108.53.159.234 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 108.53.159.234 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

• Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1110.004 - Credential Stuffing
• Tags: Bruteforce, Malicious IP, Nextray, aws, blacklist, bruteforce, cowrie, cyber security, ioc, malicious, phishing, scan, scanners, ssh, tcp, vultr

• View other sources: Spamhaus VirusTotal

• Country: United States
• Network: AS701 verizon
• Noticed: 6 times
• Protcols Attacked: SSH
• Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Singapore, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America

Open Ports Detected

20000 22 80 8000 8001 8002 8004 8006 8008 8009 8010 8016 8017 8019 8020 8024 8025 8027 8029 8030 8031 8032 8034 8037 8040 8043 8045 8049 8053 8054 8055 8066 8069 8072 8080 8081 8083 8084 8086 8087 8088 8089 8090 8092 8093 8094 8095 8098 8099 8100 8105 8107 8108 8111 8112 8118 8123 8126 8139 8143 8181 8182 8200 8222 8248 8249 8251 8252 8282 8291 8333 8334 8383 8401 8406 8412 8413 8416 8417 8418 8423 8425 8426 8428 8431 8433 8442 8443 8444 8500 8513 8545 8554 8590 8602 8622 8637 8649 8700 8733 8767 8779 8787 8788 8790 8791 8804 8805 8806 8812 8813 8815 8816 8817 8819 8820 8821 8825 8828 8833 8834 8836 8841 8842 8843 8846 8847 8849 8851 8853 8862 8864 8870 8872 8874 8875 8878 8888 8889 8890 8891 8988 8990 8993

Map

Links to attack logs

dosing-ssh-bruteforce-ip-list-2022-07-16 vultrwarsaw-ssh-bruteforce-ip-list-2022-07-08