2.27.248.127

IP Address

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

October 20, 2026

Last Seen

October 21, 2026

IOC Validation

ThreatCluster AI

Confirmed IOC — High confidence

IP address listed as part of attacker infrastructure to be blocked

Checked against every article that reports it before entering the IOC feed.

Pivot to external tools

Opens in new tab · no data sent to TC

Reputation · 4

Sandbox · 2

Infrastructure · 3

Malware trackers · 1

Web search · 2

Related Clusters (1)

Active Exploitation of Siemens Software Center Vulnerability in ClickFix Campaign

Oct 22·11 sources

Related Articles (3)

Active Exploitation Of Cve 2026 110936 In Siemens Software Center

productcert.siemens.com·Oct 21

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign

Helpnetsecurity·Oct 20

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Thehackernews·Oct 20

Related Entities

Malware ClickFix campaign Siemens CVE-2026-110936 ClickFix Legion Loader LegionLoader T1574 - Hijack Execution Flow T1059.001 - PowerShell T1053 - Scheduled Task/Job Msiexec PowerShell