Last Week in Threats Banner

Last Week in Threats: Week 45

Published on November 9, 2026 | By Focused Hunts

Bottom Line

What changed this week: Hosting infrastructure hosted three-quarters of the week's flagged attacker addresses, with nine of 12 IPs originating from commercial hosting rather than residential networks (AbuseIPDB, pulled 2026-11-09). Ransomware postings rose 5.9% to 234, led by N0n with 49 victims, while AI endpoints faced 2,196 attacker addresses.

Who is most exposed: Organizations running WordPress Core face a race-condition vulnerability already three days past CISA's remediation deadline, and defenders monitoring AI endpoints confront mass scanning and credential harvesting from 721 automated scanners (AI Honeypot Observatory, pulled 2026-11-09).

Recommended action: Patch CVE-2026-119977 immediately, audit hosting-origin traffic for credential testing and web-app attacks, and monitor AI endpoint authentication logs for enumeration patterns. Review the environment sweep queries below against the week's risk-ranked indicators.

Week in Review

The week of November 2 to 8, 2026 demonstrated that attackers continue to favor hosting infrastructure over residential networks for malicious operations. Commercial hosting providers accounted for three-quarters of the week's most-reported IP addresses, including two addresses on AS47890 (UNMANAGED LTD) that together drew 175,683 AbuseIPDB reports for credential brute-force, bot activity and port scanning (RIPEstat for network ownership, AbuseIPDB for abuse classification, pulled 2026-11-09).

Ransomware groups posted 234 victims, a 5.9% increase from the prior week's 221, with N0n emerging as the dominant actor with 49 victim postings (ransomware.live, pulled 2026-11-09). CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog, including a WordPress Core time-of-check time-of-use race condition that had already passed its November 6 deadline when this edition published. AI endpoint honeypots recorded 2,196 attacker addresses, with 1,394 newly active this week and 721 conducting mass scanning operations targeting LLM providers (AI Honeypot Observatory, pulled 2026-11-09).

Ransomware Activity

N0n led ransomware activity with 49 victim postings, marking the group's first appearance in the top ranks since September 2026 (ransomware.live total victims: 215, first seen 2026-09-18). Akira and MedusaLocker each posted 17 victims, while Qilin dropped from 42 victims the prior week to 16, a 61.9% decline. The top 10 welcomed seven new groups for the first time, displacing Booba Project, Whitearmor, genesis, rhysida, thegentlemen, payload and emperador.

Organizations in the United States accounted for 89 of the week's 234 victims, with Germany and Canada following at 15 and 10 victims respectively. The victim-location field carried 43 unknown entries, representing gaps in the feed's geographic classification (ransomware.live, pulled 2026-11-09).

Most Active Groups by Victim Postings

Victim Postings by Week

Most Active Groups by Victim Postings

N0n 49 akira 17 medusalocker 17 qilin 16 BrainCipher 12 incransom 11 safepay 10 SilentRansomGroup 10

Victim Postings by Week

242 W33 242 W34 207 W35 166 W36 162 W37 185 W38 146 W39 215 W40 197 W41 292 W42 203 W43 221 W44 234 W45

Sector and Technology Watch

Manufacturing bore the heaviest ransomware impact with 35 victims, followed by professional services at 26, and technology and healthcare each at 22. Retail and hospitality organizations accounted for 14 victims, while financial services recorded 12. The feed left 83 victims unclassified, a gap that prevents sector analysis for more than one-third of the week's activity (ransomware.live, pulled 2026-11-09).

Technology exposure concentrated on CMS platforms, consumer devices and network edge appliances. CISA's new Known Exploited Vulnerabilities entries targeted WordPress Core, Apple's cross-product authentication flows, and SonicWall's SonicOS SSLVPN single-factor authentication handling.

Most-Targeted Industries

Most-Targeted Industries

Manufacturing 35 Professional Services 26 Technology 22 Healthcare 22 Retail Hospitality 14 Financial Services 12 Transportation 6 Education 5

IOC Watch

AbuseIPDB's most-reported addresses drew reports for credential brute-force, bot activity, port scanning, SSH attacks and web-app exploitation. Half the flagged addresses drew more than 2,000 reports each.

  • 2.57.121.112 (RO): AS47890 UNMANAGED LTD, hosting, 122,476 reports, also flagged by GreyNoise Community (malicious)
  • 92.118.39.77 (RO): AS47890 UNMANAGED LTD, ISP DMZHOST, hosting, 53,207 reports, also flagged by GreyNoise Community (malicious)
  • 77.87.40.114 (UA): AS44668 ZNET Zubko Volodymyr Viktorovych, residential, 7,119 reports, also flagged by GreyNoise Community (malicious)
  • 176.65.148.216 (NL): AS51396 Pfcloud UG (haftungsbeschrankt), hosting, 3,006 reports
  • 172.236.102.250 (US): AS63949 Akamai Connected Cloud, ISP Linode, hosting, 2,966 reports, also flagged by SANS ISC DShield sensors
  • 173.255.242.196 (US): AS63949 Akamai Connected Cloud, ISP Linode, hosting, 2,855 reports, also flagged by SANS ISC DShield sensors
  • 129.121.126.188 (US): AS31898 Oracle Corporation, ISP Oso Grande IP Services, LLC, hosting, 2,807 reports, also flagged by GreyNoise Community (malicious) and SANS ISC DShield sensors
  • 122.165.162.117 (IN): AS24560 Bharti Airtel Ltd., Telemedia Services, ISP ABTS Tamilnadu,, residential, 2,199 reports, also flagged by GreyNoise Community (malicious) and SANS ISC DShield sensors
  • 72.24.210.245 (US): AS11492 CABLE ONE, INC., residential, 103 reports
  • 34.95.132.117 (BR): AS396982 Google LLC, hosting, 100 reports
  • 165.22.190.114 (US): AS14061 DigitalOcean, LLC, hosting, 65 reports
  • 34.88.214.241 (FI): AS396982 Google LLC, hosting, 59 reports

Attacker Infrastructure

Hosting providers owned nine of the week's 12 most-reported addresses, with three residential connections appearing among the flagged infrastructure (RIPEstat for network ownership, AbuseIPDB for usage classification). AS47890 (UNMANAGED LTD) hosted two addresses that together accounted for 175,683 reports. None of the 12 checked addresses appeared in abuse.ch ThreatFox or URLhaus as active command-and-control or malware-hosting infrastructure during the collection window.

Hosting Providers

  • AS47890 UNMANAGED LTD: 2.57.121.112, 92.118.39.77
  • AS63949 Akamai Connected Cloud: 172.236.102.250, 173.255.242.196
  • AS51396 Pfcloud UG (haftungsbeschrankt): 176.65.148.216
  • AS31898 Oracle Corporation: 129.121.126.188
  • AS396982 Google LLC: 34.95.132.117, 34.88.214.241
  • AS14061 DigitalOcean, LLC: 165.22.190.114

Residential Networks

  • AS44668 ZNET Zubko Volodymyr Viktorovych: 77.87.40.114
  • AS24560 Bharti Airtel Ltd., Telemedia Services: 122.165.162.117
  • AS11492 CABLE ONE, INC.: 72.24.210.245

Vulnerability Watch

CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog. CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition, had already passed its November 6 due date by three days when this edition published (CISA KEV, pulled 2026-11-09). The vulnerability drew 16 AlienVault OTX threat intelligence pulses and carries a FIRST EPSS score of 0.012, placing it in the 67th percentile for predicted exploitation probability as of November 9, 2026.

CVE-2024-27834 affects Apple's cross-product authentication flows, with a due date of November 18 and 14 OTX pulses. CVE-2026-19868 exposes SonicWall's SonicOS SSLVPN to single-factor authentication bypass, with a November 20 deadline and four OTX pulses. None of the three carries confirmed ransomware-campaign use in CISA's metadata, though KEV inclusion confirms active exploitation in each case.

Malware and C2 Infrastructure

Abuse.ch ThreatFox recorded 11,999 total indicators of compromise during ISO week 2026-W45 (November 2 to 8, 2026, first-seen date), with 3,790 fresh command-and-control addresses (abuse.ch ThreatFox, pulled 2026-11-09). The AMOS infostealer family accounted for 1,837 indicators, followed by generic unknown malware at 1,758 and unknown loaders at 1,582. Vidar drew 805 indicators, while ClearFake and IClickFix recorded 765 and 705 respectively.

The sampled C2 addresses showed overlap with AbuseIPDB's abuse reports, with two of 10 appearing in both feeds during the same window, indicating attacker infrastructure that serves dual purposes for both malware operations and other malicious activity (AbuseIPDB, checked against abuse.ch sources, pulled 2026-11-09).

