1.2.2.4 Threat Intelligence and Host Information

Sep 16, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 1.2.2.4 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 100/100

Host and Network Information

Tags: CVE-2017-8977, CVE-2021-22941, http://e.ca/?e.ca=!1:f.stopPropagation
Known tor exit node
View other sources: Spamhaus VirusTotal
Contained within other IP sets: alienvault_reputation, b3b0, bds_atif, bitcoin_blockchain_info_1d, bitcoin_blockchain_info_30d, bitcoin_blockchain_info_7d, bitcoin_nodes, bitcoin_nodes_1d, bitcoin_nodes_30d, bitcoin_nodes_7d, blocklist_de, blocklist_de_apache, blocklist_de_bruteforce, blocklist_de_ssh, blocklist_de_strongips, blocklist_net_ua, botscout_1d, botscout_30d, botscout_7d, ciarmy, cleanmx_phishing, cleanmx_viruses, cleantalk, cleantalk_1d, cleantalk_30d, cleantalk_7d, cleantalk_new, cleantalk_new_1d, cleantalk_new_30d, cleantalk_new_7d, cleantalk_updated, cleantalk_updated_1d, cleantalk_updated_30d, cleantalk_updated_7d, cobaltstrike, coinbl_hosts, coinbl_hosts_browser, coinbl_hosts_optional, coinbl_ips, cruzit_web_attacks, cta_cryptowall, cybercrime, dm_tor, dshield_top_1000, esentire_14072015_com, esentire_14072015q_com, esentire_22072014a_com, esentire_22072014b_com, esentire_22072014c_com, esentire_auth_update_ru, esentire_burmundisoul_ru, esentire_crazyerror_su, esentire_dagestanskiiviskis_ru, esentire_dorttlokolrt_com, esentire_downs1_ru, esentire_ebankoalalusys_ru, esentire_emptyarray_ru, esentire_fioartd_com, esentire_getarohirodrons_com, esentire_hasanhashsde_ru, esentire_inleet_ru, esentire_islamislamdi_ru, esentire_maddox1_ru, esentire_manning1_ru, esentire_mysebstarion_ru, esentire_smartfoodsglutenfree_kz, esentire_venerologvasan93_ru, esentire_volaya_ru, et_botcc, et_compromised, et_tor, gpf_comics, greensnow, haley_ssh, hphosts_ats, hphosts_emd, hphosts_exp, hphosts_fsa, hphosts_grm, hphosts_hfs, hphosts_mmt, hphosts_pha, hphosts_psh, hphosts_wrz, lashback_ubl, malwaredomainlist, maxmind_proxy_fraud, nixspam, normshield_all_wannacry, normshield_high_wannacry, nt_malware_dns, nt_ssh_7d, nullsecure, packetmail, packetmail_ramnode, php_commenters_30d, php_commenters_7d, php_dictionary_1d, php_dictionary_30d, php_dictionary_7d, php_harvesters_30d, php_spammers_1d, php_spammers_30d, php_spammers_7d, proxylists, proxylists_1d, proxylists_30d, proxylists_7d, proxyspy_30d, proxyspy_7d, proxz_30d, proxz_7d, sblam, snort_ipfilter, socks_proxy, socks_proxy_1d, socks_proxy_30d, socks_proxy_7d, sslproxies_1d, sslproxies_30d, sslproxies_7d, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, taichung, talosintel_ipfilter, threatcrowd, tor_exits, tor_exits_1d, tor_exits_30d, tor_exits_7d, turris_greylist, urandomusto_ftp, urandomusto_http, urandomusto_telnet, xforce_bccs, yoyo_adservers

Known TOR node
Country: China
Network: AS149002 hong kong oriental science and technology co. limited
Known APT: 28
Noticed: 1 times
Protcols Attacked: Anonymous Proxy
Passive DNS Results: www1.dohaland.com internetemailservice.net akhileshthipparthi.com thedutchfashionfactory.com js66mm.com

Malware Detected on Host

Count: 38 d0298de2e4675cafdd1c6149fb4476e77f1ba446e1a5aaf9ed12da4cb839adbb 9805b28d5895ad4118e0df750ee898940518295c362d8a756464f10e4c04cc50 0f5c045caa0bd8143a5bfaf0572543b404104fb65be4f58f1e91b7ec084b1389 3b7ff3504ea7501fc575613fac5ba585a1e9db16f165b0538f04684e50521a97 dafbedfa8a9ad0851843b6f3636755d0937088063fccadfd7c79b623f224557e f4cccc232b47e141d0e08cebec176c51ac16b7b411a7d6e798084d9b32f3bc5d 33aa51da32922e8ed27c11432014fea909068271bb8ecf8b01975858d96e01b1 6cc2147fe7cb0f5218e9e7c8e2d2046caf30cc6122e8c29e475c64efdb92a707 b4e400f2d6b28a946559fba9123649a27f0bb42d7b6525d28ee754df8fbcd0ec 43c4f6ccf3f8bc6ba5a313f3e968d949ae56e1abf80eb9036459c021acaf2ab0

Map

Whois Information

inetnum: 1.2.2.0 - 1.2.2.255
netname: KNET
descr: KNET Techonlogy (BeiJing) Co.,Ltd.
descr: 4,South 4th treet, Zhongguancun,Haidian District,Beijing
country: CN
admin-c: ZX2975-AP
tech-c: WL1818-AP
abuse-c: AC1601-AP
status: ALLOCATED PORTABLE
mnt-by: MAINT-CNNIC-AP
mnt-routes: MAINT-CNNIC-AP
mnt-irt: IRT-CNNIC-CN
last-modified: 2021-06-16T01:30:50Z
irt: IRT-CNNIC-CN
address: Beijing, China
e-mail: ipas@cnnic.cn
abuse-mailbox: ipas@cnnic.cn
admin-c: IP50-AP
tech-c: IP50-AP
mnt-by: MAINT-CNNIC-AP
last-modified: 2021-06-16T01:39:57Z
role: ABUSE CNNICCN
address: Beijing, China
country: ZZ
phone: +000000000
e-mail: ipas@cnnic.cn
admin-c: IP50-AP
tech-c: IP50-AP
nic-hdl: AC1601-AP
abuse-mailbox: ipas@cnnic.cn
mnt-by: APNIC-ABUSE
last-modified: 2020-05-14T11:19:01Z
person: Wenzhe Lu
address: 4,South 4th treet, Zhongguancun,Haidian District,Beijing
country: CN
phone: +86-010-58813017
fax-no: +86-010-58812666-126
e-mail: lwz@knet.cn
nic-hdl: WL1818-AP
mnt-by: MAINT-CNNIC-AP
last-modified: 2011-03-16T03:32:02Z
person: Zhijie Xing
address: 4,South 4th treet, Zhongguancun,Haidian District,Beijing
country: CN
phone: +86-010-58812474
fax-no: +86-010-58812666-126
e-mail: xingzhijie@knet.cn
nic-hdl: ZX2975-AP
mnt-by: MAINT-CNNIC-AP
last-modified: 2014-07-23T03:08:01Z

Links to attack logs

Share on: