185.140.53.137 Threat Intelligence and Host Information

Share on:
Jun 24, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 185.140.53.137 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Possibly Malicious Host 🟢 30/100

Host and Network Information

  • Tags: C&C, Log4j Scanning Hosts, abuse.ch, adwind, agentesla, agenttesla, alienspy, amadey, arkei stealer, arkeistealer, asyncrat, banload, bitrat, blacklist, bladabindi, blocklist, bokbot, botnets, breut, cobaltstrike, cryptbot, crysis, d2935c58fe676744fecc8614ee5356c7, darkcomet, darkside, database entry, destination ips, dharma, djvu, dofoil, fareit, ficker stealer, fingerprint, fynloski, gheg, icedid, iceid, ioc, ja3, ja3 fingerprint, keypass, kronos, loki, lokibot, magecart, malware, malware sample, malware samples, md5 hash, miguelsantareno, mirai, nancrat, nanocore, negasteal, netwire, netwire rc, njrat, orcusrat, oski stealer, ozonerat, quasarrat, racealer, recam, redline stealer, redlinestealer, remcos, remcosrat, revengerat, revetrat, sedll, servhelper, sharik, siplog, smoke loader, sockrat, ssl, status, stealer, stop ransomware, strrat, taurus stealer, tesla, timestamp, tls, tofsee, virusdeck, vtbotnet c, wadhrama

  • View other sources: Spamhaus VirusTotal

  • Country: Sweden
  • Network: AS208476 danilenko artyom
  • Noticed: 1 times
  • Protcols Attacked: Anonymous Proxy
  • Countries Attacked: United States of America
  • Passive DNS Results: iphanyi.mywire.org iphanyi.mooo.com iphanyi.webredirect.org info1.dynamic-dns.net mirroronthewall.hopto.org favorali.duckdns.org indigobaba.publicvm.com newlogs.ddns.net soith999.ddns.net teames.hopto.org 5541.gotdns.ch cool.gotdns.ch newmexy.ddns.net elvis4.ddns.net mmiri1.ddns.net liam001.spdns.eu cj419.ddns.net

Malware Detected on Host

Count: 47 6acaed46cf23fefd30d73e5b21e8480f711614aee0afcedfd29085df9430c73e 0fc54d55d3cb27bf5ec3c09325478deeebc49ff858fd7f413a62fb949b7a9666 9e303489b6a886ee967ace328a26749db9664604ab638e544e260918044b21de 10f5584682c3f5d54ba1e3afd68822c81e8234531c8b1a41e11774b980915c72 baccd3d2cd02286e08b6739dfc786f67bd64b5da6bfca6ba93ddf21f8e9d8359 f6d0fdcf620ebd3b483c6dd7e9bc7bea2f9acca8d34eb7b84ebaf457671fd758 efbae02e814b3845a289aaec71ae79b8639fd21bdd0ac91ba91b8282ff1b7b29 b1d613125002c9ad976f2a6f2dda3a835bc1ad0530cab7fe9af1eecf05fe6cc6 a2c4bdeac21d1c1a3d9522ad738f405810618fd9a3e0735cfe5a258c80ddcfaf e748e76168a7e308c718a4caff95bcee0e5315937c293169015aed60b27ab135

Open Ports Detected

443 80

Map

Whois Information

  • inetnum: 185.140.53.0 - 185.140.53.255
  • netname: G-net
  • country: HK
  • admin-c: TK9391-RIPE
  • tech-c: TK9391-RIPE
  • status: ASSIGNED PA
  • mnt-domains: MENET-MNT
  • mnt-lower: MENET-MNT
  • mnt-routes: MENET-MNT
  • mnt-routes: lir-se-blycka-1-MNT
  • org: ORG-MA1897-RIPE
  • mnt-by: se-tombii-1-mnt
  • mnt-by: lir-se-blycka-1-MNT
  • created: 2023-01-17T19:58:13Z
  • last-modified: 2023-01-17T20:26:24Z
  • organisation: ORG-MA1897-RIPE
  • org-name: NPO G-net
  • country: JP
  • descr: G-net
  • address: 6-2 Yoshino-cho, Gifu City
  • address: Gifu Prefecture 500-8844
  • address: Japan
  • abuse-c: ACRO44234-RIPE
  • org-type: OTHER
  • mnt-ref: MENET-MNT
  • mnt-by: MENET-MNT
  • mnt-ref: ADAMBB-MNT
  • mnt-ref: GEORGEDC-MNT
  • mnt-ref: SPARTANHOST-MNT
  • mnt-ref: HOSTCRAM-MNT
  • mnt-ref: lir-se-blycka-1-MNT
  • mnt-ref: lir-doge-mnt
  • mnt-ref: ROUTE48-MNT
  • mnt-ref: mnt-de-maximilian-1
  • mnt-ref: IPXO-MNT
  • mnt-ref: SAKURA-MNT
  • created: 2021-10-29T15:57:44Z
  • last-modified: 2023-04-10T03:21:13Z
  • person: Shuji Minamida
  • address: 6-2 Yoshino-cho, Gifu City
  • address: Gifu Prefecture 500-8844
  • address: Japan
  • phone: +8108074718866
  • nic-hdl: TK9391-RIPE
  • mnt-by: MENET-MNT
  • created: 2021-10-29T15:49:08Z
  • last-modified: 2022-02-05T05:53:49Z
  • route: 185.140.53.0/24
  • origin: AS210542
  • mnt-by: se-tombii-1-mnt
  • mnt-by: lir-se-blycka-1-MNT
  • mnt-by: MENET-MNT
  • created: 2023-01-17T20:26:51Z
  • last-modified: 2023-01-17T20:29:01Z
  • route: 185.140.53.0/24
  • origin: AS63796
  • mnt-by: se-tombii-1-mnt
  • mnt-by: lir-se-blycka-1-MNT
  • mnt-by: MENET-MNT
  • created: 2023-01-17T20:28:09Z
  • last-modified: 2023-01-17T20:28:27Z

Links to attack logs

anonymous-proxy-ip-list-2023-06-22