203.229.206.22 Threat Intelligence and Host Information

Apr 17, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 203.229.206.22 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 80/100

Host and Network Information

Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110.004 - Credential Stuffing, T1110 - Brute Force
Tags: attack, Bruteforce, Brute-Force, cowrie, cyber security, ioc, login, malicious, Nextray, phishing, scanner, ssh, SSH, Telnet
View other sources: Spamhaus VirusTotal
Contained within other IP sets: blocklist_de, blocklist_de_ssh, blocklist_net_ua

Country: South Korea
Network:
Noticed: 50 times
Protocols Attacked: ssh
Countries Attacked: Australia, Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: junior.catsecurity.net

Malware Detected on Host

Count: 6 a0ee131ef784e271c8d3749de724def97bcff6ad7eca49d60601ace2db39fcdc 9300cd667b6da2c03f962b36510665e314f3c8c2c7eae0be9a22a7836c2e3134 6b7cbb2815ecf79a9cd9ab9495f502587c80c09c82acd568cb510cc7c730c155 09a8334732e99fd97805269811deadaca5d4f28ab2b9d0fcf48f26ad38c6e883 f98f5ab7c62c81ccc6d53ca224624e348c0ed12dcd0b2350b3a1ff0a4a5f8e0f 25576c995ed43e08ffd44b9c0b398e355341455773abb9f6d45826b87b058871

Open Ports Detected

80 9000

CVEs Detected

CVE-2007-4723 CVE-2009-0796 CVE-2009-2299 CVE-2011-1176 CVE-2011-2688 CVE-2012-3526 CVE-2012-4001 CVE-2012-4360 CVE-2013-0941 CVE-2013-0942 CVE-2013-2765 CVE-2013-4365

Map

Whois Information

query : 203.229.206.22
IPv4주소 : 203.229.128.0 - 203.229.255.255 (/17)
기관명 : 주식회사 케이티
서비스명 : KORNET
주소 : 경기도 성남시 분당구 불정로 90
우편번호 : 13606
할당일자 : 19960601
이름 : IP주소 담당자
전화번호 : +82-2-500-6630
전자우편 : kornet_ip@kt.com
IPv4주소 : 203.229.206.0 - 203.229.206.255 (/24)
기관명 : 가톨릭대학교
네트워크 구분 : CUSTOMER
주소 : 경기도 부천시 원미구
우편번호 : 420-102
할당내역 등록일 : 20150317
이름 : IP주소 담당자
전화번호 : +82-2-500-6630
전자우편 : kornet_ip@kt.com
IPv4 Address : 203.229.128.0 - 203.229.255.255 (/17)
Organization Name : Korea Telecom
Service Name : KORNET
Address : Gyeonggi-do Bundang-gu, Seongnam-si Buljeong-ro 90
Zip Code : 13606
Registration Date : 19960601
Name : IP Manager
Phone : +82-2-500-6630
E-Mail : kornet_ip@kt.com
IPv4 Address : 203.229.206.0 - 203.229.206.255 (/24)
Organization Name : Gatoldaehakgyo
Network Type : CUSTOMER
Address : Wonmi-Gu Bucheon-Si Gyeonggi-Do
Zip Code : 420-102
Registration Date : 20150317
Name : IP Manager
Phone : +82-2-500-6630
E-Mail : kornet_ip@kt.com

Links to attack logs

Share on: