205.139.110.242 Threat Intelligence and Host Information

Apr 18, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 205.139.110.242 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1001 - Data Obfuscation, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036 - Masquerading, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1045 - Software Packing, T1046 - Network Service Scanning, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1057 - Process Discovery, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1064 - Scripting, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1089 - Disabling Security Tools, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1100 - Web Shell, T1105 - Ingress Tool Transfer, T1106 - Native API, T1112 - Modify Registry, T1114.002 - Remote Email Collection, T1114 - Email Collection, T1119 - Automated Collection, T1129 - Shared Modules, T1132 - Data Encoding, T1140 - Deobfuscate/Decode Files or Information, T1158 - Hidden Files and Directories, T1176 - Browser Extensions, T1190 - Exploit Public-Facing Application, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1211 - Exploitation for Defense Evasion, T1222.002 - Linux and Mac File and Directory Permissions Modification, T1412 - Capture SMS Messages, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1450 - Exploit SS7 to Track Device Location, T1454 - Malicious SMS Message, T1496 - Resource Hijacking, T1497 - Virtualization/Sandbox Evasion, T1498 - Network Denial of Service, T1543 - Create or Modify System Process, T1546 - Event Triggered Execution, T1547 - Boot or Logon Autostart Execution, T1560 - Archive Collected Data, T1566 - Phishing, T1568 - Dynamic Resolution, T1573 - Encrypted Channel, T1574.008 - Path Interception by Search Order Hijacking, T1583.005 - Botnet, T1588 - Obtain Capabilities, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0007 - Discovery, TA0011 - Command and Control, TA0029 - Privilege Escalation, TA0037 - Command and Control

