112.80.181.45 Threat Intelligence and Host Information

May 25, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 112.80.181.45 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1105 - Ingress Tool Transfer, T1106 - Native API, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1158 - Hidden Files and Directories, T1498 - Network Denial of Service, T1518 - Software Discovery, T1553 - Subvert Trust Controls, T1568 - Dynamic Resolution, T1583 - Acquire Infrastructure

  • Tags: active related, added active, alerts, all scoreblue, analysis date, australia, av detections, capture, contact, contacted, copy, copyright, create, create c, create new, crossrider, dded active, ded active, default, delete, detections dns, dock, entries, execution, filehash, filehashmd5, filehashsha1, filehashsha256, file score, found, hstr, ids detections, indicator, indicator role, information, iocs, ipv4, keylogger, lowfi, malicious ids, malware, malware type, medium, mozilla, nemucod, next, no entries, openioc, pcap, pdf report, pulses, pulses url, query, read c, related pulses, role title, scan endpoints, search, service, show, showing, siendownloader, snanning_host, stix, suspicioussectioname, title added, tor role, trojan, trojanclicker, trojan.crypted, type, type indicator, united, url https, vadokrist, win324shared, win32mediadrug, win32spigot, worm, write, xport, yara detections, zusy

  • View other sources: Spamhaus VirusTotal

  • Country: China
  • Network:
  • Noticed: 7 times
  • Protocols Attacked: SSH
  • Countries Attacked: Australia, United States of America
  • Passive DNS Results: hare.dnspod.net hachimi233.xyz manager.dnspod.net swordfish.dnspod.net zoe.dnspod.net duck.dnspod.net basil.dnspod.net cotton.dnspod.net qingliu.online swallow.dnspod.net brandon.dnspod.net laguna.work open.dnspod.net loss.dnspod.net humphrey.dnspod.net ira.dnspod.net swift.dnspod.net chilly.dnspod.net jonas.dnspod.net aldrich.dnspod.net xuechuang.vip radial.dnspod.net hugo.dnspod.net donkey.dnspod.net trunk.dnspod.net nas0010.top norma.dnspod.net lucien.dnspod.net breeze.dnspod.net meteoroloty.dnspod.net cricket.dnspod.net sow.dnspod.net dwight.dnspod.net phase.dnspod.net bicycle.dnspod.net sorb.dnspod.net eleven.dnspod.net hobart.dnspod.net mirfac.dnspod.net pelican.dnspod.net augustine.dnspod.net spica.dnspod.net mosca.dnspod.net vela.dnspod.net coach.dnspod.net job.dnspod.net cathy.dnspod.net hubery.dnspod.net dgtg3.fun soil.dnspod.net seeds.dnspod.net lettuce.dnspod.net calf.dnspod.net bill.dnspod.net poppy.dnspod.net mizar.dnspod.net rabbit.dnspod.net panda.dnspod.net arnold.dnspod.net xqztxs666.xyz train.dnspod.net giraffe.dnspod.net nitrogen.dnspod.net tuna.dnspod.net young.dnspod.net racetrack.dnspod.net gold.dnspod.net mule.dnspod.net antlia.dnspod.net wrestling.dnspod.net abalone.dnspod.net grace.dnspod.net delphinus.dnspod.net barry.dnspod.net radian.dnspod.net net.dnspod.net merak.dnspod.net bart.dnspod.net broken.dnspod.net plover.dnspod.net laura.dnspod.net alfred.dnspod.net tennis.dnspod.net jabildf.top nineteen.dnspod.net stormy.dnspod.net josephine.dnspod.net lance.dnspod.net felix.dnspod.net markab.dnspod.net skyblue.dnspod.net temporary.dnspod.net branch.dnspod.net mustard.dnspod.net celeste.dnspod.net everley.dnspod.net palegreen.dnspod.net hamiltion.dnspod.net ship.dnspod.net techno.dnspod.net gilt.dnspod.net chisel.dnspod.net adonis.dnspod.net drone.dnspod.net sheila.dnspod.net meteorologist.dnspod.net carol.dnspod.net oyster.dnspod.net tropical.dnspod.net tomcat.dnspod.net twelfth.dnspod.net kennedy.dnspod.net thunder.dnspod.net blanche.dnspod.net basketball.dnspod.net barlow.dnspod.net chyiyun.top guava.dnspod.net plateau.dnspod.net cliff.dnspod.net mamie.dnspod.net skiing.dnspod.net root.dnspod.net desk.dnspod.net xn–3lq903at12b.store albert.dnspod.net dragonfly.dnspod.net magnesium.dnspod.net thistle.dnspod.net taproot.dnspod.net sun.dnspod.net leg.dnspod.net flow.dnspod.net fanny.dnspod.net clare.dnspod.net brilliant.dnspod.net bartender.dnspod.net geoff.dnspod.net owner.dnspod.net door.dnspod.net gym.dnspod.net fishball.dnspod.net hyman.dnspod.net kenneth.dnspod.net canna.dnspod.net safe.dnspod.net concrete.dnspod.net fast.dnspod.net franklin.dnspod.net plate.dnspod.net bard.dnspod.net rapper.dnspod.net bridge.dnspod.net wool.dnspod.net toolbox.dnspod.net audience.dnspod.net seal.dnspod.net wdada.online CHICK.DNSPOD.NET goldfinch.dnspod.net chijiuchuanqi.com jiandongsteel.com popcorn.dnspod.net southeast.dnspod.net arvin.dnspod.net fifth.dnspod.net newbalancefr.com scheat.dnspod.net auriga.dnspod.net bough.dnspod.net chameleon.dnspod.net quail.dnspod.net squash.dnspod.net string.dnspod.net ns2.dnspod.net pollux.dnspod.net bowls.dnspod.net vivien.dnspod.net tiger.dnspod.net theresa.dnspod.net chester.dnspod.net balmy.dnspod.net qianyuyu521.love paraffin.dnspod.net frederic.dnspod.net yacht.dnspod.net segment.dnspod.net gotozy.top tina.dnspod.net gybsbs.com hanhechina.com altjkk.com charcoal.dnspod.net uranium.dnspod.net tree.dnspod.net egbert.dnspod.net lee.dnspod.net building.dnspod.net maticfox.com www.carbonatomgame.com carbonatomgame.com turbot.dnspod.net cockle.dnspod.net xinpro.cn chunaigpt.top cockroach.dnspod.net www.yolesto.com www.upc123.cn upc123.cn ns13.xincache.com huachengtec.com ns17.xincache.com www.haohot.net lamb.dnspod.net cinema.dnspod.net ce1.xincache.com sculptor.dnspod.net rap.dnspod.net fin.dnspod.net nxd6.top ryyx.xyz slategray.dnspod.net api.fangtaikun.cn shblong.com hurricane.dnspod.net belle.dnspod.net bizcn1.dnspod.net ns19.xincache.com company.dnspod.net old.dnspod.net unemployed.dnspod.net www.yuanjiejm.com laiweijie.com family222.com kitten.dnspod.net amos.dnspod.net hzy123.top marina.dnspod.net wp.xiaoyaowd.cn tophero1.top burnell.dnspod.net 782619.cn dull.dnspod.net ten.dnspod.net qmqm.asia ns15.xincache.com colin.dnspod.net white.dnspod.net f1g1ns1.dnspod.net ns11.xincache.com shengma.tech christian.dnspod.net mangnolia.dnspod.net mussel.dnspod.net yingduobao.com

