Has anyone taken to reporting IPs to the providers...
# citrix-netscalerj
Jeff Riechers
10/05/2026, 1:08 PMHas anyone taken to reporting IPs to the providers that are hosting attack attempts? Have only 1 ip that isn't in our other blocking methods that has been hammering a netscaler for the past 24 hours and reported it.
Jeff Riechers
10/05/2026, 1:10 PMIf you have NetScaler Console setup as syslog for your gateways, this is a good search string to find pitboss attack attempts. Message ~ "Authentication is rejected for pitboss PPE unexpectedly died"
j
Julian Jakob
10/05/2026, 1:20 PMYeah I did some reportings to Opentext / Brightcloud in the last three days via support.threatintel.opentext.com/tools/url-ip-lookup.php after about one hour, they responded and changed the IP's to Bad / Scanners 🙂
❤️ 1