  • Tags: $WebWatson, 443 ma2592000, 5511940750757, aaaa, aaaa nxdomain, abuseipdb, accept, activity beacon, adaptivebee, added active, address, administrator, a domains, adult content, aes256gcm, agent, agent tesla, agenttesla, akamai, akamaiasn1, alexa, alexa top, algorithm, all octoseek, all scoreblue, all search, amadey, america, america asn, america city, amonetize, analyze, analyzer paste, analyzer threat, anchor hrefs, android, Anomalous.100%, anonymizer, a nxdomain, anyxxxtube, apache, api blog, appdata, appdatalocal, apple, apple ios, apple phone, april, arbor networks, arc1, artemis, as10753 level, as10796 charter, as11351 charter, as11426 charter, as11427 charter, as12271 charter, as14061, as15133 verizon, as15169 google, as16276, as16625 akamai, as16787 charter, as174 cogent, as19536 directv, as20001 charter, as20115 charter, as204601 zomro, as20940, as28521, as31154 toyota, as31898 oracle, as32244 liquid, as33363 charter, as3379 kaiser, as3456 charter, as396982 google, as40021 contabo, as44273 host, as51167 contabo, as53418, as54113, as55293 a2, as55688 pt, as5742, as60664 xion, as6185 apple, as63949 linode, as6976 verizon, as7018 att, as701 verizon, as714 apple, as7843 charter, as797 att, as8068, as8075, ascii text, ashley, asn as55688, asnone, asnone germany, asnone united, assign function, asyncrat, august, auth1, authority, avast avg, avast win32, ave maria, avg win32, awful, azorult, babelpolyfill, back, backdoor, bandoo, bank, banker, bankerddedridexexploit, bankerdridexevasive, banking, basic, b body, bcnt1, BehavesLike.YahLover, belgium, belgium unknown, benchhttp, betabot, bhja, binder, bitbucket.org, bitfender, bittorrent dht, blacklist, blacklist http, blacklist https, blacknet, blacknet rat, blacknet threats, bladabindi, blood, body, body doctype, body head, body length, bondat, boomrapikey, boomr function, boomrmq string, botmaster, botnet, botnetwork, bot networks, bounty, bradesco, breaking news, breast cancer, brian sabey, brute force, buildno, burkina, business, c2, ca id, callback function, capa, ca x3, cc3517, cdate, centos web, certificate, channelisales, chaos, check, china cobalt, christine, chrome, cisco umbrella, citadel, ck id, ck matrix, class, clean mx, click, clng, close, cloudeye, cmc threat, cname, cndst root, cnisrg root, cobalt strike, cobaltstrike4.tk, code, collections kp, colorado, comcast, com laude, command, command and control, command_and_control, communicating, components, comspec, conduit, connect, contact, contacted, contacted urls, content length, content type, control ta0011, __convergedlogin_pcustomizationloader_44b450e8d543eb53930d, cookie, copy, copyright, core, count blacklist, country, country united, covid19, crack, crash, created, create process, creates, creation date, critical, critical risk, cryptbot, cryptexportkey, csc corporate, cus cndigicert, cus cngts, cus cnmicrosoft, cus cnr3, cus olet, cus ouserver, cutwail, CVE-2005-1790, CVE-2009-3672, CVE-2010-3333, CVE-2010-3962, CVE-2012-3993, CVE-2014-3153, CVE-2014-6332, CVE-2015-1641, CVE-2015-1650, CVE-2017-0143, CVE-2017-0147, CVE-2017-0199, CVE-2017-11882, CVE-2017-8464, CVE-2017-8570, CVE-2017-8759, CVE-2018-0802, CVE-2018-4893, CVE-2018-8373, CVE-2018-8453, CVE-2020-0601, CVE-2020-0674, CVE-2021-27065, CVE-2021-40444, CVE-2023-4966, cyber army, cybereason, cyberfolks, cyber stalking, cyberstalking, cyber threat, czechia unknown, darkgate, dark power, darkweb, data, data rticon, date, date hash, daum, dbatloader, december, deep scan, defacement, default, defender, de indicators, delete, delete c, delete file, Delf.NBX, delphi generic, denver, destination, destination ip, detection list, detections type, detplock, device, discovery t1082, district, dnspionage, dns replication, dns resolutions, docs pricing, doctype, domain, domain name, domain related, domain robot, domains, domaiq, doscom c, dos exe, dos executable, downer, downldr, download, downloader, downloads, dr city, dridex, dropbox, dropped, dropper, drpsuinstaller, drweb, dynamic, dynamicloader, e98c1cec8156, ecacc, edsaid, elf collection, emails, emails info, emotet, empty hash, ems1, encrypt, encrypt cnr3, endangerment, engineering, entertainment, entries, entries http, enumerate, erase, error, error resume, et, et info, et p2p, etpro, etpro trojan, et tor, et trojan, eurodns sa, europeberlin, evasion ta0005, evasive, evasivemsilratrevenge-rat, evilnum, example domain, executable, execution, exe size, exit, expiration date, exploit, exploited spyware, exploit source, exploit_source, explorer, external ip, facebook, factory, fakealert, fakedout threat, falcon sandbox, false, fastly error, february, feodo tracker, file, file name, filerepmalware, FileRepMalware, files, filesadobe c, file samples, files c, files deleted, files ip, files location, files matching, file system, file type, final url, finance, financial, find, firefox c, first, first seen, fixed line, flashpix, formbook, for privacy, fortinet, france, frankfurt, fuery, gamehack, games, gandi sas, gating, gecko, general, general full, generic, generic malware, generic windos, Gen:Heur.Ransom.HiddenTears, genkryptik, germany, germany unknown, get http, get na, getprocaddress, ghost rat, gina, gmbh, gmbh version, gmt cache, gmt content, gmt server, gootkit, grandoreiro, graph, hacker, hackers, hacking, hacktool, hallrender, hallrender.com, hashes, hat server, header intel, headers nel, healthone, hetzner online, heur, heurunsec, hiddentear, high, highly targeted, hijacker, hiloti, historicalandnew, historical otx, historical ssl, hit, home, host, hosting, hostname, hostnames, houdini, hrefs, hr rtd, html, html document, html public, http, httponly, http requests, http response, https, hupigon, hx88x89, hx88x9ax1e, hybrid, icedid, Icefog, icons library, icwrmind, identifier, ids detections, ietfdtd html, iframe, ii llc, impressum, incident ip, inc orgid, inc usage, indicator, indicator facts, indostealer, info, info compiler, information isp, inmortal, installcore, installer, insurance, intel, internet files, invalid pointer, invalid url, invasion of privacy, iobit, iocs, ioc search, ios, ip address, ip detections, iphone unlocker, ip related, ip security, ip summary, ip traffic, ipv4, isp charter, isp hostname, issuer, ja3s, jansky, january, japan, javascript, javascript c, jeffrey scott reimer, js user, jujubox, july, june, karin, kathrin, kb