  • Active C2 servers also reported for abuse: two servers of 10 checked against AbuseIPDB

AI Endpoint Attacks

AI endpoint honeypots recorded 2,196 attacker addresses during the week, with 1,394 newly active and 641 persistent from prior weeks (AI Honeypot Observatory, local running record, pulled 2026-11-09). MITRE ATT&CK technique T1595.002 (Active Scanning: Vulnerability Scanning) led activity with 1,372 addresses, followed by T1046 (Network Service Discovery) at 765 addresses and T1552.001 (Unsecured Credentials: Credentials In Files) at 694. Mass scanning, credential harvesting and enumeration operations dominated the attack surface facing LLM providers and AI service endpoints.

  • New this week: 1,394 addresses
  • Persistent from last week: 641 addresses
  • Returning after a gap: 161 addresses
  • Gone quiet since last week: 1,489 addresses
  • Active three or more weeks running: 342 addresses

AI-Endpoint Attacker Categories

Scanner Mass 721 Credential Harvester 562 Scanner Enum 345 Relay Customer 262 Research Scanner 252 Mcp Scanner 25 Identity Prober 14 Relay Verifier 10

Hunting Takeaway

Hunt for hosting-origin infrastructure conducting brute-force authentication attempts, web-application attacks or enumeration scans against externally facing services. Focus on addresses originating from commercial hosting autonomous systems rather than consumer ISPs, particularly when authentication failures or rate-limit violations concentrate within narrow time windows. This pattern reflects the week's finding that three-quarters of the most-reported attacker addresses operated from hosting networks, enabling adversaries to leverage dedicated infrastructure for credential testing and vulnerability scanning at scale.

Splunk SPL Query

index=* (source="XmlWinEventLog:Security" OR source="WinEventLog:Security" OR tag=authentication) earliest=-7d
| eval src_type=if(match(src_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), "internal", "external")
| where src_type="external" AND action="failure"
| stats count AS failure_count, dc(user) AS unique_accounts, earliest(_time) AS first_seen, latest(_time) AS last_seen by src_ip, dest
| eval duration_seconds=last_seen - first_seen
| where failure_count > 50 AND duration_seconds < 3600
| sort - failure_count
| table src_ip, dest, failure_count, unique_accounts, duration_seconds

Microsoft KQL Query

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != "0"
| where IPAddress !startswith "10." and IPAddress !startswith "172.16." and IPAddress !startswith "192.168."
| summarize FailureCount = count(), UniqueAccounts = dcount(UserPrincipalName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by IPAddress, AppDisplayName
| extend DurationSeconds = datetime_diff('second', LastSeen, FirstSeen)
| where FailureCount > 50 and DurationSeconds < 3600
| order by FailureCount desc
| project IPAddress, AppDisplayName, FailureCount, UniqueAccounts, DurationSeconds

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Environment Sweep

The queries below check for the week's 15 risk-ranked attacker addresses, 10 domains and 10 file hashes from ThreatFox, and the three CISA Known Exploited Vulnerabilities entries. Risk ranking prioritizes live command-and-control infrastructure first, then independent-source agreement and AbuseIPDB report volume, with benign research scanners excluded. The patch checks cover CVE-2026-119977 (WordPress Core), CVE-2024-27834 (Apple cross-product authentication) and CVE-2026-19868 (SonicWall SSLVPN).

No query results do not mean no threat. The sweep targets known indicators from this week's intelligence, but adversaries operate infrastructure not yet reported and exploit vulnerabilities outside the KEV catalog.

Sweep for this week's malicious IPs

Splunk (CIM Network_Traffic)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Traffic.All_Traffic
    where earliest=-30d (All_Traffic.dest_ip IN ("2.57.121.112", "92.118.39.77", "185.7.214.97", "50.16.16.211", "134.122.62.90", "113.31.109.95", "111.170.148.132", "31.56.19.10", "2.26.225.39", "45.13.232.234", "129.121.126.188", "77.87.40.114", "122.165.162.117", "172.236.102.250", "173.255.242.196") OR All_Traffic.src_ip IN ("2.57.121.112", "92.118.39.77", "185.7.214.97", "50.16.16.211", "134.122.62.90", "113.31.109.95", "111.170.148.132", "31.56.19.10", "2.26.225.39", "45.13.232.234", "129.121.126.188", "77.87.40.114", "122.165.162.117", "172.236.102.250", "173.255.242.196"))
    by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action
| rename All_Traffic.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepIPs = dynamic(["2.57.121.112", "92.118.39.77", "185.7.214.97", "50.16.16.211", "134.122.62.90", "113.31.109.95", "111.170.148.132", "31.56.19.10", "2.26.225.39", "45.13.232.234", "129.121.126.188", "77.87.40.114", "122.165.162.117", "172.236.102.250", "173.255.242.196"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP, RemotePort, ActionType
| order by Hits desc

Microsoft Sentinel (firewall and proxy logs via CEF)

let SweepIPs = dynamic(["2.57.121.112", "92.118.39.77", "185.7.214.97", "50.16.16.211", "134.122.62.90", "113.31.109.95", "111.170.148.132", "31.56.19.10", "2.26.225.39", "45.13.232.234", "129.121.126.188", "77.87.40.114", "122.165.162.117", "172.236.102.250", "173.255.242.196"]);
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationIP in (SweepIPs) or SourceIP in (SweepIPs)
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DeviceAction
| order by Hits desc

Sweep for this week's C2 and payload domains

Splunk (CIM Network_Resolution)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Network_Resolution.DNS
    where earliest=-30d DNS.query IN ("maplemesh9.com", "quill-95.com", "anvil13.com", "verse-38.com", "schemaleap1.com", "cube-60.com", "nimbus-58.com", "fern46.com", "stealer.greatfinds.life", "super-fourteen33.cc")
    by DNS.src DNS.query DNS.answer
| rename DNS.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepDomains = dynamic(["maplemesh9.com", "quill-95.com", "anvil13.com", "verse-38.com", "schemaleap1.com", "cube-60.com", "nimbus-58.com", "fern46.com", "stealer.greatfinds.life", "super-fourteen33.cc"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (SweepDomains)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteUrl, RemoteIP
| order by Hits desc

Sweep for this week's malware hashes

Splunk (CIM Endpoint.Filesystem)

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Endpoint.Filesystem
    where earliest=-30d Filesystem.file_hash IN ("011a016cc4a39bc4c37c847808eb9412789467906fd0e74fc95face38bf49bad", "ae83866601ca30c7bc548257e02ecb5ae862512f572211ff5bc89aa0d7a19279", "393a188fb0873f9eaa7f1c383c38ed833f7eb0a626914b46f9c6bbe8504072fc", "5438372cfdfd2e56f4f11aba3a30877a7bd9ca9a355006a6da882f1caa81292c", "f7505697f2fa39e5c967fd2f8a9a31fc3ea570321dbd7a41e89135a621701325", "0f29610d1022f8c529781d9bdcc1634828db99fe3f2d5a85672211373332133a", "6899de02275212137c073a02bd57f43446dd2955db7b7cece2e8adcd5440253b", "1555a21dbe82c51a03ce2488accdb2a8abd3a6672474e916cebb356b8f4fe90e", "25ff6fa2d367dd982268264a5dd1184e484ba75f29993e793b637e90cf172193", "9762c3c56cdf66caf86b9e676216a2cb98b5b32c4eb175cd9e32041b7491aa4e")
    by Filesystem.dest Filesystem.file_path Filesystem.file_name Filesystem.file_hash
| rename Filesystem.* AS *
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft Defender XDR (advanced hunting)

let SweepHashes = dynamic(["011a016cc4a39bc4c37c847808eb9412789467906fd0e74fc95face38bf49bad", "ae83866601ca30c7bc548257e02ecb5ae862512f572211ff5bc89aa0d7a19279", "393a188fb0873f9eaa7f1c383c38ed833f7eb0a626914b46f9c6bbe8504072fc", "5438372cfdfd2e56f4f11aba3a30877a7bd9ca9a355006a6da882f1caa81292c", "f7505697f2fa39e5c967fd2f8a9a31fc3ea570321dbd7a41e89135a621701325", "0f29610d1022f8c529781d9bdcc1634828db99fe3f2d5a85672211373332133a", "6899de02275212137c073a02bd57f43446dd2955db7b7cece2e8adcd5440253b", "1555a21dbe82c51a03ce2488accdb2a8abd3a6672474e916cebb356b8f4fe90e", "25ff6fa2d367dd982268264a5dd1184e484ba75f29993e793b637e90cf172193", "9762c3c56cdf66caf86b9e676216a2cb98b5b32c4eb175cd9e32041b7491aa4e"]);
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (SweepHashes)
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Paths = make_set(FolderPath, 10) by DeviceName, FileName, SHA256
| order by Hits desc

Check exposure to this week's KEV additions

Microsoft Defender Vulnerability Management

let PatchCVEs = dynamic(["CVE-2026-119977", "CVE-2024-27834", "CVE-2026-19868"]);
DeviceTvmSoftwareVulnerabilities
| where CveId in (PatchCVEs)
| summarize Devices = dcount(DeviceId), DeviceNames = make_set(DeviceName, 20) by CveId, SoftwareVendor, SoftwareName, VulnerabilitySeverityLevel, RecommendedSecurityUpdate
| order by Devices desc

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.

