185.220.102.252 Threat Intelligence and Host Information

Share on:

Apr 20, 2023 ipinfopage

General

This page was generated as a result of this host being detected actively attacking or scanning another host. See below for information related to the host network, location, number of days noticed, protocols attacked and other information including reverse DNS and whois.

Likely Malicious Host 🟠 70/100

Host and Network Information

Mitre ATT&CK IDs: T1110 - Brute Force
Tags: Brute-Force, Bruteforce, Nextray, Port scan, SSH, Telnet, attack, aws, cyber security, digital ocean, ioc, kfsensor, login, malicious, phishing, probing, rdp, scanner, scanners, scanning, ssh, vultr, webscan, webscanner bruteforce web app attack
Known tor exit node
View other sources: Spamhaus VirusTotal
Contained within other IP sets: blocklist_net_ua, botscout_30d, dm_tor, et_tor, greensnow, haley_ssh, php_harvesters_30d, sblam, stopforumspam, stopforumspam_180d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, tor_exits, tor_exits_1d, tor_exits_30d, tor_exits_7d
Known TOR node
Country: Germany
Network: AS60729 zwiebelfreunde e.v.
Noticed: 50 times
Protcols Attacked: ssh
Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Singapore, Turkey, Ukraine, United Kingdom, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: dlgstreet.direct.quickconnect.to tor-exit-relay-6.anonymizing-proxy.digitalcourage.de

Malware Detected on Host

Count: 33 bf012b77e22041aeddcbba1a28a91113060ca713e4c8d5c86d93b6a60ce10bce ec43e150012d049bbdf9a552c9a466482c628db8b981064584998a97d2662914 a04eae52065bbfc69818baeafcd98809c03bf7e48e5c7632c20fbd6c5dd08c8e 7548589cca05a011b563d58e795233faf2310975659bbc8b4d1db7ae6d805280 d643588fd00e7cbb933a634a3a1636e4b789dd7bc22ecf4a83c80f133ab1a849 e746ba510b706bc06b084ce84d6cd7e417137efde85bf12e421fdf21fd677943 f046b65739764aa74d38bfaf666094d45ad087b3bc6430c5a19c599b1735a54e 949c6737d24f301ca7ea79dfd0936614bb3158ca66be70a842e7e0a7510d8616 7cf34eadb163afa46e8936bc8a37c38d51a646079d39897397ab6bd3fd527f9a 25837be752586ccedb7da8ab32d563a7baa799d91ca69067f0b8acc14dfc0923

Open Ports Detected

123 443 80 8080

Map

Whois Information

inetnum: 185.220.102.240 - 185.220.102.255
netname: DIGITALCOURAGE-EXITS
country: DE
admin-c: KM6429-RIPE
tech-c: KM6429-RIPE
org: ORG-DE86-RIPE
status: SUB-ALLOCATED PA
mnt-by: de-zwf-1-mnt
mnt-by: ZWIEBELFREUNDE
created: 2020-08-16T15:25:46Z
last-modified: 2020-08-16T15:26:13Z
organisation: ORG-DE86-RIPE
org-name: Digitalcourage e.V.
org-type: OTHER
address: Marktstrasse 18
abuse-c: ACRO33566-RIPE
mnt-ref: ZWIEBELFREUNDE
mnt-by: de-zwf-1-mnt
mnt-by: ZWIEBELFREUNDE
created: 2020-06-15T07:35:08Z
last-modified: 2020-06-15T07:38:47Z
person: Karl Mueller
address: Marktstr. 18, D-33602 Bielefeld, Germany
phone: +49-521-1639 1639
nic-hdl: KM6429-RIPE
mnt-by: Digitalcourage
created: 2016-04-06T18:18:29Z
last-modified: 2017-10-30T23:11:41Z
route: 185.220.102.0/24
origin: AS60729
mnt-by: de-zwf-1-mnt
created: 2017-09-17T04:04:03Z
last-modified: 2018-05-15T08:28:07Z

Links to attack logs