body, kb file, kde, kelihos, key algorithm, keybase, key identifier, key info, keylogger, key usage, kgs0, khtml, kidney cancer, kls0, known tor, konqueror, kovter, kraken, kryptiklfq, kryptikpii, kx82xd3x11, kyrgyz default, language, languageenu, law firm, layer protocol, lcc linker, legal, level, level 3, levelblue, line isp, link library, linux agent, listen, live, liver cancer, local, localeenus, location los, location oxford, location united, lockbit, locky, loki, lokibot, Loki Password Stealer (PWS), loki pws, look, lowfi, low software, luke, lumma stealer, lung cancer, main, majorver16, maldoc, malicious, Malicious domain - SANS Internet Storm Center, malicious red team, malicious site, malicious url, maltiverse, malvertizing, malware, malware beacon, malware distribution site, malware download, malware host, malware ransom trojan evader rat, malware site, markmonitor, mascore2, mas.to, matches rule, matsnu, maxage5184000, mb first, mediamagnet, medical center, medium, memcommit, memory pattern, meta, meterpreter, mexico unknown, michigan, microsoft, million, miner, misc attack, mitre, mitre att, mobilekey.pw, model, modify system, module load, modules t1129, moldova related, moldova unknown, monitoring, moved, mozilla, msie, msil, msms86718722, msr apr, ms windows, mutexes, mx81xd1r, name, namecheap inc, name md5, name servers, name verdict, nanocore rat, nct1, necurs, net107, net1070000, nethandle, netherlands, netherlands asn, netrange, network, network rat, networm, new ioc, next, next http, nids, nivdort, njrat, nod32, no data, node tcp, node traffic, no expired, no na, noname057, no no, notepad, november, npzk765, ns nxdomain, null, number, nxdomain, nymaim, object, object moved, observed, october, odigicert inc, odx3x33jk9w3, ogoogle trust, olet, open, open threat, opera, os2 executable, osregion, os version, otx telemetry, ouserver ca, outbreak, overlay, oxford, packing t1045, page dow, panda, panel forum, parked, partru, passive, passive dns, password bypass, paste, patch, path, pattern match, paypal, pcap, pe32, pe32 executable, pe32 linker, pe32 packer, pegasus, pe resource, performs dns, persistence, pe section, petite, pe yandex, phi, phishing, phishing bank, phishing paypal, phishingransomwaresinkhole, phishing site, pii, pings c, .pl, please, plesk forum, plugx, pony, pornhub, port, poser, possible, postalcode, post http, post utcore, pragma, prefetch8, presbyterianst, presenoker, prism_object, prism_setting, problem, problems, process, process32nextw, processes tree, process t1543, products, project, project skynet, prostate cancer, protocol h2, protocol t1071, psiusa, ptls7, public key, public w3cdtd, puffstealer, pulse http, pulse pulses, pulses, pulses none, pulse submit, pushdo, pykspa, python user, qakbot, quasar, quasar rat, query, raccoon, radamant, ramnit, ransomexx, ransomware, ransomwaretorrentlocker, rat, rat trojan, read, read c, reads software, record type, record value, redacted for, redirector, redirectors, redline, redline stealer, referrer, refresh, regbinary, regdword, registrarsafe, registry, registry keys, regsetvalueexa, relacionada, related nids, related pulses, related tags, relayrouter, relic, remcos, remote, remote access trojan, remote debian spy, replacement, request, research group, resolutions, resource hash, response, restart, revenge rat, revenge-rat, reverse dns, rightsaided, riskware, rmndrp, rock, role title, root ca, rticon kyrgyz, rticon neutral, rultazo, runescape, sabey, safe site, sality, sameorigin, samesite=none, samesitenone, sample, samples, sandy, sarcoma, scammer, scan endpoints, scanning host, scans show, script, script script, scriptsrcelem, script urls, sea p, search, search debian available space, search live, secure server, security, security tls, seen, send bug, september, server, server ca, server header, servers, service, service privacy, serving ip, set cookie, settingswpad, sex_phot.jpg.exe, sgeneric, sha1, sha256, sha2 secure, shell, shell code, show, showing, show technique, shutdown, siblings domain, signals mutexes, simda, sinkhole, sinkhole cookie, site, skin cancer, skynet, sliver, slot1, smokeloader, Smokeloader, sneaky server, snort ip, soa nxdomain, social engineering, software, solimba, song culture, sonja, sophos, South Carolina Federal Credit Union phishing, spammer, span, spearfishing, specified, sports, spyware, srdvd16010404, ssdp, ssl certificate, startpage, stateprov, states, static engine, status, status code, status page, stealer, steam, stop, storage, stream, strike, strings, subject, subject key, subject public, summary, suppobox, survivor, susp, suspic, suspicious, swift, swrort, sylvia, system, systemlocale, t1045, t1046 sends, t1059 very, t1064, t1083 reads, t1129, ta0002 command, ta0003 create, ta0007 network, tag count, tagging, tags, tag tag, targeted attack, targeting, targets, targets sa, targets tsara brashears, team, teams api, technology, template, text, text c, threat, threat analyzer, threat report, threat roundup, tinba, title, title meta, tls rsa, tofsee, tools, tor c++, tor c++ client, tor known, tor relayrouter, tracking, traffic, trending videos, trickbot, trojan, trojan evader, trojan features, trojan malware, trojanspy, trojanx, trustinfo, tsara brashears, ttl value, tue dec, tulach, twitter, type, type fixed, type indicator, type name, type win32, unauthorized, undetected dns8, undetected vx, unicode text, union, united, united kingdom, unknown, unlocker, unreliable subdomains, unruy, unsafe, upatre, url analysis, url http, url https, urls, urls http, urls https, url summary, ursnif, usage type, user, utf8 text, v3 serial, valid, validity, value, value snkz, variables, vault, vawtrak, vdfsurfs, vendorname2581, verify, vidar, vipre, virtool, virus network, virustotal, virut, vitro, vjw0rm, voun2hd, vs2005, vs2008, vs98, wacatac, wanacrypt0rwannacrywcry, weather, webshell, webtoolbar, wells fargo, west domains, whitelisted, whois, whois lookup, whois parent, whois record, whois siblings, whois whois, win16 ne, win32, win32dh, win32 dynamic, win32 exe, win64, windows check, windows create, windows nt, windows service, wiper, worm, write, write c, write file, written c, wTJh.exe, x00x00, x509v3 crl, x8dxb7xb7, x92xac, x95xd3xa4, xb9x8b, x frame, xhtml, xmlns http, yandex, yara detections, yara rule, ygjpaufscontext, zbot, zdb zeus, zenbox, zeus, zune

