Has anyone seen anything from ANY other IP besides

213.209.159.55?

38.134.148.238 167.148.88.236 51.158.203.95 178.16.54.11 these were mentioned earlier in the day

the first 2 are from a different exploit attempt... (LDAP exploit) unsure of the second 2

Thanks for the replies - yeah I have the others in the blocks from the other day. Thank goodness for Geoblocking - most of my clients seeing the traffic drop at the firewall

what's the country of origin?

Netherlands

oof

Yeah, that's a problem if your EU based.

I see 213.209.159.55 as Germany?

Hmmm Fair! Not sure what the FW is smoking then.

I saw a URL early this AM: hxxps://f.pylrk.cc/i77AMHeTM1Z7892K/s_sh