Open Ports Detected

53

Map

Whois Information

  • inetnum: 112.80.0.0 - 112.87.255.255
  • netname: UNICOM-JS
  • descr: China Unicom Jiangsu province network
  • descr: China Unicom
  • country: CN
  • admin-c: CH1302-AP
  • tech-c: LL58-AP
  • abuse-c: AC1718-AP
  • status: ALLOCATED PORTABLE
  • mnt-by: APNIC-HM
  • mnt-lower: MAINT-CNCGROUP-JS
  • mnt-routes: MAINT-CNCGROUP-RR
  • mnt-irt: IRT-CU-CN
  • last-modified: 2025-01-22T13:12:40Z
  • irt: IRT-CU-CN
  • address: No.21,Financial Street
  • address: Beijing,100033
  • address: P.R.China
  • e-mail: zhaoyz3@chinaunicom.cn
  • abuse-mailbox: zhaoyz3@chinaunicom.cn
  • admin-c: CH1302-AP
  • tech-c: CH1302-AP
  • mnt-by: MAINT-CNCGROUP
  • last-modified: 2025-02-24T06:16:57Z
  • role: ABUSE CUCN
  • country: ZZ
  • address: No.21,Financial Street
  • address: Beijing,100033
  • address: P.R.China
  • phone: +000000000
  • e-mail: zhaoyz3@chinaunicom.cn
  • admin-c: CH1302-AP
  • tech-c: CH1302-AP
  • nic-hdl: AC1718-AP
  • abuse-mailbox: zhaoyz3@chinaunicom.cn
  • mnt-by: APNIC-ABUSE
  • last-modified: 2025-02-24T06:17:45Z
  • person: ChinaUnicom Hostmaster
  • nic-hdl: CH1302-AP
  • e-mail: hqs-ipabuse@chinaunicom.cn
  • address: No.21,Jin-Rong Street
  • address: Beijing,100033
  • address: P.R.China
  • phone: +86-10-66259764
  • fax-no: +86-10-66259764
  • country: CN
  • mnt-by: MAINT-CNCGROUP
  • last-modified: 2017-08-17T06:13:16Z
  • person: Lan Li
  • nic-hdl: LL58-AP
  • e-mail: js-cu-ipmanage@chinaunicom.cn
  • address: No. 65 Beijing West Road,Nanjing,China
  • phone: +86257900060
  • fax-no: +86252900280
  • country: CN
  • mnt-by: MAINT-NEW
  • last-modified: 2013-08-15T02:13:11Z
  • route: 112.80.0.0/13
  • descr: China Unicom CHINA169 Jiangsu Province Network
  • country: CN
  • origin: AS4837
  • mnt-by: MAINT-CNCGROUP-RR
  • last-modified: 2008-12-31T01:00:07Z

Links to attack logs

****** ****** ******

Share on: