209.126.80.197 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 209.126.80.197 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Possibly Malicious Host 🟢 20/100

Host and Network Information

• View other sources: Spamhaus VirusTotal

• Country: United States
• Network: AS40021 contabo inc.
• Noticed: 1 times
• Protocols Attacked: Anonymous Proxy
• Passive DNS Results: bzuksmr.localto.net zwb9yrp.localto.net jhafspq.localto.net vtcc.cloud analytics.djangonest.com minecraft.lootah.cam visacine.com cdn.mazdacosmosport.com diversionenmontana.com.mx colorestapalpa.mx cdn.antywirusy.edu.pl lego.altcarb.eu

Malware Detected on Host

Count: 5 1ee0bbe65d36377f7ae07751bc2ec01c75e1e6910dcb7fab5a840e385766e033 c087b75c232bdfa3d7b4e7ed2c8d4cc121d95dc771b8fa6895a7e67602bb6196 330b18e944ddacb97f402b9047b5a2ecbfcf8e15da0ff4ea403fbf4dbdb74b59 502024626e41250255969e471b867d42ec317862b4e45cea98fc68bdf3f9b436 1fda489ae72b60aec0485da197fab895bbefc1c78eab87a099fe5ff8c89abb08

Open Ports Detected

1414 1521 2081 22 4040 4664 5697 5801 80 8048 8088 8111 82 8419 8834 9207 9981

CVEs Detected

CVE-2007-2768 CVE-2008-3844 CVE-2016-20012 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408 CVE-2023-48795 CVE-2023-51385 CVE-2023-51767 CVE-2024-6387

Map

Whois Information

• NetRange: 209.126.80.0 - 209.126.87.255
• CIDR: 209.126.80.0/21
• NetName: CONTA-48
• NetHandle: NET-209-126-80-0-1
• Parent: NET209 (NET-209-0-0-0-0)
• NetType: Direct Allocation
• OriginAS: AS40021
• Organization: Contabo Inc. (CONTA-48)
• RegDate: 2021-03-18
• Updated: 2023-05-16
• Ref: https://rdap.arin.net/registry/ip/209.126.80.0
• OrgName: Contabo Inc.
• OrgId: CONTA-48
• Address: 710 N Tucker Blvd. STE 400A
• City: St. Louis
• StateProv: MO
• PostalCode: 63101
• Country: US
• RegDate: 2019-12-23
• Updated: 2023-04-05
• Ref: https://rdap.arin.net/registry/entity/CONTA-48
• OrgNOCHandle: CONTA393-ARIN
• OrgNOCName: Contabo NOC
• OrgNOCPhone: +498921268372
• OrgNOCEmail: sascha.wintz@contabo.com
• OrgNOCRef: https://rdap.arin.net/registry/entity/CONTA393-ARIN
• OrgAbuseHandle: CAD61-ARIN
• OrgAbuseName: Contabo Abuse Department
• OrgAbusePhone: +498921665862
• OrgAbuseEmail: abuse@contabo.de
• OrgAbuseRef: https://rdap.arin.net/registry/entity/CAD61-ARIN
• OrgTechHandle: CONTA392-ARIN
• OrgTechName: Contabo Tech
• OrgTechPhone: +498921665862
• OrgTechEmail: johannes.selg@contabo.de
• OrgTechRef: https://rdap.arin.net/registry/entity/CONTA392-ARIN
• OrgRoutingHandle: CONTA393-ARIN
• OrgRoutingName: Contabo NOC
• OrgRoutingPhone: +498921268372
• OrgRoutingEmail: sascha.wintz@contabo.com
• OrgRoutingRef: https://rdap.arin.net/registry/entity/CONTA393-ARIN

Links to attack logs

anonymous-proxy-ip-list-2024-09-20