  • View other sources: Spamhaus VirusTotal

  • Country: United States
  • Network:
  • Noticed: 16 times
  • Protocols Attacked: SSH
  • Countries Attacked: Brazil, Canada, France, Germany, Hungary, Indonesia, Ireland, Japan, Luxembourg, Moldova Republic of, Russian Federation, Spain, Ukraine, United States of America
  • Passive DNS Results: smtp.tmh.org inbound.idaho.gov relay.idaho.gov relay2.idaho.gov mail.grovesconstruction.com bridgeviewbankmortgagemail2.myabt.net highlandsloansmail.myabt.net highlandsmortgagemail.myabt.net mail.giin.org mimecastemail.camarketing.com bridgeviewbankmortgagemail.myabt.net mailhub1.ahsys.org us-smtp-inbound-2.mimecast.com mimecast1.nilanjohnson.com us-smtp-inbound-1.mimecast.com highlandsloansmail2.myabt.net mx1.octitle.com

Malware Detected on Host

Count: 10 ad56cbe93c076716605d8f9428e6674a8c290fee44ad88a839ad97d7861f3f64 517d018f1d6a4a2ebeae883b3b8764ad0eb79335be4590c0e171d99f353fdba9 11e4bcc0293961bb87e25ea824525b79ce0591b9fbd3c18eac9154d1c1c8a541 e95473aa49d0a44bfe6f78fa48cc7ca41f9593088fa6eb7f1e94ae5bffa06026 5966e329cb56a0cc4956f1ca0da2b337aa3e6145d4622ac1152bfc29ab96304d d764f74fed76b0aca2fa47d40dbafb789d1a092383c9a16ff028d43314761c61 c0ad356737bbda3e5a6ee90ebde15c611559c5e4f818e74a20d5d04df7807521 2bd6f81fe8e057a0a4be0622b091c4ec586396b88c8c9b45b58b75a1938bff7f 37e9a5dffeac0dcac798df71444aeb6a0ffadf1391d38bc028c46038db7fbbac 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a

