185.220.100.241 Threat Intelligence and Host Information

General

This page was generated as a result of this host being detected actively attacking or scanning another host. See below for information related to the host network, location, number of days noticed, protocols attacked and other information including reverse DNS and whois.

Known Malicious Host 🔴 90/100

Host and Network Information

• Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1110.004 - Credential Stuffing, T1489 - Service Stop, T1498 - Network Denial of Service
• Tags: Brute Force, Bruteforce, DDoS, Nextray, SSH, SSL VPN, Scanner, T1212, TCP ACK flood, TOR, Telnet, VPN, Webattack, attack, badrequest, brute force, bruteforce, cowrie, cve-2018-13379, cyber security, direct network flood, fortinet, ioc, login, malicious, phishing, probing, public facing websites, scanner, scanning, service stop, smtp, ssh, tcp, webscan, webscanner, webscanner bruteforce web app attack
• Known tor exit node
• View other sources: Spamhaus VirusTotal

• Contained within other IP sets: blocklist_net_ua, botscout_1d, cruzit_web_attacks, dm_tor, et_tor, php_harvesters_7d, sblam, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, tor_exits

• Known TOR node
• Country: Germany
• Network: AS205100 f3 netze e.v.
• Noticed: 50 times
• Protcols Attacked: redis
• Countries Attacked: Australia, Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Spain, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
• Passive DNS Results: tor-exit-14.zbau.f3netze.de b23967.direct.quickconnect.to shadowlegion.ddns.net

Malware Detected on Host

Count: 19 d3bea0e50e223746aa21c799a7434be4538d066e34d048fa5d5182bb68df52a1 b5bb4de39af3743acfe8c5ba9feacc1a87ccb9cb902cb69347261c26d2598a66 00c7d00aad28f7ccf06651fa6bdad39f627798531bde47b84f4fafa4133d115f 292cc0f4fb558ad55517bdec32de901b7e578c60614450d32dd4ad470793253f 7548589cca05a011b563d58e795233faf2310975659bbc8b4d1db7ae6d805280 d643588fd00e7cbb933a634a3a1636e4b789dd7bc22ecf4a83c80f133ab1a849 ce11997dc64e5db0dc62219e25dc06c4209ba388589112d24973e5fc22ae48ee 25837be752586ccedb7da8ab32d563a7baa799d91ca69067f0b8acc14dfc0923 b73eaa192ab95cab8e279d904a301d61ec84be69781b369bd73e538437680bc3 f2d2ac74db5bbbb4afb1818bf345019c15a5688b574e53c5f93aa41b1df353c4

Open Ports Detected

22 9000 9001

Map

Whois Information

• inetnum: 185.220.100.240 - 185.220.100.255
• descr: Network for Tor-Exit traffic.
• netname: TOR-EXIT
• country: DE
• admin-c: FN2977-RIPE
• tech-c: FN2977-RIPE
• status: ASSIGNED PA
• mnt-by: F3NETZE
• created: 2020-01-15T18:58:08Z
• last-modified: 2021-03-22T21:10:04Z
• org: ORG-FNE6-RIPE
• organisation: ORG-FNE6-RIPE
• org-name: F3 Netze e.V.
• country: DE
• org-type: OTHER
• address: Am Hafen 6
• address: 97437 Hassfurt
• address: DE
• abuse-c: AA32807-RIPE
• mnt-ref: F3NETZE
• mnt-ref: ZWIEBELFREUNDE
• mnt-by: F3NETZE
• created: 2017-11-06T17:07:57Z
• last-modified: 2022-12-01T17:12:28Z
• role: F3Netze NOC
• address: F3 Netze e.V.
• address: Am Hafen 6
• address: 97437 Hassfurt
• address: Germany
• admin-c: TN3638-RIPE
• admin-c: CR8822-RIPE
• admin-c: FB15623-RIPE
• admin-c: TK7920-RIPE
• tech-c: TN3638-RIPE
• tech-c: CR8822-RIPE
• tech-c: FB15623-RIPE
• tech-c: TK7920-RIPE
• nic-hdl: FN2977-RIPE
• mnt-by: F3NETZE
• created: 2018-03-26T10:57:36Z
• last-modified: 2019-10-04T14:16:13Z
• route: 185.220.100.0/24
• origin: AS205100
• mnt-by: F3NETZE
• created: 2018-02-18T18:17:41Z
• last-modified: 2018-02-18T18:17:41Z

Links to attack logs

vultrparis-redis-bruteforce-ip-list-2022-01-29 bruteforce-ip-list-2020-05-15 awsbah-redis-bruteforce-ip-list-2022-05-11 nmap-scanning-list-2022-06-19 awssafrica-redis-bruteforce-ip-list-2022-05-10 awssafrica-redis-bruteforce-ip-list-2022-05-19 cve-2018-13379-attacker-ip-list-2022-08-29