202.146.217.192 Threat Intelligence and Host Information

Share on:

General

This page contains threat intelligence information for the IPv4 address 202.146.217.192 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 47/100

Host and Network Information

  • Mitre ATT&CK IDs: T1046 - Network Service Scanning, T1423 - Network Service Scanning, T1595.001 - Scanning IP Blocks, T1595.002 - Vulnerability Scanning, T1596.005 - Scan Databases, TA0043 - Reconnaissance
  • Tags: blacklist, botnet, bruteforce, cyber security, digital ocean, ioc, malicious, Malicious IP, mirai, mssql, Nextray, nmap, phishing, port-scan, scan, smb, tcp, tsec

  • View other sources: Spamhaus VirusTotal

  • Country: Hong Kong
  • Network: AS64050 bgpnet global asn
  • Noticed: 1 times
  • Protcols Attacked: mssql
  • Countries Attacked: Australia, Canada, Czechia, Denmark, Estonia, France, Germany, Italy, Latvia, Lithuania, Norway, Poland, Romania, Singapore, Turkey, Ukraine, United Kingdom, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: ylmp3.com vlp8093.cn 915859.com whc1818.com baihu-fuzhu.com www.4xjob.cn 4xjob.cn m.xhrenshui.com www.xinxinxiu.com xinxinxiu.com 8898567.com

Malware Detected on Host

Count: 2 f2cf080916163ed2c1439d62ae2e65ea59d6d6560aea1d5ad0663297a9f8cc5a 98d98f1a1d94dda824af6fb34115ca8863582916cf6b302bd55d8736a60ea100

Map

Whois Information

  • inetnum: 202.146.217.0 - 202.146.217.255
  • netname: MEGA-II
  • descr: MEGA-II IDC
  • country: HK
  • admin-c: DA179-AP
  • tech-c: DA179-AP
  • abuse-c: AS2098-AP
  • status: ALLOCATED NON-PORTABLE
  • mnt-by: MAINT-HK-SUN
  • mnt-irt: IRT-SUN-HK
  • last-modified: 2020-05-17T23:04:03Z
  • irt: IRT-SUN-HK
  • address: MEGA-II IDC
  • e-mail: [email protected]
  • abuse-mailbox: [email protected]
  • admin-c: DA179-AP
  • tech-c: DA179-AP
  • mnt-by: MAINT-HK-SNW
  • last-modified: 2023-05-11T06:45:09Z
  • role: ABUSE SUNHK
  • address: MEGA-II IDC
  • country: ZZ
  • phone: +000000000
  • e-mail: [email protected]
  • admin-c: DA179-AP
  • tech-c: DA179-AP
  • nic-hdl: AS2098-AP
  • abuse-mailbox: [email protected]
  • mnt-by: APNIC-ABUSE
  • last-modified: 2023-05-11T06:51:55Z
  • person: DNS Administrator
  • nic-hdl: DA179-AP
  • e-mail: [email protected]
  • address: SHA TIN
  • phone: +852-2135-9374
  • country: HK
  • mnt-by: MAINT-HK-SNW
  • abuse-mailbox: [email protected]
  • last-modified: 2020-05-17T14:55:38Z

Links to attack logs

nmap-scanning-list-2022-02-19 vultrparis-mssql-bruteforce-ip-list-2022-03-07 dolondon-mssql-bruteforce-ip-list-2022-04-30 dosing-mssql-bruteforce-ip-list-2022-03-09 dolondon-mssql-bruteforce-ip-list-2021-11-20