On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the ...

YouTube video by Detection Dispatch (Alex's Version)

GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable int...

11 organizations compromised in 26 seconds. GreyNoise breaks down the AI-enabled campaign against PaperCut NG/MF that hit 440 instances across 48 countries.

In the latest edition of the NoiseLetter we've got new integrations, product updates, and fresh content to dig into.

Today we’re announcing an expanded integration between GreyNoise and the CrowdStrike Falcon® platform including a purpose-built Falcon Next-Gen SIEM dashboard, correlation rules that detect allowed in...

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured ...

Engage with GreyNoise at Fal.Con. Stop by our booth #1757, meet with us, or attend our event.

Former Google Threat Intelligence leader joins GreyNoise as SVP of Adversary Operations to advance proactive discovery and disruption of cyber threats.

In this edition, we're diving into GreyNoise use cases, sharing the latest product releases, and getting ready for our biggest event of the year, NoiseFest.

Join us for NoiseFest at BlackHat/DEFCON on Thursday, August 6th. Enjoy drinks, snacks, and engaging conversations with your peers. RSVP now!

Join us for NoiseFest at BlackHat/DEFCON on Thursday, August 6th. Enjoy drinks, snacks, and engaging conversations with your peers. RSVP now!

Learn four practical ways GreyNoise improves SOC outcomes—from reducing alert volume and surfacing targeted threats to identifying compromised hosts.

Get GreyNoise updates! Read the May 2026 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.

GreyNoise compared 119,842 malicious IPs against 11 major threat feeds. The average coverage: just 2%, exposing the limits of static blocklists.

A new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.

Get GreyNoise updates! Read the April 2026 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.

This webinar presents the full findings of the latest report on residential proxy abuse — why IP reputation is structurally broken against this traffic, behavioral patterns consistent with compromised...

This week's report covers credential discovery, VNC exposure, and a new multi-cloud scanning framework.

Attackers are moving before disclosures. GreyNoise shows how surge activity can signal vulnerabilities days before CVEs are published.