FortiBleed Related Network Connections

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•6

This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including aggregator/C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems or active exploitation attempts related to FortiBleed.