Threat Intelligence Feed — Tag: LLM_LLM03

Malicious activity detected from 185.150.191.165 (US, AS23470). 4719 events observed across HTTP, HTTPS, TCP, TCP/SYN, TLS. AI verdict: NOISE.

Threat actor operating from 104.243.34.165 conducted an 18-day reconnaissance campaign targeting hidden environment files and multiple network services, generating 2,504 malicious events between April 4-22, 2026. The activity demonstrates systematic information gathering techniques consistent with c…