170.106.117.160 Threat Intelligence and Host Information

Apr 07, 2024 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 170.106.117.160 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110.004 - Credential Stuffing, T1110 - Brute Force
Tags: attack, Bruteforce, Brute-Force, cowrie, cyber security, ioc, login, malicious, Nextray, phishing, scanner, ssh, SSH, Telnet
View other sources: Spamhaus VirusTotal
Contained within other IP sets: blocklist_de, blocklist_de_ssh

Country: United States
Network: AS132203 tencent building kejizhongyi avenue
Noticed: 50 times
Protocols Attacked: ssh
Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America

Malware Detected on Host

Count: 1 14455fa64ac9d730835b2686d4388aa54e6bfba3cf20f257816c80aba960b880

Open Ports Detected

10001 10134 10243 10909 10911 11000 111 11112 11210 11211 11300 11371 11434 12000 13579 14147 14265 14344 16010 16030 16992 17000 18081 18245 19000 20000 20256 20547 21025 21379 22021 23023 23424 25001 25105 25565 27015 28015 28080 30002 30003 31337 32400 32764 33060 35000 37215 9000

Map

Whois Information

NetRange: 170.106.0.0 - 170.106.255.255
CIDR: 170.106.0.0/16
NetName: APNIC
NetHandle: NET-170-106-0-0-1
Parent: NET170 (NET-170-0-0-0-0)
NetType: Early Registrations, Transferred to APNIC
OriginAS:
Organization: Asia Pacific Network Information Centre (APNIC)
RegDate: 2017-10-05
Updated: 2017-10-05
Ref: https://rdap.arin.net/registry/ip/170.106.0.0
OrgName: Asia Pacific Network Information Centre
OrgId: APNIC
Address: PO Box 3646
City: South Brisbane
StateProv: QLD
PostalCode: 4101
Country: AU
RegDate:
Updated: 2012-01-24
Ref: https://rdap.arin.net/registry/entity/APNIC
OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3188
OrgTechEmail: search-apnic-not-arin@apnic.net
OrgTechRef: https://rdap.arin.net/registry/entity/AWC12-ARIN
OrgAbuseHandle: AWC12-ARIN
OrgAbuseName: APNIC Whois Contact
OrgAbusePhone: +61 7 3858 3188
OrgAbuseEmail: search-apnic-not-arin@apnic.net
OrgAbuseRef: https://rdap.arin.net/registry/entity/AWC12-ARIN
inetnum: 170.106.0.0 - 170.106.167.255
netname: ACEVILLEPTELTD-SG
descr: 16 COLLYER QUAY
country: US
admin-c: APA7-AP
tech-c: APA7-AP
abuse-c: AA1875-AP
status: ALLOCATED NON-PORTABLE
mnt-by: MAINT-ACEVILLEPTELTD-SG
mnt-irt: IRT-ACEVILLEPTELTD-SG
last-modified: 2021-01-26T21:12:12Z
irt: IRT-ACEVILLEPTELTD-SG
e-mail: qcloud_net_duty@tencent.com
abuse-mailbox: qcloud_net_duty@tencent.com
admin-c: APA7-AP
tech-c: APA7-AP
mnt-by: MAINT-ACEVILLEPTELTD-SG
last-modified: 2023-10-31T10:51:54Z
role: ABUSE ACEVILLEPTELTDSG
country: ZZ
phone: +000000000
e-mail: qcloud_net_duty@tencent.com
admin-c: APA7-AP
tech-c: APA7-AP
nic-hdl: AA1875-AP
abuse-mailbox: qcloud_net_duty@tencent.com
mnt-by: APNIC-ABUSE
last-modified: 2023-10-31T10:52:31Z
role: ACEVILLE PTELTD administrator
country: SG
phone: +8613923479936
fax-no: +8613923479936
e-mail: qcloud_net_duty@tencent.com
admin-c: APA7-AP
tech-c: APA7-AP
nic-hdl: APA7-AP
mnt-by: MAINT-ACEVILLEPTELTD-SG
last-modified: 2023-03-17T12:36:41Z
route: 170.106.0.0/16
origin: AS132203
descr: Tencent Cloud Computing (Beijing) Co., Ltd
mnt-by: MAINT-TENCENT-CN
last-modified: 2017-12-28T07:27:05Z

Links to attack logs

Share on: