Summary (Bottom Line Up Front)
Malicious activity detected from 172.235.168.35 (NL, AS63949). 2503 events observed across HTTP, Java-RMI, MQTT, Modbus, Oracle/TNS. AI verdict: HIGH.
Activity Timeline
INITIAL REPORT2026-03-10T12:04:34Z
Source: Analyst Manual Entry
Malicious activity detected from 172.235.168.35 (NL, AS63949). 2503 events observed across HTTP, Java-RMI, MQTT, Modbus, Oracle/TNS. AI verdict: HIGH.
Technical details
Protocols: HTTP, Java-RMI, MQTT, Modbus, Oracle/TNS, RDP, SMB, TCP, TCP/SYN, TLS, TLS/1.0, TLS/1.2+, auto, http, https, https_tls_handshake, modbus, mqtt, mqtts_tls_handshake, oracle, smtp
Attack types: FORTI_API, FORTI_PROBE, FORTI_RECON, ICS_ATTACK, K8S_ATTACK, MQTT_ATTACK, ORACLE_TNS, SCANNER, SMB, SMTP_PROBE
Unique destination ports: 12
Active window: 2026-03-04 23:30:37.514014 to 2026-03-04 23:35:38.306602
Top patterns: fortigate_unknown_path, modbus_broadcast_attack, modbus_illegal_fc, smb_smb1_usage, smb1_detected
Associated CVEs: null
IOCs
IP:172.235.168.35
ASN:63949
COUNTRY:NL
Recommendations
- Block 172.235.168.35 at perimeter firewall
- Monitor other traffic from AS63949
- Escalate to incident response team
- Review correlated attacker profiles for campaign links