Calyptix Community Shield - Log4j Active Exploitation IPs

calyptix-log4j-active-exploitation.csv

This is a curated list of IP addresses that are exploiting the Log4j vulnerability as seen by Calyptix Security's Community Shield service. Community Shield runs on Calyptix Security's firewalls and monitors and protects the networks of thousands of businesses and organizations.

The exploitation attempts from these IP addresses triggered alerts from Proofpoint's Emerging Threats ruleset. We wish to thank Proofpoint for providing the rules that made it possible to detect various types of Log4j exploitation attempts.

In order to avoid providing redundant data, we are excluding IP addresses from these lists (at the time our list was created): GreyNoise, Microsoft, and CrowdSec.

The first_seen_utc and last_seen_utc fields are provided to help you decide whether to include or exclude the IP addresses in your own environment.

We hope that these IPs will help you secure your environment from Log4j exploitation attempts. If you have any feedback about the list, please feel free to comment below, or tweet us @calyptix.

• The Calyptix Community Shield team

We have also published some interactive Log4j dashboards! These are updated hourly:

https://www.calyptix.com/press-releases/community-shield-dashboard-log4j/