Observable: Password spray and brute force attacks against VPNs and remote access portals
Observable Type: IPv4 addresses
Rating: B2
TLP:Clear
Details:
IP addresses have been recently observed attempting to illegitimately log in to corporate and honeypot portals. There are commercial VPN endpoints and residential proxy VPN IPs in the list so it is meant to be used more for hunting than an outright block, though I encourage you to at least consider blocking inbound access to portals and VPNs from such networks anyway.
vpnPortalNaughtyIps20260423.txt (287.8 KB)