Open Ports Detected

25 587

Map

Whois Information

  • NetRange: 205.138.0.0 - 205.140.175.255
  • CIDR: 205.138.0.0/15, 205.140.160.0/20, 205.140.128.0/19, 205.140.0.0/17
  • NetName: CENTURYLINK-LEGACY-SAVVIS-BLK182
  • NetHandle: NET-205-138-0-0-1
  • Parent: NET205 (NET-205-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS:
  • Organization: CenturyLink Communications, LLC (CCL-534)
  • RegDate: 1995-02-15
  • Updated: 2018-11-15
  • Ref: https://rdap.arin.net/registry/ip/205.138.0.0
  • OrgName: CenturyLink Communications, LLC
  • OrgId: CCL-534
  • Address: 100 CENTURYLINK DR
  • City: Monroe
  • StateProv: LA
  • PostalCode: 71201
  • Country: US
  • RegDate: 2018-07-12
  • Updated: 2024-06-17
  • Comment: USAGE OF IP SPACE MUST COMPLY WITH OUR ACCEPTABLE USE POLICY:
  • Comment: https://www.lumen.com/en-us/about/legal/acceptable-use-policy.html
  • Comment:
  • Comment:
  • Comment: 1. You are permitted to route the Lumen IP prefixes listed via Public BGP to your alternate ISP from the designated ASN. Any other ASN originating the prefix listed is forbidden.
  • Comment: 2. The Lumen IP prefixes listed can be routed via Public BGP to your alternate ISP as long as you remain an active customer with Lumen and continue to route the prefixes over at least one Lumen Internet circuit without significant traffic engineering.
  • Comment: 3. Should your Internet services with Lumen be discontinued, Lumen reserves the right to have your alternate ISP terminate the routing of the Lumen IP prefixes without advanced notification, should you fail to do so.
  • Comment: 4. All IP Addresses assigned or allocated by Lumen to an end-user (customer or ISP) shall be considered non-portable and will be reclaimed by Lumen upon service termination.
  • Comment: 5. Lumen reserves the right to conduct audits to ensure the LOA conditions are being met.
  • Comment: 6. Usage of IP space must comply with our AUP https://www.lumen.com/en-us/about/legal/acceptable-use-policy.html
  • Comment:
  • Comment: Our looking glass is located at: https://lookingglass.centurylink.com/
  • Comment:
  • Comment: For subpoena or court order please fax 844.254.5800 or refer to our Trust & Safety page:
  • Comment: https://www.lumen.com/en-us/about/legal/trust-center/trust-and-safety.html
  • Comment:
  • Comment: For abuse issues, please email abuse@aup.lumen.com
  • Comment: All abuse reports MUST include:
  • Comment: * src IP
  • Comment: * dest IP (your IP)
  • Comment: * dest port
  • Comment: * Accurate date/timestamp and timezone of activity
  • Comment: * Intensity/frequency (short log extracts)
  • Comment: * Your contact details (phone and email)
  • Comment: Without these we will be unable to identify the correct owner of the IP address at that point in time.
  • Ref: https://rdap.arin.net/registry/entity/CCL-534
  • OrgRoutingHandle: RPKIR-ARIN
  • OrgRoutingName: RPKI-ROA
  • OrgRoutingPhone: +1-877-886-6515
  • OrgRoutingEmail: rpki-roa@lumen.com
  • OrgRoutingRef: https://rdap.arin.net/registry/entity/RPKIR-ARIN
  • OrgAbuseHandle: CAD54-ARIN
  • OrgAbuseName: Centurylink Abuse Desk
  • OrgAbusePhone: +1-877-886-6515
  • OrgAbuseEmail: abuse@aup.lumen.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/CAD54-ARIN
  • OrgTechHandle: QIA-ARIN
  • OrgTechName: Centurylink IP Admin
  • OrgTechPhone: +1-877-886-6515
  • OrgTechEmail: ipadmin@centurylink.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/QIA-ARIN

Links to attack logs

****** ****** ******

Share on: