185.220.100.249 Threat Intelligence and Host Information

Share on:
Feb 24, 2023 ipinfopage

General

This page was generated as a result of this host being detected actively attacking or scanning another host. See below for information related to the host network, location, number of days noticed, protocols attacked and other information including reverse DNS and whois.

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1018 - Remote System Discovery, T1021 - Remote Services, T1027 - Obfuscated Files or Information, T1059 - Command and Scripting Interpreter, T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1110.004 - Credential Stuffing, T1133 - External Remote Services, T1486 - Data Encrypted for Impact, T1490 - Inhibit System Recovery, T1560 - Archive Collected Data, T1562 - Impair Defenses, T1566 - Phishing
  • Tags: Scanner, TOR, VPN, Webattack, badrequest, bruteforce, cert, ck techniques, cock, computer security, cowrie, csirt, cyber risks, cyber security, cybersecurity, email addresses, file extensions, file names, gmail, icmp, id use, jitjat, keemail, medusalocker, outlook, payment wallets, powershell, probing, protonmail, ransom note, rescuer, scanning, smtp, ssh, tcp, technique title, tutanota, u. s. computer emergency readiness, uscert, webscan, webscanner, webscanner bruteforce web app attack
  • Known tor exit node
  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, cruzit_web_attacks, dm_tor, et_tor, greensnow, sblam, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, tor_exits

  • Known TOR node
  • Country: Germany
  • Network: AS205100 f3 netze e.v.
  • Noticed: 50 times
  • Protcols Attacked: mysql redis
  • Countries Attacked: Germany, United States of America
  • Passive DNS Results: tor-exit-10.zbau.f3netze.de seed.nu.crypto-daio.co.uk

Malware Detected on Host

Count: 16 1bcf4ed8359169765701d4c4c5c98d50acd6719e88a51de9078f7604ad64d8da a896be5e1f5b7d498d6556c9d64fe6407b70360e36dd3f47ee46da9367748ff6 c3932c29216786e70f1d7637f56764896936aa483c96d54f91d72790f49284e4 e7711425a3037a9b4a805b185c9096b2db65a523f07c8f908ab89d1da37370b7 ce11997dc64e5db0dc62219e25dc06c4209ba388589112d24973e5fc22ae48ee b73eaa192ab95cab8e279d904a301d61ec84be69781b369bd73e538437680bc3 f2d2ac74db5bbbb4afb1818bf345019c15a5688b574e53c5f93aa41b1df353c4 857df9f995f743358d9379eb9d8ef7848e7969ecc13394600eadbf973076d664 4fa3f2617f30ba961c5a8ba15364a6b9c70882bf4f405cc868ef734bfefeed91 5ec5871b702ab135831503398816c6d1572c3371c48531dc3ffee82c4562dc4e

Open Ports Detected

22 9000 9001

Map

Whois Information

  • inetnum: 185.220.100.240 - 185.220.100.255
  • descr: Network for Tor-Exit traffic.
  • netname: TOR-EXIT
  • country: DE
  • admin-c: FN2977-RIPE
  • tech-c: FN2977-RIPE
  • status: ASSIGNED PA
  • mnt-by: F3NETZE
  • created: 2020-01-15T18:58:08Z
  • last-modified: 2021-03-22T21:10:04Z
  • org: ORG-FNE6-RIPE
  • organisation: ORG-FNE6-RIPE
  • org-name: F3 Netze e.V.
  • country: DE
  • org-type: OTHER
  • address: Am Hafen 6
  • address: 97437 Hassfurt
  • address: DE
  • abuse-c: AA32807-RIPE
  • mnt-ref: F3NETZE
  • mnt-ref: ZWIEBELFREUNDE
  • mnt-by: F3NETZE
  • created: 2017-11-06T17:07:57Z
  • last-modified: 2022-12-01T17:12:28Z
  • role: F3Netze NOC
  • address: F3 Netze e.V.
  • address: Am Hafen 6
  • address: 97437 Hassfurt
  • address: Germany
  • admin-c: TN3638-RIPE
  • admin-c: CR8822-RIPE
  • admin-c: FB15623-RIPE
  • admin-c: TK7920-RIPE
  • tech-c: TN3638-RIPE
  • tech-c: CR8822-RIPE
  • tech-c: FB15623-RIPE
  • tech-c: TK7920-RIPE
  • nic-hdl: FN2977-RIPE
  • mnt-by: F3NETZE
  • created: 2018-03-26T10:57:36Z
  • last-modified: 2019-10-04T14:16:13Z
  • route: 185.220.100.0/24
  • origin: AS205100
  • mnt-by: F3NETZE
  • created: 2018-02-18T18:17:41Z
  • last-modified: 2018-02-18T18:17:41Z

Links to attack logs

nmap-scanning-list-2021-10-01 awsbah-redis-bruteforce-ip-list-2021-12-21 bruteforce-ip-list-2020-05-09 awsindia-mysql-bruteforce-ip-list-2022-05-19 redis-bruteforce-ip-list-2021-11-29 nmap-scanning-list-2021-09-28