192.3.13.56 Threat Intelligence and Host Information

ipinfopage

General

This page contains threat intelligence information for the IPv4 address 192.3.13.56 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

🟠 Elevated — 55/100

Geographic Location

Host and Network Information

View other sources: Spamhaus VirusTotal Shodan AbuseIPDB
Country: United States
Noticed: 6 times
Protocols Attacked: SSH
Countries Attacked: United Kingdom of Great Britain and Northern Ireland, United States of America
Open Ports: 3389
Tor Node: No

MITRE ATT&CK TTPs

T1012 - Query Registry
T1027 - Obfuscated Files or Information
T1037.003 - Network Logon Script
T1037 - Boot or Logon Initialization Scripts
T1040 - Network Sniffing
T1045 - Software Packing
T1046 - Network Service Scanning
T1053 - Scheduled Task/Job
T1055 - Process Injection
T1057 - Process Discovery
T1060 - Registry Run Keys / Startup Folder
T1063 - Security Software Discovery
T1082 - System Information Discovery
T1098.002 - Exchange Email Delegate Permissions
T1102.002 - Bidirectional Communication
T1106 - Native API
T1110.004 - Credential Stuffing
T1119 - Automated Collection
T1129 - Shared Modules
T1140 - Deobfuscate/Decode Files or Information
T1143 - Hidden Window
T1147 - Hidden Users
T1205.001 - Port Knocking
T1444 - Masquerade as Legitimate Application
T1460 - Biometric Spoofing
T1566 - Phishing
T1584.005 - Botnet
TA0002 - Execution
TA0003 - Persistence
TA0004 - Privilege Escalation
TA0005 - Defense Evasion
TA0006 - Credential Access
TA0007 - Discovery
TA0008 - Lateral Movement
TA0009 - Collection
TA0010 - Exfiltration
TA0011 - Command and Control

Passive DNS

firstdigitalscope.gotdns.ch

Attack Log References

Whois Information

NetRange: 192.3.0.0 - 192.3.255.255 CIDR: 192.3.0.0/16 NetName: CC-15 NetHandle: NET-192-3-0-0-1 Parent: NET192 (NET-192-0-0-0-0) NetType: Direct Allocation OriginAS: AS36352 Organization: HostPapa (HOSTP-7) RegDate: 2013-06-07 Updated: 2024-02-02 Comment: Geofeed https://geofeeds.oniaas.io/geofeeds.csv Ref: https://rdap.arin.net/registry/ip/192.3.0.0 OrgName: HostPapa OrgId: HOSTP-7 Address: 325 Delaware Avenue Address: Suite 300 City: Buffalo StateProv: NY PostalCode: 14202 Country: US RegDate: 2016-06-06 Updated: 2024-04-26 Ref: https://rdap.arin.net/registry/entity/HOSTP-7 OrgTechHandle: NETTE9-ARIN OrgTechName: NETTECH OrgTechPhone: +1-905-315-3455 OrgTechEmail: net-tech-global@hostpapa.com OrgTechRef: https://rdap.arin.net/registry/entity/NETTE9-ARIN OrgAbuseHandle: NETAB23-ARIN OrgAbuseName: NETABUSE OrgAbusePhone: +1-905-315-3455 OrgAbuseEmail: net-abuse-global@hostpapa.com OrgAbuseRef: https://rdap.arin.net/registry/entity/NETAB23-ARIN RAbuseHandle: NETAB27-ARIN RAbuseName: NETABUSE-COLOCROSSING RAbusePhone: +1-800-518-9716 RAbuseEmail: abuse@colocrossing.com RAbuseRef: https://rdap.arin.net/registry/entity/NETAB27-ARIN RTechHandle: NETTE11-ARIN RTechName: NETTECH-COLOCROSSING RTechPhone: +1-800-518-9716 RTechEmail: support@colocrossing.com RTechRef: https://rdap.arin.net/registry/entity/NETTE11-ARIN NetRange: 192.3.13.0 - 192.3.13.127 CIDR: 192.3.13.0/25 NetName: CC-192-3-13-0-25 NetHandle: NET-192-3-13-0-1 Parent: CC-15 (NET-192-3-0-0-1) NetType: Reassigned OriginAS: AS36352 Organization: VPS ACE (VA-188) RegDate: 2021-04-23 Updated: 2021-04-23 Ref: https://rdap.arin.net/registry/ip/192.3.13.0 OrgName: VPS ACE OrgId: VA-188 Address: 350 Main Street City: Buffalo StateProv: NY PostalCode: 14202 Country: US RegDate: 2013-07-24 Updated: 2013-07-24 Ref: https://rdap.arin.net/registry/entity/VA-188 OrgNOCHandle: BARAU15-ARIN OrgNOCName: Barauski, Matt OrgNOCPhone: +1-855-587-7223 OrgNOCEmail: support@vpsace.com OrgNOCRef: https://rdap.arin.net/registry/entity/BARAU15-ARIN OrgTechHandle: BARAU15-ARIN OrgTechName: Barauski, Matt OrgTechPhone: +1-855-587-7223 OrgTechEmail: support@vpsace.com OrgTechRef: https://rdap.arin.net/registry/entity/BARAU15-ARIN OrgAbuseHandle: BARAU15-ARIN OrgAbuseName: Barauski, Matt OrgAbusePhone: +1-855-587-7223 OrgAbuseEmail: support@vpsace.com OrgAbuseRef: https://rdap.arin.net/registry/entity/BARAU15-ARIN