FortiBleed Related Network Connections

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•5

This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes.