192.42.116.28 Threat Intelligence and Host Information

Share on:
May 13, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 192.42.116.28 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 70/100

Host and Network Information

  • Mitre ATT&CK IDs: T1110 - Brute Force
  • Tags: Bruteforce, Nextray, SSH, TOR, Telnet, VPN, attack, badrequest, bruteforce, cve202229266, cyber security, description, description ip, digital ocean, indicator, indicator type, ioc, kfsensor, login, malicious, phishing, probing, rdp, scanner, scanners, scanning, ssh, vultr, webscan, webscanner, webscanner bruteforce web app attack
  • Known tor exit node
  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, botscout_30d, botscout_7d, dm_tor, et_tor, haley_ssh, sblam, snort_ipfilter, stopforumspam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, talosintel_ipfilter, tor_exits, tor_exits_1d, tor_exits_30d, tor_exits_7d

  • Known TOR node
  • Country: Netherlands
  • Network: AS1101 surfnet bv
  • Noticed: 50 times
  • Protcols Attacked: ssh
  • Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: dlgstreet.direct.quickconnect.to this-is-a-tor-exit-node-hviv128.hviv.nl

Malware Detected on Host

Count: 11 8baf3a0d9fbb0da7c194ee6137f96b6c3ab8e73be07cba516cb50d2b8f0a652c 2e1cb6a2cb1b284dbdd0b8d47d53f946ca0b27a196c45600cc656889c2e57623 a4a63515b6bd2562e94430e10629c0c9e69309b2281dc857628cd537909c0352 6dda72788904c9a5629dd078a870780bc082e185ac67cf3a5174c9d361658e51 4fa3f2617f30ba961c5a8ba15364a6b9c70882bf4f405cc868ef734bfefeed91 d981ad10286d6f252b690bbc47d2649fb6b6fd4f5bf05cdd85e55707168f2a04 4322f5477f23e04b4474091e6406c0aac5627e26d05fb5448e3fc5c28ff6dc14 cabf0db3d73622405c6ad92e55a24d186ba72e5f9155ca0e26a3bfff3f234656 21e53009e2fb57aca62dd0c2ce160d2dd4be02613523d293826ee12e10feac4b c53f13d92e43eab3a516773bfa1b0b38c7e31be44ff6d6404c275aee7463c0a3

Map

Whois Information

  • NetRange: 192.42.113.0 - 192.42.132.255
  • CIDR: 192.42.132.0/24, 192.42.113.0/24, 192.42.114.0/23, 192.42.120.0/21, 192.42.116.0/22, 192.42.128.0/22
  • NetName: RIPE-ERX-192-42-113-0
  • NetHandle: NET-192-42-113-0-1
  • Parent: NET192 (NET-192-0-0-0-0)
  • NetType: Early Registrations, Transferred to RIPE NCC
  • OriginAS:
  • Organization: RIPE Network Coordination Centre (RIPE)
  • RegDate: 2005-02-28
  • Updated: 2005-02-28
  • Comment: These addresses have been further assigned to users in
  • Comment: the RIPE NCC region. Contact information can be found in
  • Ref: https://rdap.arin.net/registry/ip/192.42.113.0
  • OrgName: RIPE Network Coordination Centre
  • OrgId: RIPE
  • Address: P.O. Box 10096
  • City: Amsterdam
  • StateProv:
  • PostalCode: 1001EB
  • Country: NL
  • RegDate:
  • Updated: 2013-07-29
  • Ref: https://rdap.arin.net/registry/entity/RIPE
  • OrgAbuseHandle: ABUSE3850-ARIN
  • OrgAbuseName: Abuse Contact
  • OrgAbusePhone: +31205354444
  • OrgAbuseEmail: [email protected]
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN
  • OrgTechHandle: RNO29-ARIN
  • OrgTechName: RIPE NCC Operations
  • OrgTechPhone: +31 20 535 4444
  • OrgTechEmail: [email protected]
  • OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN
  • inetnum: 192.42.116.0 - 192.42.116.31
  • netname: TOR-EXIT-HVIV
  • descr: https://www.hartvoorinternetvrijheid.nl/eng.html
  • descr: Amsterdam
  • country: NL
  • org: ORG-HVI2-RIPE
  • admin-c: HVI34-RIPE
  • tech-c: HVI34-RIPE
  • status: LEGACY
  • mnt-by: AS1101-MNT
  • created: 2017-11-02T13:21:00Z
  • last-modified: 2017-11-02T13:21:00Z
  • organisation: ORG-HVI2-RIPE
  • org-name: Hart voor Internetvrijheid
  • org-type: OTHER
  • address: Haarlemmer Houttuinen 63-3
  • address: 1013 GM Amsterdam
  • abuse-c: HVI34-RIPE
  • mnt-ref: NOTSURFNET-MNT
  • mnt-by: AS1101-MNT
  • mnt-by: NOTSURFNET-MNT
  • created: 2017-11-02T13:10:57Z
  • last-modified: 2017-11-02T13:34:15Z
  • role: Hart voor Internetvrijheid (Abuse)
  • address: Haarlemmer Houttuinen 63-3
  • address: 1013 GM Amsterdam
  • abuse-mailbox: [email protected]
  • nic-hdl: HVI34-RIPE
  • mnt-by: AS1101-MNT
  • mnt-by: NOTSURFNET-MNT
  • created: 2017-11-02T13:14:14Z
  • last-modified: 2017-11-02T13:33:13Z
  • route: 192.42.116.0/22
  • descr: IP-EEND-IP
  • origin: AS1101
  • mnt-by: AS1103-MNT
  • created: 2007-12-19T21:20:53Z
  • last-modified: 2007-12-19T21:20:53Z

Links to attack logs

vultrwarsaw-ssh-bruteforce-ip-list-2023-03-07 vultrwarsaw-ssh-bruteforce-ip-list-2022-08-29 bruteforce-ip-list-2021-01-14 dofrank-ssh-bruteforce-ip-list-2023-03-21 bruteforce-ip-list-2020-07-03