48.217.233.95
blockedBruteRegular
Case file
First seen on 2026-10-04T19:06:41Z, most recently active on 2026-10-05T04:47:28Z.
Recorded 15 attack-shaped requests across 2 separate days.
Its traffic triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt.
Seen on our edge sensor.
Scored into the "Brute" level, carrying the badge Regular.
Routed via AS8075 (Microsoft Corporation), an ASN we classify as cloud.
Blocked by the firewalls on our servers since 2026-10-05T05:10:04Z, through 2027-01-03T05:10:04Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS8075 — Microsoft Corporation |
| ASN type | cloud |
| Country | United States (US) |
| Flags | none observed |
Timeline
- 2026-10-0412
- 2026-10-053
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T04:47:28Z | edge | servbg.dev | 3 × triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt | POST /api (3 distinct paths) | |
| 2026-10-04T23:07:15Z – 2026-10-04T23:10:16Z | edge | 2 sites | 6 × triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt | POST /api (3 distinct paths) | |
| 2026-10-04T19:32:09Z | edge | techauthors.eu | 3 × triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt | POST /api (3 distinct paths) | |
| 2026-10-04T19:06:41Z | edge | carrentvarna.com | 3 × triggered Cloudflare's managed rule for a Next.js server-action request-smuggling/RCE attempt | POST /api (3 distinct paths) |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 48.217.233.95. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
