Weekly Report for 2026-08-08 to 2026-08-15

STIX2 Threat Intelligence Feeds (21,422 indicators this week)

Weekly Intelligence Summary

Weekly Comparison

Threat Score Distribution

Average threat score across all tracked IPs: 17.8/100

Attacks by Destination

Attacks By Country & ASN

Attacks By Protocol

MITRE ATT&CK Techniques

Cloud Provider Abuse

Top Attacking Networks

Attack Classification Tags

Phishing Domains by Category

Top SSH Bruteforce Usernames

Infrastructure Analysis

Anonymous Proxy Hosts

No proxy data available.

Emerging Threats (Last 24h)

IP Address	Threat Score	Country	Tags
107.189.8.65	100	Luxembourg	attack Bruteforce Brute-Force cowrie cve202229266 cyber security
185.94.111.1	100	Russia	Alaska cowrie ddos denial of service IPs Attacking Alaskan Hosts malicious
193.107.216.228	100	Hong Kong	bruteforce cyber security digital ocean Energy ICS ioc
193.46.255.60	100	Romania	awsau awsbah awsindia awsjap blacklist botnet
92.63.196.25	100	Russia	admin blacklist botnet brute force Energy green
92.63.196.61	100	Russia	admin blacklist botnet brute force Energy green
89.248.165.202	100	Netherlands	Alaska auto-generated security botnet green IPs Attacking Alaskan Hosts kfsensor
5.61.11.123	100	Russia	blacklist botnet cyber security Energy green ICS
154.89.5.86	100	Hong Kong	cyber security ioc malicious Nextray phishing Scanner
183.136.226.3	100	China	brute force cyber security Energy green ICS ioc
183.136.226.4	100	China	bruteforce cyber security digital ocean Energy green ICS
176.192.99.26	100	Russia	attack awsau bruteforce cyber security Energy green
144.172.118.37	100	United States	attack cve202229266 cyber security description description ip indicator
209.141.34.39	100	United States	Bruteforce Brute-Force cowrie cyber security ioc LokiBot
45.146.165.165	100	Russia	Bot Exploit IOC Malware Nextray Scanner
45.143.203.3	100	Ukraine	admin blacklist botnet green Malicious IP mirai
89.248.163.140	100	United Kingdom	auto-generated security Brute force count cyber security ioc kfsensor
104.16.18.94	100		0 report 10357 aaaa abuse contact accept access ta0001
45.143.200.50	100	Russia	admin Alaska alienvault blacklist botnet cyber security
80.254.126.75	100	Russia	cyber security green ioc kfsensor malicious Nextray

Highest Risk Networks

Network	Risk Score	IPs	Risk Level
AS60729 zwiebelfreunde e.v.	85	16
AS210731 forening for dotsrc	84	11
AS4224 the calyx institute	81	21
AS208294 cia triad security llc	69	116
AS396507 emerald onion	62	34
AS1101 surfnet bv	59	38
AS57724 ddos guard ltd	53	20
AS15736 mobile business solution mbs llp	49	11
AS138740 citylink broadbnad services pvt ltd	48	13
AS137280 kingsoft cloud corporation limited	48	102
AS206264 amarutu technology ltd	46	11
AS39351 31173 services ab	45	15
AS202660 uzbektelekom joint stock company	45	17
AS58541 qingdao 266000	45	176
AS263333 vipturbo comrcio & servios de informtica ltda	45	32

Web Exploit Detection Summary

Source	Rule	Events	Unique IPs	CVEs
ET	ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML	746	52	—
LOCAL	LOCAL AWS Credentials File Grab Attempt	596	73	—
LOCAL	LOCAL PHP Source Backup File Grab Attempt	320	58	—
LOCAL	LOCAL Spring Boot Actuator Sensitive Endpoint Probe	227	53	—
ET	ET WEB_SERVER WEB-PHP phpinfo access	222	42	CVE-2002-1149
ET	ET WEB_SPECIFIC_APPS Rails Arbitrary File Disclosure Attempt	184	32	CVE-2019-5418
ET	ET WEB_SERVER Likely Malicious Request for /proc/self/environ	88	39	—
ET	ET EXPLOIT [FIREEYE] Suspicious Pulse Secure HTTP Request (CVE-2021-22893) M1	84	2	CVE-2021-22893
ET	ET SCAN ELF/Mirai Variant User-Agent (Inbound)	76	8	—
ET	GPL WEB_SERVER .htpasswd access	49	31	—
ET	ET WEB_SERVER /etc/passwd Detected in URI	39	21	—
ET	ET WEB_SPECIFIC_APPS IBM Langflow Auto-Login Bypass (CVE-2026-9198)	38	9	CVE-2026-9198
ET	ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)	36	8	—
ET	ET SCAN Suspicious User-Agent Containing Web Scan/er Likely Web Scanner	30	1	—
LOCAL	LOCAL Ivanti Connect Secure Admin Interface Probe	29	2	CVE-2024-21887
ET	ET SCAN SFTP/FTP Password Exposure via sftp-config.json	28	10	—
ET	ET WEB_SPECIFIC_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M1	23	6	CVE-2022-22274 CVE-2023-0656
LOCAL	LOCAL Microsoft Exchange ECP Admin Probe (ProxyShell/ProxyLogon)	22	3	CVE-2021-26855
LOCAL	LOCAL VMware vCenter SDK API Probe	22	11	CVE-2021-22005
ET	ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt	21	11	—

CVE Exploitation Activity

Web Exploit Attacker Countries (176 IPs)

OpenCLAW Dashboard Intelligence