We have been given a list of IP addresses that are actively attempting to exploit the recent NetScaler CVEs and we are advising our clients to block the incoming traffic from these IP addresses at the firewall: # Tier 1 - attacker infrastructure + spray (block permanently, all gateways, both directions) 62.133.62.80 31.56.197.72 64.94.85.67 92.118.204.229 78.128.113.10 5.188.206.226 149.28.29.221 138.226.239.0/24 185.136.15.0/24 77.91.71.0/24 93.152.219.115 # Tier 2 - residential proxy exits (block on VPN/NetScaler-facing rule, 30-day expiry) 76.36.174.5 100.40.202.26 47.227.98.207 71.163.176.214 97.205.234.34 98.29.80.205 24.126.15.56 74.99.67.70 96.248.121.105 204.210.216.23 76.72.187.172 153.66.69.45 209.79.172.70 71.163.14.19 99.110.24.72 45.36.42.217 66.188.65.11 173.77.155.230 73.22.64.16 172.58.208.58 199.79.241.36 68.99.0.48 67.224.124.236 74.244.147.208 142.129.220.168 184.12.39.60 # Domain (FQDN object / URL Filtering, egress) entretiensol.com We can also enter them on the NetScalers themselves but it would be best to drop the traffic at the edge. Let me know if you have any questions.

I can add the following that have been extracted from several logs across multiple customers still doing those 'pitboss' login requests today: 23.132.164.35 64.94.85.67 103.149.225.82 79.133.42.141 85.11.187.35 185.156.46.162 154.217.251.226

Yep, seen plenty of pitbosses trying to login today, but no other IP's than what you both have specified, thank you for sharing. :)

Thanks for sharing

@Richard Faulkner Is this a Citrix provided list, or cumulative list based on the logs from your various customers?

From one of the M7 partners. Collated from what we’ve seen in the logs.

how do you guys typically block them? on the NS itself via policy?

We are recommending our customers block the addresses I posted in the channel on their firewall and NetScalers.

23.27.143.20 is another one, it's also seen from someone else in another thread

89.44.80.7 I found this one, along with the one Brandon saw.

image.png