# T1590.005 IP Addresses > As of 2026-10-16, T1590.005 (IP Addresses) appears in 10 tracked threats, first reported 2026-02-25 and most recently 2026-10-16; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 10 (2 critical, 5 high, 3 medium) - **First seen:** 2026-02-25 - **Last seen:** 2026-10-16 - **Detection rules:** 18 (counts only; Blue tier and above) ## Key facts - **ID:** T1590.005 - **Framework:** MITRE ATT&CK - **Tactics:** Reconnaissance - **Matrix:** Enterprise - **Parent:** T1590 - **Data as of:** 2026-10-16 - **MITRE:** https://attack.mitre.org/techniques/T1590/005/ ## Activity timeline T1590.005 first appeared in tracked threats on 2026-02-25 and was most recently reported on 2026-10-16. The busiest month was 2026-06 with 2 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1590.005 IP Addresses is catalogued by MITRE ATT&CK under the Reconnaissance tactic in the Enterprise matrix, as a sub-technique of [T1590 Gather Victim Network Information](https://intel.threadlinqs.com/technique/T1590). Threadlinqs maps 10 of 2961 tracked threats (0.3%) to it; by severity that is 2 critical, 5 high, 3 medium. Threats that use T1590.005 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (7 threats), [T1046 Network Service Discovery](https://intel.threadlinqs.com/technique/T1046) (6 threats), [T1499.004 Application or System Exploitation](https://intel.threadlinqs.com/technique/T1499.004) (6 threats), [T1595.002 Vulnerability Scanning](https://intel.threadlinqs.com/technique/T1595.002) (6 threats), [T1592.002 Software](https://intel.threadlinqs.com/technique/T1592.002) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. ## Tracked threats 10 tracked threats use T1590.005. - [AdFection: Zero-click ad-based delivery of Candiru (Integrity Labs) spyware via Discover-Tech's…](https://intel.threadlinqs.com/threat/TL-2026-3763) — high — 2026-10-16 - [AdFection: Discover-Tech Abuses Real-Time Bidding Ad Networks to Deliver Candiru Spyware](https://intel.threadlinqs.com/threat/TL-2026-3628) — high — 2026-10-15 - [Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage…](https://intel.threadlinqs.com/threat/TL-2026-2658) — medium — 2026-09-25 - [CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with…](https://intel.threadlinqs.com/threat/TL-2026-2080) — critical — 2026-08-20 - [NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS…](https://intel.threadlinqs.com/threat/TL-2026-1927) — high — 2026-08-07 - [OpenSSL "HollowByte" DoS Vulnerability — Memory Exhaustion via Malformed ClientHello (11-Byte Trigger)](https://intel.threadlinqs.com/threat/TL-2026-1471) — medium — 2026-07-18 - [CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-1140) — critical — 2026-06-30 - [SolarWinds Serv-U DoS (CVE-2026-28318) — Actively Exploited Uncontrolled Resource Consumption via…](https://intel.threadlinqs.com/threat/TL-2026-0717) — high — 2026-06-08 - [Concentrated 21-IP Cluster (AS213438/ColocaTel) Behind ~50% of Global RDP Internet Scanning](https://intel.threadlinqs.com/threat/TL-2026-1466) — medium — 2026-04-10 - [Coordinated Reconnaissance Campaign Maps SonicWall SSL VPN Attack Surface via Commercial Proxy…](https://intel.threadlinqs.com/threat/TL-2026-1468) — high — 2026-02-25 ## Related CVEs CVEs referenced by the tracked threats that use T1590.005, most frequent first. - [CVE-2019-7481](https://intel.threadlinqs.com/cve/CVE-2019-7481) - [CVE-2021-20028](https://intel.threadlinqs.com/cve/CVE-2021-20028) - [CVE-2022-22274](https://intel.threadlinqs.com/cve/CVE-2022-22274) - [CVE-2023-0656](https://intel.threadlinqs.com/cve/CVE-2023-0656) - [CVE-2023-44221](https://intel.threadlinqs.com/cve/CVE-2023-44221) - [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966) - [CVE-2024-38475](https://intel.threadlinqs.com/cve/CVE-2024-38475) - [CVE-2024-40766](https://intel.threadlinqs.com/cve/CVE-2024-40766) - [CVE-2024-53704](https://intel.threadlinqs.com/cve/CVE-2024-53704) - [CVE-2025-1218](https://intel.threadlinqs.com/cve/CVE-2025-1218) - [CVE-2025-14181](https://intel.threadlinqs.com/cve/CVE-2025-14181) - [CVE-2026-17545](https://intel.threadlinqs.com/cve/CVE-2026-17545) - [CVE-2026-19489](https://intel.threadlinqs.com/cve/CVE-2026-19489) - [CVE-2026-19490](https://intel.threadlinqs.com/cve/CVE-2026-19490) - [CVE-2026-28318](https://intel.threadlinqs.com/cve/CVE-2026-28318) - [CVE-2026-3055](https://intel.threadlinqs.com/cve/CVE-2026-3055) - [CVE-2026-56181](https://intel.threadlinqs.com/cve/CVE-2026-56181) - [CVE-2026-6103](https://intel.threadlinqs.com/cve/CVE-2026-6103) - [CVE-2026-63913](https://intel.threadlinqs.com/cve/CVE-2026-63913) - [CVE-2026-8451](https://intel.threadlinqs.com/cve/CVE-2026-8451) - [CVE-2026-91765](https://intel.threadlinqs.com/cve/CVE-2026-91765) - [CVE-2026-91766](https://intel.threadlinqs.com/cve/CVE-2026-91766) - [CVE-2026-91767](https://intel.threadlinqs.com/cve/CVE-2026-91767) - [CVE-2026-91768](https://intel.threadlinqs.com/cve/CVE-2026-91768) - [CVE-2026-91769](https://intel.threadlinqs.com/cve/CVE-2026-91769) - [CVE-2026-92842](https://intel.threadlinqs.com/cve/CVE-2026-92842) - [CVE-2026-93682](https://intel.threadlinqs.com/cve/CVE-2026-93682) ## Detection coverage Threadlinqs maintains 18 detection rules mapped to T1590.005 (SPL 4, KQL 7, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only. 18 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1590 Gather Victim Network Information](https://intel.threadlinqs.com/technique/T1590) — 100 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1590.005 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)