112.80.181.111 Threat Intelligence and Host Information

May 25, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 112.80.181.111 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1105 - Ingress Tool Transfer, T1106 - Native API, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1158 - Hidden Files and Directories, T1498 - Network Denial of Service, T1518 - Software Discovery, T1553 - Subvert Trust Controls, T1568 - Dynamic Resolution, T1583 - Acquire Infrastructure

  • Tags: active related, added active, alerts, all scoreblue, analysis date, australia, av detections, capture, contact, contacted, copy, copyright, create, create c, create new, crossrider, dded active, ded active, default, delete, detections dns, dock, entries, execution, filehash, filehashmd5, filehashsha1, filehashsha256, file score, found, hstr, ids detections, indicator, indicator role, information, iocs, ipv4, keylogger, lowfi, malicious ids, malware, malware type, medium, mozilla, nemucod, next, no entries, openioc, pcap, pdf report, pulses, pulses url, query, read c, related pulses, role title, scan endpoints, search, service, show, showing, siendownloader, snanning_host, stix, suspicioussectioname, title added, tor role, trojan, trojanclicker, trojan.crypted, type, type indicator, united, url https, vadokrist, win324shared, win32mediadrug, win32spigot, worm, write, xport, yara detections, zusy

  • View other sources: Spamhaus VirusTotal

  • Country: China
  • Network:
  • Noticed: 5 times
  • Protocols Attacked: SSH
  • Countries Attacked: Australia, United States of America
  • Passive DNS Results: sirloin.dnspod.net alston.dnspod.net taro.dnspod.net crow.dnspod.net aubrey.dnspod.net sebastiane.dnspod.net walking.dnspod.net fornax.dnspod.net edwiin.dnspod.net leila.dnspod.net victory.dnspod.net shell.dnspod.net same.dnspod.net bread.dnspod.net wire.dnspod.net atomosphere.dnspod.net allen.dnspod.net golf.dnspod.net value.dnspod.net chop.dnspod.net cygnus.dnspod.net chair.dnspod.net seed.dnspod.net lionel.dnspod.net semicircle.dnspod.net aquila.dnspod.net yvette.dnspod.net rainfall.dnspod.net sara.dnspod.net cucumber.dnspod.net steak.dnspod.net tulip.dnspod.net triangulum.dnspod.net drive.dnspod.net gymnastics.dnspod.net cap.dnspod.net saw.dnspod.net seven.dnspod.net linesman.dnspod.net point.dnspod.net octopus.dnspod.net thin.dnspod.net agatha.dnspod.net oleander.dnspod.net alcor.dnspod.net centipede.dnspod.net sprout.dnspod.net prawn.dnspod.net tortoise.dnspod.net wallis.dnspod.net petrol.dnspod.net bed.dnspod.net jeff.dnspod.net herring.dnspod.net knot.dnspod.net castor.dnspod.net hermosa.dnspod.net thuban.dnspod.net almonds.dnspod.net zenobia.dnspod.net information.dnspod.net lyndon.dnspod.net debby.dnspod.net thrush.dnspod.net text.dnspod.net termite.dnspod.net joan.dnspod.net broccoli.dnspod.net bridget.dnspod.net bess.dnspod.net bear.dnspod.net bancroft.dnspod.net balsam.dnspod.net darcy.dnspod.net kiwi.dnspod.net sapphire.dnspod.net doris.dnspod.net task.dnspod.net restore.dnspod.net pentagon.dnspod.net levi.dnspod.net quit.dnspod.net tempest.dnspod.net sky.dnspod.net icy.dnspod.net aries.dnspod.net daylily.dnspod.net trapezoid.dnspod.net mark.dnspod.net cracker.dnspod.net tarpon.dnspod.net ken.dnspod.net lorraine.dnspod.net nickel.dnspod.net poult.dnspod.net define.dnspod.net pepper.dnspod.net touchline.dnspod.net alexia.dnspod.net example.dnspod.net caesar.dnspod.net windy.dnspod.net jonathan.dnspod.net blair.dnspod.net circinus.dnspod.net CHARLES.DNSPOD.NET main.dnspod.net chijiuchuanqi.com hedda.dnspod.net twelve.dnspod.net execute.dnspod.net control.dnspod.net board.dnspod.net jeans.dnspod.net loquat.dnspod.net flora.dnspod.net use.dnspod.net dodecagon.dnspod.net money.dnspod.net flautist.dnspod.net tsienhsueshen.com pettitoes.dnspod.net selena.dnspod.net thirty.dnspod.net bradley.dnspod.net trisa.dnspod.net good.dnspod.net fridge.dnspod.net jam.dnspod.net upc123.cn canteen.dnspod.net bruno.dnspod.net grasshopper.dnspod.net structure.dnspod.net gavial.dnspod.net lark.dnspod.net mabel.dnspod.net kent.dnspod.net trainee.dnspod.net www.upc123.cn daguan.fun chloe.dnspod.net tan.dnspod.net meishi403.top yzy56.com www.nuxt.org.cn nuxt.org.cn eli.dnspod.net chyiyun.top gotozy.top littletlkes.com ns14.xincache.com www.9aj.net www.huachengtec.com ns18.xincache.com sepal.dnspod.net tom.dnspod.net babao.fun express.dnspod.net variable.dnspod.net can.dnspod.net harvey.dnspod.net www.iealy.net game.dnspod.net catta.dnspod.net bizcn2.dnspod.net ns20.xincache.com hyena.dnspod.net bedroom.dnspod.net base.dnspod.net bernard.dnspod.net avery.dnspod.net barman.dnspod.net barret.dnspod.net xxw-top.xyz player.dnspod.net frank.dnspod.net lewis.dnspod.net xcwork.top crust.dnspod.net camel.dnspod.net pansy.dnspod.net barton.dnspod.net goose.dnspod.net ns16.xincache.com colbert.dnspod.net locate.dnspod.net f1g1ns2.dnspod.net ns12.xincache.com www.ewmould.com whirlwind.dnspod.net leif.dnspod.net crystal.dnspod.net gzrmlmn.net

Open Ports Detected

53

Map

Whois Information

  • inetnum: 112.80.0.0 - 112.87.255.255
  • netname: UNICOM-JS
  • descr: China Unicom Jiangsu province network
  • descr: China Unicom
  • country: CN
  • admin-c: CH1302-AP
  • tech-c: LL58-AP
  • abuse-c: AC1718-AP
  • status: ALLOCATED PORTABLE
  • mnt-by: APNIC-HM
  • mnt-lower: MAINT-CNCGROUP-JS
  • mnt-routes: MAINT-CNCGROUP-RR
  • mnt-irt: IRT-CU-CN
  • last-modified: 2025-01-22T13:12:40Z
  • irt: IRT-CU-CN
  • address: No.21,Financial Street
  • address: Beijing,100033
  • address: P.R.China
  • e-mail: zhaoyz3@chinaunicom.cn
  • abuse-mailbox: zhaoyz3@chinaunicom.cn
  • admin-c: CH1302-AP
  • tech-c: CH1302-AP
  • mnt-by: MAINT-CNCGROUP
  • last-modified: 2025-02-24T06:16:57Z
  • role: ABUSE CUCN
  • country: ZZ
  • address: No.21,Financial Street
  • address: Beijing,100033
  • address: P.R.China
  • phone: +000000000
  • e-mail: zhaoyz3@chinaunicom.cn
  • admin-c: CH1302-AP
  • tech-c: CH1302-AP
  • nic-hdl: AC1718-AP
  • abuse-mailbox: zhaoyz3@chinaunicom.cn
  • mnt-by: APNIC-ABUSE
  • last-modified: 2025-02-24T06:17:45Z
  • person: ChinaUnicom Hostmaster
  • nic-hdl: CH1302-AP
  • e-mail: hqs-ipabuse@chinaunicom.cn
  • address: No.21,Jin-Rong Street
  • address: Beijing,100033
  • address: P.R.China
  • phone: +86-10-66259764
  • fax-no: +86-10-66259764
  • country: CN
  • mnt-by: MAINT-CNCGROUP
  • last-modified: 2017-08-17T06:13:16Z
  • person: Lan Li
  • nic-hdl: LL58-AP
  • e-mail: js-cu-ipmanage@chinaunicom.cn
  • address: No. 65 Beijing West Road,Nanjing,China
  • phone: +86257900060
  • fax-no: +86252900280
  • country: CN
  • mnt-by: MAINT-NEW
  • last-modified: 2013-08-15T02:13:11Z
  • route: 112.80.0.0/13
  • descr: China Unicom CHINA169 Jiangsu Province Network
  • country: CN
  • origin: AS4837
  • mnt-by: MAINT-CNCGROUP-RR
  • last-modified: 2008-12-31T01:00:07Z

Links to attack logs

****** ****** ******

Share on: