138.197.142.81 Threat Intelligence and Host Information

Share on:

Jul 21, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 138.197.142.81 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1110.004 - Credential Stuffing
Tags: Brute-Force, Bruteforce, Nextray, SSH, bruteforce, cowrie, cyber security, ioc, malicious, phishing, scanners, ssh, vultr
View other sources: Spamhaus VirusTotal
Contained within other IP sets: b3b0, haley_ssh
Country: Canada
Network: AS14061 digitalocean llc
Noticed: 1 times
Protcols Attacked: ssh
Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Spain, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: canadamasq.com odoo.canadamasq.com droplet-1935.meetbbb.com foodgrads.com

Open Ports Detected

10000 7000 9000 9001 9002 9003 9004 9005 9006 9008 9009 9010 9011 9013 9014 9015 9017 9018 9019 9020 9021 9022 9024 9025 9027 9029 9031 9033 9034 9038 9039 9040 9041 9044 9045 9048 9049 9050 9051 9082 9088 9090 9091 9092 9096 9097 9100 9101 9102 9104 9105 9106 9108 9111 9119 9151 9160 9189 9191 9199 9200 9201 9204 9205 9206 9208 9209 9212 9214 9215 9216 9217 9218 9219 9220 9221 9222 9251 9295 9299 9300 9301 9303 9306 9308 9310 9389 9418 9433 9443 9444 9445 9500 9527 9530 9595 9600 9663 9690 9704 9743 9761 9765 9800 9861 9869 9898 9899 9943 9944 9950 9966 9981 9990 9991 9993 9994 9998 9999

Map

Whois Information

NetRange: 138.197.0.0 - 138.197.255.255
CIDR: 138.197.0.0/16
NetName: DIGITALOCEAN-138-197-0-0
NetHandle: NET-138-197-0-0-1
Parent: NET138 (NET-138-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS14061
Organization: DigitalOcean, LLC (DO-13)
RegDate: 2016-01-26
Updated: 2020-04-03
Comment: Routing and Peering Policy can be found at https://www.as14061.net
Comment:
Ref: https://rdap.arin.net/registry/ip/138.197.0.0
OrgName: DigitalOcean, LLC
OrgId: DO-13
Address: 101 Ave of the Americas
Address: FL2
City: New York
StateProv: NY
PostalCode: 10013
Country: US
RegDate: 2012-05-14
Updated: 2023-07-07
Ref: https://rdap.arin.net/registry/entity/DO-13
OrgNOCHandle: NOC32014-ARIN
OrgNOCName: Network Operations Center
OrgNOCPhone: +1-347-875-6044
OrgNOCEmail: [email protected]
OrgNOCRef: https://rdap.arin.net/registry/entity/NOC32014-ARIN
OrgAbuseHandle: ABUSE5232-ARIN
OrgAbuseName: Abuse, DigitalOcean
OrgAbusePhone: +1-347-875-6044
OrgAbuseEmail: [email protected]
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE5232-ARIN
OrgTechHandle: NOC32014-ARIN
OrgTechName: Network Operations Center
OrgTechPhone: +1-347-875-6044
OrgTechEmail: [email protected]
OrgTechRef: https://rdap.arin.net/registry/entity/NOC32014-ARIN

Links to attack logs