Related Resources

Appendix: Raw Tables

Top Ransomware Groups

ransomware.live, pulled 2026-11-09

GroupVictim CountChange from Prior Week
N0n49new to the top ranks
akira17new to the top ranks
medusalocker17new to the top ranks
qilin16-26 (-61.9%)
BrainCipher12new to the top ranks
incransom11new to the top ranks
safepay10+1 (+11.1%)
SilentRansomGroup10-2 (-16.7%)
metaencryptor7new to the top ranks
Deadlock6new to the top ranks

Most-Reported Malicious IPs

AbuseIPDB 100% confidence, pulled 2026-11-09; network ownership from RIPEstat (RIR registry data); scan verdict from GreyNoise Community

IP AddressCountryOrigin TypeASN / OwnerTotal ReportsReportersLast ReportedGreyNoise
2.57.121.112ROhostingAS47890 UNMANAGED LTD12247610752026-11-09malicious
92.118.39.77ROhostingAS47890 UNMANAGED LTD5320717082026-11-09malicious
77.87.40.114UAresidentialAS44668 ZNET Zubko Volodymyr Viktorovych711913522026-11-09malicious
176.65.148.216NLhostingAS51396 Pfcloud UG (haftungsbeschrankt)30061222026-11-09unknown
172.236.102.250UShostingAS63949 Akamai Connected Cloud29661772026-11-09unknown
173.255.242.196UShostingAS63949 Akamai Connected Cloud28551612026-11-09unknown
129.121.126.188UShostingAS31898 Oracle Corporation280710632026-11-09malicious
122.165.162.117INresidentialAS24560 Bharti Airtel Ltd., Telemedia Services21992472026-11-09malicious
72.24.210.245USresidentialAS11492 CABLE ONE, INC.103622026-11-09unknown
34.95.132.117BRhostingAS396982 Google LLC100792026-11-09unknown
165.22.190.114UShostingAS14061 DigitalOcean, LLC65472026-11-09unknown
34.88.214.241FIhostingAS396982 Google LLC59462026-11-09unknown

Attacker Networks

network ownership from RIPEstat (RIR registry data), report volume from AbuseIPDB, pulled 2026-11-09

ASNProvider / ISPOrigin ClassIP CountTotal Reports
AS47890UNMANAGED LTDhosting2175683
AS63949Akamai Connected Cloudhosting25821
AS396982Google LLChosting2159
AS44668ZNET Zubko Volodymyr Viktorovychresidential17119
AS51396Pfcloud UG (haftungsbeschrankt)hosting13006
AS31898Oracle Corporationhosting12807
AS24560Bharti Airtel Ltd., Telemedia Servicesresidential12199
AS11492CABLE ONE, INC.residential1103
AS14061DigitalOcean, LLChosting165

New KEV Additions

CISA Known Exploited Vulnerabilities catalog, pulled 2026-11-09; in-the-wild pulse counts from AlienVault OTX; exploitation probability from FIRST EPSS, as of 2026-11-08

CVEVendor / ProductVulnerability TypeDate AddedDue DateEPSS
CVE-2026-119977WordPress WordPress CoreWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (16 OTX pulses)2026-11-032026-11-060.01 (67th pct)
CVE-2024-27834Apple Multiple ProductsApple Multiple Products Improper Authentication Vulnerability (14 OTX pulses)2026-11-042026-11-180.02 (74th pct)
CVE-2026-19868SonicWall SonicOS SSLVPNSonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (four OTX pulses)2026-11-062026-11-200.01 (50th pct)

Top Malware Families

abuse.ch ThreatFox, ISO week 2026-W45 (2026-11-02 to 2026-11-08), first-seen date

FamilyIOC Count
AMOS1837
Unknown malware1758
Unknown Loader1582
Vidar805
ClearFake765
IClickFix705
Mirai551
VShell357
WARDENStealer286
SalatStealer213

