Observable: Observed IPs Attempting to Log In to GlobalProtect Portals
Observable Type: IP List
Details:
badIps.txt (165.0 KB)
2 Likes
Oh nice! Right into the blocklist they go.
Careful though. Some are residential IPs so it’s possible you’ll block legitimate remote users who don’t realize that their router / camera / TV / etc. is part of a botnet or ORB. Obviously that’s a business risk decision but something for people to be aware of.
1 Like
What was the provenance of these?
Observed by me in prod and honeypot GlobalProtect portals. These aren’t just scanners, they all attempted to log in with creds and were not legitimate for the systems they were attempting to access.
Edit to test the edit function: They were all observed within the past two weeks.
1 Like