185.220.100.248 Threat Intelligence and Host Information

Share on:

General

This page was generated as a result of this host being detected actively attacking or scanning another host. See below for information related to the host network, location, number of days noticed, protocols attacked and other information including reverse DNS and whois.

Host and Network Information

  • Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1110.004 - Credential Stuffing, T1489 - Service Stop, T1498 - Network Denial of Service
  • Tags: DDoS, SSH, Scanner, TCP ACK flood, TOR, Telnet, VPN, Webattack, attack, badrequest, brute force, bruteforce, cowrie, direct network flood, login, probing, public facing websites, scanner, scanning, service stop, smtp, ssh, tcp, webscan, webscanner, webscanner bruteforce web app attack
  • Known tor exit node
  • View other sources: Spamhaus VirusTotal
  • Contained within other IP sets: blocklist_net_ua, botscout_1d, cybercrime, dm_tor, et_tor, sblam, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, tor_exits

  • Known TOR node
  • Country: Germany
  • Network: AS205100 f3 netze e.v.
  • Noticed: 50 times
  • Protcols Attacked: redis
  • Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: tor-exit-9.zbau.f3netze.de

Malware Detected on Host

Count: 13 a896be5e1f5b7d498d6556c9d64fe6407b70360e36dd3f47ee46da9367748ff6 d643588fd00e7cbb933a634a3a1636e4b789dd7bc22ecf4a83c80f133ab1a849 caa1241730c0dd6844a54bd4ef74d7238c83180e01266ba4f65e5d2cc2855f2f ce11997dc64e5db0dc62219e25dc06c4209ba388589112d24973e5fc22ae48ee 25837be752586ccedb7da8ab32d563a7baa799d91ca69067f0b8acc14dfc0923 857df9f995f743358d9379eb9d8ef7848e7969ecc13394600eadbf973076d664 a7e484d7cdbcb39538cd203c269d39b15d59f1703cf73429ca67128bb66c0a00 860d97d305fcbfd03fd39a6784c3257fed4e463260a9a5455cfd72a1d166f074 2e66d07f6dc0aaaa247802ba12be12fc5904b0a23d6118c76718c3f84125b871 010321a94d616733d0564ec1584682a1b359315565db281c008be1f31624be0e

Open Ports Detected

22 9000 9001

Map

Whois Information

  • inetnum: 185.220.100.240 - 185.220.100.255
  • descr: Network for Tor-Exit traffic.
  • netname: TOR-EXIT
  • country: DE
  • admin-c: FN2977-RIPE
  • tech-c: FN2977-RIPE
  • status: ASSIGNED PA
  • mnt-by: F3NETZE
  • created: 2020-01-15T18:58:08Z
  • last-modified: 2021-03-22T21:10:04Z
  • org: ORG-FNE6-RIPE
  • organisation: ORG-FNE6-RIPE
  • org-name: F3 Netze e.V.
  • country: DE
  • org-type: OTHER
  • address: Am Hafen 6
  • address: 97437 Hassfurt
  • address: DE
  • abuse-c: AA32807-RIPE
  • mnt-ref: F3NETZE
  • mnt-ref: ZWIEBELFREUNDE
  • mnt-by: F3NETZE
  • created: 2017-11-06T17:07:57Z
  • last-modified: 2022-12-01T17:12:28Z
  • role: F3Netze NOC
  • address: F3 Netze e.V.
  • address: Am Hafen 6
  • address: 97437 Hassfurt
  • address: Germany
  • admin-c: TN3638-RIPE
  • admin-c: CR8822-RIPE
  • admin-c: FB15623-RIPE
  • admin-c: TK7920-RIPE
  • tech-c: TN3638-RIPE
  • tech-c: CR8822-RIPE
  • tech-c: FB15623-RIPE
  • tech-c: TK7920-RIPE
  • nic-hdl: FN2977-RIPE
  • mnt-by: F3NETZE
  • created: 2018-03-26T10:57:36Z
  • last-modified: 2019-10-04T14:16:13Z
  • route: 185.220.100.0/24
  • origin: AS205100
  • mnt-by: F3NETZE
  • created: 2018-02-18T18:17:41Z
  • last-modified: 2018-02-18T18:17:41Z

Links to attack logs

awsbah-redis-bruteforce-ip-list-2021-09-16 nmap-scanning-list-2022-01-24 awsbah-redis-bruteforce-ip-list-2022-05-12 awssafrica-redis-bruteforce-ip-list-2022-01-23 awsindia-redis-bruteforce-ip-list-2022-05-15