AI-Endpoint Attacker IOCs

AI Honeypot Observatory, Focused Hunts running record of 1-day pulls, pulled 2026-11-09; INFRA-COLLISION rows excluded; Peak Daily Hits is the single busiest day this week

IP AddressActor CategoryConfidenceMITRE TTPsThis WeekPeak Daily HitsFirst Observed
35.255.146.207SCANNER-MASSvery-highT1595.002, T1595.003, T1190, T1552.001, T1496.001new135142026-11-03
103.39.108.200SCANNER-MASSvery-highT1046, T1102, T1078, T1496.001, T1595.002, T1595.003, T1592.002persistent65482026-10-29
51.79.207.222SCANNER-MASSvery-highT1595.002, T1496.001new57112026-11-05
167.233.74.146SCANNER-MASSvery-highT1595.002, T1595.003new41962026-11-05
83.228.229.77SCANNER-ENUMvery-highT1046, T1102, T1595.002persistent37792026-10-13
154.37.208.58SCANNER-MASSvery-highT1046, T1595.002persistent32082026-09-10
43.156.79.80RELAY-VERIFIERvery-highT1046, T1102, T1078, T1496.001persistent30952026-09-10
45.112.149.170SCANNER-MASSvery-highT1046, T1102, T1496.001persistent27262026-10-11
194.180.49.41CREDENTIAL-HARVESTERvery-highT1046, T1552.001persistent25822026-10-27
102.220.163.241CREDENTIAL-HARVESTERvery-highT1046, T1552.001persistent23812026-10-26
176.144.10.198SCANNER-ENUMvery-highT1046, T1102, T1595.002persistent23042026-10-22
89.35.130.127SCANNER-MASSvery-highT1595.002, T1595.003persistent20452026-11-01
78.174.210.99RELAY-CUSTOMERvery-highT1046, T1102, T1595.002, T1496.001persistent17442026-10-28
104.168.115.214RELAY-VERIFIERvery-highT1046, T1592, T1102, T1078, T1592.002persistent9572026-09-10
32.216.141.74SCANNER-MASSvery-highT1046, T1102, T1595.002, T1496.001persistent2862026-09-26
51.79.191.234RELAY-CUSTOMERvery-highT1046, T1102, T1078, T1496.001persistent1582026-10-21
101.42.172.53RELAY-CUSTOMERvery-highT1046, T1102, T1595.002persistent1442026-09-10
149.28.142.11IDENTITY-PROBERvery-highT1046, T1592, T1102, T1595.002, T1496.001, T1592.002persistent1132026-09-11
188.253.127.228RELAY-CUSTOMERvery-highT1046, T1102, T1496.001returning442026-09-26
38.55.133.49CREDENTIAL-HARVESTERvery-highT1046, T1102, T1595.002, T1552.001persistent92026-10-12
161.114.15.176SCANNER-MASShighT1595.002, T1496.001persistent19582026-11-01
84.247.152.177RELAY-CATALOGERhighT1046, T1102, T1496.001returning13872026-09-19
185.195.233.186RELAY-CUSTOMERhighT1046, T1102, T1496.001persistent13802026-10-30
212.107.30.203RELAY-CUSTOMERhighT1046, T1102, T1552.001, T1496.001, T1595.002persistent13612026-09-11
13.140.200.70SCANNER-MASShighT1595.002, T1595.003, T1496.001, T1552.001new13472026-11-03

Methodology and Sources

This report is built entirely from open-source threat intelligence: public ransomware leak-site activity, community IP-reputation data, internet-scanner context, registry network ownership and hosting-type classification of the reported addresses, the government catalog of actively exploited vulnerabilities, community exploitation-probability scores, malware and command-and-control indicator feeds, and honeypot observations of attacks on AI service endpoints. Figures are aggregated across these public sources, cross-referenced, and captured as a point-in-time snapshot. They are aggregate public statistics, not original Focused Hunts detections, and each traces back to its source and to the raw snapshot retained for this edition.

Confirmed listings are kept separate from actor claims, and partial counts are reported as a floor. Week-over-week trends are drawn once successive snapshots support them.

Reported addresses that belong to known benign infrastructure (internet-measurement scanners confirmed by forward DNS, search and AI crawlers inside their operators' published ranges, and addresses GreyNoise classifies benign) are left out of the attacker figures and listed under the IP table instead.

Feeds unavailable for this edition: RansomLook (corroborate_groups() missing 1 required positional argument: 'look_groups'). The affected sections are omitted rather than estimated.

← Back to Last Week in Threats