185.220.102.8 Threat Intelligence and Host Information

Share on:
Apr 20, 2023 ipinfopage

General

This page was generated as a result of this host being detected actively attacking or scanning another host. See below for information related to the host network, location, number of days noticed, protocols attacked and other information including reverse DNS and whois.

Known Malicious Host 🔴 90/100

Host and Network Information

  • Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1110.004 - Credential Stuffing
  • Tags: Bruteforce, Nextray, SSH, Scanner, TOR, Telnet, VPN, Webattack, anna paula, associated, attack, badrequest, bruteforce, cowrie, currc3adculo, cyber security, from email, headers, ioc, kfsensor, login, malicious, malspam email, msi file, phishing, probing, rdp, scanner, scanning, smtp, ssh, tcp, tuesday, utf8, webscan, webscanner, webscanner bruteforce web app attack, zip archive
  • Known tor exit node
  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, botscout_30d, botscout_7d, cruzit_web_attacks, dm_tor, et_tor, greensnow, haley_ssh, maxmind_proxy_fraud, snort_ipfilter, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, talosintel_ipfilter, tor_exits_30d

  • Known TOR node
  • Country: Germany
  • Network: AS60729 zwiebelfreunde e.v.
  • Noticed: 50 times
  • Protcols Attacked: ssh
  • Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: block2.mmms.eu

Malware Detected on Host

Count: 9 a30c9f57c4bf5ec6b5b09d11aa889e0a3b7b10b1aa8c987faacdd0041088af7f 7282e2fdb25b07554b082f5cf1697315ed5ce3005f985cbe96a34da965869db5 cc004d4b453ff5725eae34ec6c72f7691d45abe27eb42cc6c6f3b4d41ac7288b caa1241730c0dd6844a54bd4ef74d7238c83180e01266ba4f65e5d2cc2855f2f 5064222b0154c6f1fd2603c690a20f3d21e737bc3057deeda47f47022453865f 5064222b0154c6f1fd2603c690a20f3d21e737bc3057deeda47f47022453865f a71e984a4ea60fcad9aa7c3ff4dbcf3545503fe985be130eb35934d2b20bdbc1 bfaa0d5932b14d955e0aa3e6b9602134f15e99dba3834eaad5b945404ef18184 68ec0e0162cbf4e5cfe72474461b7da812c922ca81a5c0a10bbfbb6c53ef4796

Map

Whois Information

  • inetnum: 185.220.102.0 - 185.220.102.31
  • descr: Zwiebelfreunde e.V.
  • netname: ZWIEBELFREUNDE
  • country: DE
  • org: ORG-ZE9-RIPE
  • admin-c: MB22990-RIPE
  • tech-c: MB22990-RIPE
  • status: ASSIGNED PA
  • mnt-by: de-zwf-1-mnt
  • mnt-by: ZWIEBELFREUNDE
  • created: 2018-08-25T15:37:55Z
  • last-modified: 2018-08-25T15:37:55Z
  • organisation: ORG-ZE9-RIPE
  • org-name: Zwiebelfreunde e.V.
  • org-type: OTHER
  • address: c/o DID Dresdner Institut fuer Datenschutz
  • address: Palaisplatz 3
  • address: 01097 Dresden
  • address: GERMANY
  • abuse-c: AR18597-RIPE
  • mnt-ref: ZWIEBELFREUNDE
  • mnt-by: ZWIEBELFREUNDE
  • created: 2013-05-21T12:32:47Z
  • last-modified: 2019-09-12T15:27:10Z
  • person: Jens Kubieziel
  • address: Zwiebelfreunde e.V.
  • address: c/o DID Dresdner Institut fuer Datenschutz
  • address: Palaisplatz 3
  • address: 01097 Dresden
  • address: Germany
  • phone: +49-351-21296018
  • fax-no: +49-8131-9044975
  • nic-hdl: MB22990-RIPE
  • mnt-by: ZWIEBELFREUNDE
  • created: 2011-02-11T04:11:32Z
  • last-modified: 2021-10-10T17:17:11Z
  • route: 185.220.102.0/24
  • origin: AS60729
  • mnt-by: de-zwf-1-mnt
  • created: 2017-09-17T04:04:03Z
  • last-modified: 2018-05-15T08:28:07Z

Links to attack logs

bruteforce-ip-list-2021-06-16 bruteforce-ip-list-2020-11-18 bruteforce-ip-list-2021-05-10 aws-ssh-bruteforce-ip-list-2021-06-12 bruteforce-ip-list-2020-07-14 bruteforce-ip-list-2020-06-28 bruteforce-ip-list-2021-05-28 aws-ssh-bruteforce-ip-list-2021-06-07 bruteforce-ip-list-2020-05-31 bruteforce-ip-list-2021-04-25 bruteforce-ip-list-2020-07-12