Skip to main content
UnknownPublished

tlp clear · KRVTZ-NET IDS alerts for 2026-05-13

Affects tlp clearSource CIRCL OSINT Feed

0

TLP:CLEAR, disclosure is not limited

Mentions 2 CVEs

Mentioned vulnerabilities

Description

The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.

Indicators of compromise

IP addresses 14

  • 166.88.169.211ET SCAN Exabot Webcrawler User Agent
  • 82.29.236.223ET SCAN Exabot Webcrawler User Agent
  • 204.217.161.116ET SCAN Exabot Webcrawler User Agent
  • 82.23.225.94ET SCAN Exabot Webcrawler User Agent
  • 13.206.210.150ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)
  • 142.111.98.29ET SCAN Exabot Webcrawler User Agent
  • 67.227.36.235ET SCAN Exabot Webcrawler User Agent
  • 107.175.135.81ET SCAN Exabot Webcrawler User Agent
  • 64.137.42.99ET SCAN Exabot Webcrawler User Agent
  • 64.62.156.38ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)

Community reviews

Loading reviews…