Summary (Bottom Line Up Front)
IP address 65.49.1.152 conducted sustained reconnaissance activities from March 15 to April 17, 2026, targeting multiple protocols including FortiGate infrastructure, Oracle databases, IoT devices, and Kubernetes clusters across 59 observed events. Assessment indicates LOW threat level with medium confidence, representing opportunistic scanning rather than targeted attack activity. Network defenders should implement enhanced monitoring for the identified attack patterns and block the source IP as a precautionary measure. ##
Activity Timeline
INITIAL REPORT2026-04-17T12:50:20Z
Source: Analyst Manual Entry
IP address 65.49.1.152 conducted sustained reconnaissance activities from March 15 to April 17, 2026, targeting multiple protocols including FortiGate infrastructure, Oracle databases, IoT devices, and Kubernetes clusters across 59 observed events. Assessment indicates LOW threat level with medium confidence, representing opportunistic scanning rather than targeted attack activity. Network defenders should implement enhanced monitoring for the identified attack patterns and block the source IP as a precautionary measure.
Technical details
Attack Timeline: March 15, 2026 11:00 - April 17, 2026 06:00 (33-day campaign)
Protocols Targeted: HTTP, HTTPS, MODBUS, Oracle, SMB, SMTP, TLS variants
Primary Techniques: Network service discovery, vulnerability scanning, credential access attempts
Key Attack Patterns: FortiGate infrastructure probing (11 events), IoT MQTT command injection attempts (6 events), Oracle database reconnaissance (1 event), SMBv1 exploitation probes (1 event)
Notable Anomalies: HTTP traffic directed at Oracle port 1521/TCP indicating protocol tunneling or misconfiguration
IOCs: 65.49.1.152, FortiGate API paths (/api/v2/static/not.found, /migadmin/lang/legacy/legacy/filechecksum), Kubernetes version enumeration attempts
IOCs
IP:65.49.1.152
Recommendations
- Block IP address 65.49.1.152 at network perimeter and implement monitoring for similar scanning patterns across FortiGate, Oracle, and IoT infrastructure
- Review and harden FortiGate SSL VPN configurations, particularly login endpoints and API access controls identified in reconnaissance attempts
- Disable SMBv1 protocol across the network environment and implement enhanced logging for SMB negotiation attempts
- Deploy additional monitoring for Oracle database port 1521 focusing on HTTP protocol anomalies and unauthorized connection attempts
- Implement network segmentation to isolate IoT devices and industrial control systems from general network access