Conversation

Notices

1. Embed this notice
   cR0w :cascadia: (cr0w@infosec.exchange)'s status on Tuesday, 01-Apr-2025 06:38:01 JST cR0w :cascadia:

   • boB Rudis 🇺🇦
   • GreyNoise

   Following up on the scanning and password spraying that @hrbrmstr and @greynoise have posted about today, I combined a list of IPs I'm seeing going after Palo Alto GlobalProtect with the Greynoise lists:

   https://cascadiacrow.com/globalprotectips.txt

   I also have a list of usernames attempted by those various IP addresses:

   https://cascadiacrow.com/globalprotectusernames.txt

   #threatIntel #gayInt

   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Tuesday, 01-Apr-2025 06:38:00 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     • boB Rudis 🇺🇦
     • GreyNoise

     @cR0w @hrbrmstr @greynoise 🐐

   • Embed this notice
     cR0w :cascadia: (cr0w@infosec.exchange)'s status on Tuesday, 01-Apr-2025 06:38:01 JST cR0w :cascadia:

     in reply to

     • boB Rudis 🇺🇦
     • GreyNoise

     @hrbrmstr @greynoise Since it's already 1 April in parts of the world, I feel like need to assure you that the links are real text lists and not ASCII anuses or anything. This time.

   • Embed this notice
     cR0w :cascadia: (cr0w@infosec.exchange)'s status on Tuesday, 01-Apr-2025 06:39:35 JST cR0w :cascadia:

     in reply to

     • Ryan Castellucci :nonbinary_flag:
     • boB Rudis 🇺🇦
     • GreyNoise

     @ryanc @hrbrmstr @greynoise