Last week we shared an alert on active Citrix NetScaler exploitation. While incident response is still ongoing, Augur's predictive engine was already engaged against these operators before Citrix published its advisory. Here is what Augur saw:
213.209.159.0/24 was predicted malicious in early September 2025. More than a year before weaponization. The ASN traces to Feo Prest SRL in Romania, a bulletproof hosting provider our engine had already associated with malware infrastructure.
89.44.80.7 sits inside AS59711, HZ Hosting Ltd, another bulletproof provider confirmed in Augur's BPH dataset. The IP was active as spam origin going back to 2018, when Augur first flagged it, before it re-emerged in April 2026 supporting malicious activity.
31.56.197.72 is hosted on CGI Global Limited (AS56971), another confirmed bulletproof provider. Augur predicted this IP as malicious in mid-October 2025, nearly a year before exploitation was confirmed in the wild.
85.203.46.191 was predicted by Augur in March 2016. Later, the infrastructure appeared in active scanner detections throughout September 2026. That is over a decade of pre-advisory visibility on infrastructure that showed up in this exploitation campaign.
Despite the 194.127.166.0/24 range showing active scanner behaviour in Augur's tracking starting August, 2026, Augur had the CIDR blocked since December 2018 due to preemptive telemetry. That is nearly 8 years of preemptive visibility on the same subnet where active exploitation was later confirmed.
The Power of Preemptive Infrastructure Intelligence
This is what preemptive infrastructure intelligence looks like operationally. Augur clients had coverage on this attacker infrastructure while threat actors were still in the reconnaissance and staging phase, weeks before a single Citrix advisory was published.
If you are running NetScaler in your environment, patch now and check your auth logs.
Specific IPs Released in Third-Party Research
85.203.46.191 — Predicted March, 2016
194.127.166.19 — Predicted Dec, 2018
194.127.166.32 — Predicted Dec, 2018
194.127.166.36 — Predicted Dec, 2018
194.127.166.70 — Predicted Dec, 2018
194.127.166.126 — Predicted Dec, 2018
46.247.43.50 — Predicted Dec, 2025
Associated CIDRs
213.209.159.0/24 — Predicted Sep, 2025
85.203.46.0/24 – Predicted Mar, 2016
89.44.80.7/32 — Predicted Jun, 2018
194.127.166.18/32 — Predicted Dec, 2018
31.56.197.72/32 — Predicted Oct, 2025
46.247.43.0/24 – Predicted Dec, 2025
For questions or additional analysis, contact: research@augursecurity.com
