# PitScaler CVE-2026-88771/88772 public-IoC IPv4 edge-blocklist # Generated 2026-10-03 18:32 UTC from https://pitscaler.com/iocs.csv # 93 IPs included; 43 IPv4 rows excluded as shared infrastructure or low-confidence leads # (Cloudflare WARP egress, shared commercial VPN exits, residential/ISP CGNAT addresses, a domain-parking IP). # Read the caveats: https://pitscaler.com/iocs.csv - attacker IPs differ per victim (Beaumont). # Blocking these is defence in depth, not incident response. A clean log proves nothing. # # Excluded: # 91.195.240.123 Associated exploit source (IFIN compiled observables) # 85.203.46.191 Reconnaissance (Lupovis) # 38.134.148.238 Tied to the 2 Oct activity, shared in the NetScaler community and carried in the # 167.148.88.236 Tied to the 2 Oct activity, shared in the NetScaler community and carried in the # 182.101.54.57 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 87.224.84.82 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 120.28.233.211 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 23.234.111.22 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 85.221.203.85 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 46.150.68.55 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 159.26.103.184 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 197.52.9.138 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 180.242.113.168 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 85.117.117.248 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 73.43.85.7 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 88.180.103.22 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 194.28.195.90 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 95.63.246.50 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 31.13.192.160 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 185.170.55.89 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 104.203.50.26 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 37.19.221.171 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 58.187.56.89 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 171.106.10.118 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 178.66.43.241 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 94.190.77.195 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 93.177.60.233 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 68.46.140.222 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 178.218.40.232 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 49.36.107.103 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 191.37.30.194 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 23.234.74.48 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 72.73.231.73 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 95.229.84.239 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 113.137.102.68 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 125.122.56.47 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 92.118.204.229 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 28-2 # 104.28.193.147 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 29 ( # 104.28.211.105 Tagged by GreyNoise for CVE-2026-88771 exploitation attempts, last seen Sep 29 ( # 104.28.215.137 Requested # 104.28.247.136 Requested # 104.28.215.136 Requested # 104.28.247.137 GetUserName request stream 10-27 Sep (Cloudflare WARP) # 4.246.63.96 5.188.206.226 8.210.67.91 8.210.119.74 8.217.173.25 8.218.219.56 23.27.143.20 23.132.164.35 31.56.197.72 34.90.151.231 38.180.81.157 44.226.128.41 44.252.255.141 45.61.136.143 45.76.34.141 45.141.21.130 45.143.167.96 45.249.89.172 47.76.63.52 47.76.92.109 47.76.102.1 47.76.132.65 47.230.224.154 47.239.205.29 47.243.125.255 54.70.59.128 62.133.62.80 64.94.85.67 64.177.93.71 64.225.103.14 66.135.19.18 66.227.183.84 68.178.160.183 70.172.58.168 77.83.199.39 78.47.24.217 78.128.113.10 78.135.96.136 80.240.22.229 82.24.212.15 82.167.14.7 89.36.231.206 89.44.80.7 95.133.231.109 104.200.67.56 104.248.74.206 104.248.244.66 130.94.20.222 130.94.42.226 130.94.106.141 134.175.71.50 137.184.91.207 137.220.53.135 138.28.234.38 138.68.21.29 138.199.200.90 139.180.152.138 142.93.85.227 142.93.205.229 143.198.7.94 144.172.108.78 149.28.29.221 149.28.58.71 149.104.78.141 153.75.82.220 154.217.251.226 157.254.167.12 158.94.209.12 159.65.104.231 162.33.178.9 162.243.36.88 165.227.201.112 167.99.111.203 170.64.176.26 172.247.44.85 173.40.135.209 173.231.39.244 176.65.148.54 177.4.12.11 185.156.46.162 185.209.15.246 185.243.41.247 193.149.176.207 194.26.29.88 194.242.130.193 195.123.233.245 198.13.159.233 199.233.217.13 206.232.71.215 209.250.236.77 213.209.159.55 216.203.21.233 216.245.184.164