185.220.100.250 Threat Intelligence and Host Information

Share on:
Apr 20, 2023 ipinfopage

General

This page was generated as a result of this host being detected actively attacking or scanning another host. See below for information related to the host network, location, number of days noticed, protocols attacked and other information including reverse DNS and whois.

Known Malicious Host 🔴 80/100

Host and Network Information

  • Mitre ATT&CK IDs: T1110 - Brute Force, T1489 - Service Stop, T1498 - Network Denial of Service
  • Tags: Brute Force, DDoS, Nextray, SSL VPN, TCP ACK flood, TOR, VPN, badrequest, brute force, bruteforce, cyber security, direct network flood, ioc, kfsensor, malicious, nmap, phishing, port-scan, probing, public facing websites, rdp, scanning, service stop, ssh, vnc, webscan, webscanner, webscanner bruteforce web app attack
  • Known tor exit node
  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, dm_tor, et_tor, greensnow, php_harvesters_30d, sblam, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, tor_exits

  • Known TOR node
  • Country: Germany
  • Network: AS205100 f3 netze e.v.
  • Noticed: 50 times
  • Protcols Attacked: redis
  • Countries Attacked: Australia, Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Spain, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: dlgstreet.direct.quickconnect.to wlkchyenjdhjss.ga tor-exit-11.zbau.f3netze.de

Malware Detected on Host

Count: 12 4a7d98590befe7f48428ee7a1017f74cb36aefb96a7ceff59a630c1c1b472439 ec43e150012d049bbdf9a552c9a466482c628db8b981064584998a97d2662914 d643588fd00e7cbb933a634a3a1636e4b789dd7bc22ecf4a83c80f133ab1a849 a4a63515b6bd2562e94430e10629c0c9e69309b2281dc857628cd537909c0352 175947117e7dfbe4d0b437034d850cb8bb063038d1b1ab0219c56ddc6464b395 857df9f995f743358d9379eb9d8ef7848e7969ecc13394600eadbf973076d664 5ec5871b702ab135831503398816c6d1572c3371c48531dc3ffee82c4562dc4e cc73c6d65098f18536aec1e15c84bec5b933f55ae91a5d2406242e8a49d527e2 2e66d07f6dc0aaaa247802ba12be12fc5904b0a23d6118c76718c3f84125b871 cabf0db3d73622405c6ad92e55a24d186ba72e5f9155ca0e26a3bfff3f234656

Open Ports Detected

22 9000 9001 9101

Map

Whois Information

  • inetnum: 185.220.100.240 - 185.220.100.255
  • descr: Network for Tor-Exit traffic.
  • netname: TOR-EXIT
  • country: DE
  • admin-c: FN2977-RIPE
  • tech-c: FN2977-RIPE
  • status: ASSIGNED PA
  • mnt-by: F3NETZE
  • created: 2020-01-15T18:58:08Z
  • last-modified: 2021-03-22T21:10:04Z
  • org: ORG-FNE6-RIPE
  • organisation: ORG-FNE6-RIPE
  • org-name: F3 Netze e.V.
  • country: DE
  • org-type: OTHER
  • address: Am Hafen 6
  • address: 97437 Hassfurt
  • address: DE
  • abuse-c: AA32807-RIPE
  • mnt-ref: F3NETZE
  • mnt-ref: ZWIEBELFREUNDE
  • mnt-by: F3NETZE
  • created: 2017-11-06T17:07:57Z
  • last-modified: 2022-12-01T17:12:28Z
  • role: F3Netze NOC
  • address: F3 Netze e.V.
  • address: Am Hafen 6
  • address: 97437 Hassfurt
  • address: Germany
  • admin-c: TN3638-RIPE
  • admin-c: CR8822-RIPE
  • admin-c: FB15623-RIPE
  • admin-c: TK7920-RIPE
  • tech-c: TN3638-RIPE
  • tech-c: CR8822-RIPE
  • tech-c: FB15623-RIPE
  • tech-c: TK7920-RIPE
  • nic-hdl: FN2977-RIPE
  • mnt-by: F3NETZE
  • created: 2018-03-26T10:57:36Z
  • last-modified: 2019-10-04T14:16:13Z
  • route: 185.220.100.0/24
  • origin: AS205100
  • mnt-by: F3NETZE
  • created: 2018-02-18T18:17:41Z
  • last-modified: 2018-02-18T18:17:41Z

Links to attack logs

nmap-scanning-list-2022-06-17 nmap-scanning-list-2022-08-30 nmap-scanning-list-2022-01-16 nmap-scanning-list-2022-09-03 awsbah-redis-bruteforce-ip-list-2022-02-08