Grey Noise’s Recent Observations Around F5
Summary: GreyNoise reported elevated crawling activity against its F5 BIG-IP profile beginning 15 October 2025 at 6:41PM EST, amid the security incident involving F5 BIG-IP announced that same day, with most traffic hitting U.S.- and French-based sensors and most appearing to originate from researchers and academic institutions, mostly Cortex Xpanse. Earlier anomalies included 14 October activity targeting only South Africa-based systems from HOSTIFOX INTERNET VE BILISIM HIZMETLERI TICARET SANAYI LIMITED SIRKETI using SYN packets that failed to establish a full connection, and 23 September crawling from Digital Ocean primarily targeting U.S.-based assets.
Why it matters: GreyNoise states the majority of tagged traffic hit its BIG-IP profile, implying targeted rather than opportunistic activity, and that only minimal activity attempted to execute code against the management interface - so the scanning you see may not reflect the exploitation that follows.
Read the original at GreyNoise Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026