213.136.93.171 Threat Intelligence and Host Information

Oct 19, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 213.136.93.171 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 67/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1012 - Query Registry, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1046 - Network Service Scanning, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1057 - Process Discovery, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1064 - Scripting, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1089 - Disabling Security Tools, T1096 - NTFS File Attributes, T1106 - Native API, T1110 - Brute Force, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1133 - External Remote Services, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1428 - Exploit Enterprise Resources, T1485 - Data Destruction, T1498 - Network Denial of Service, T1543 - Create or Modify System Process, T1547 - Boot or Logon Autostart Execution, T1564 - Hide Artifacts, T1566 - Phishing, T1573 - Encrypted Channel

  • Tags: 01.10.2025, 2025, 443 ma2592000, aaaa, aaaa nxdomain, abuseipdb, accept, access, access ta0001, access ta0006, activity, activity beacon, activity mirai, added active, address, address domain, a domains, adversaries, adware malware, ag alberto, ag ingo, air force, akamai, alerts, algorithm, all quiet, all scoreblue, all search, america city, analyzer paste, analyzer threat, andariel, android, anomalous file, a nxdomain, apache, appdata, appdatalocal, apple, april, artemis, as10753 level, as10796 charter, as11351 charter, as11426 charter, as11427 charter, as12271 charter, as12337 noris, as133618, as14061, as15133 verizon, as15169 google, as15598, as16276, as16552 tiggee, as16625 akamai, as16787 charter, as174 cogent, as19024, as1921, as19536 directv, as20001 charter, as20115 charter, as204601 zomro, as20940, as21342, as24940 hetzner, as28521, as29789, as31898 oracle, as32787 akamai, as32934, as33363 charter, as3379 kaiser, as3456 charter, as35994 akamai, as396982 google, as397241, as40021 contabo, as44273 host, as45430, as47846, as49505, as51167 contabo, as53418, as54113, as5742, as60664 xion, as62597 nsone, as63949 linode, as6976 verizon, as7018 att, as701 verizon, as714 apple, as7843 charter, as797 att, as8068, as8075, as8560, as8972 host, as9009 m247, asn as15598, asnone, asnone dns, asnone germany, asnone related, asnone united, austria, avast avg, av detections, avg clamav, backdoor, benchhttp, binbusybox, bios, bits, bittorrent dht, blacklist, body, body doctype, body head, brazil, breaking news, brian sabey, browsing, brute-force, bruteforce, business, cachecontrol, capa, cape, catalog tree, cc3517, centos web, certificate, charter communications, check, checkin, china unknown, chrome, cisco umbrella, clickable urls, close, cname, cnapple public, cnc beacon, code, colorado, command, components, connection, contacted, content length, content type, control ta0011, cookie, copy, copyright, country united, cowrie, cp bus, create process, creates, creation date, cryp, cryptexportkey, cur cono, cus cndigicert, cus cngts, cus ouserver, cve201717215, cyber folks, cyberfolks, cyber security, cyber warfare, czechia unknown, data redacted, date, date hash, date tue, ddos, DDoS, default, defense evasion, delete, delete c, delete file, delete shadows, delphi, demonbot, denvecolorado, denver, denver colorado, destination, detected m1, detection list, dionaea, discovery e1082, discovery t1082, div div, dns query, docguard, dock, domain, domain name, domain related, domains, doscom c, download, dr city, drweb, dynamic, dynamicloader, e1203 data, e1564 hidden, e98c1cec8156, ecacc, echo request, ee edcje4j, ekyxe, emails, emails info, encrypt, entertainment, entries, entries http, enumerate, eofae, erase, error, et, et info, et p2p, etpro, etpro malware, etpro trojan, et trojan, evasion ob0006, evasion ta0005, example domain, execution, expiration date, expires thu, exploit, exploitation, exploit none, externalport, fakedout threat, fastly error, fatt, federation asn, file, filehash, filerepmalware, files, filesadobe c, file samples, files c, files domain, files ip, file size, files location, files matching, file system, file type, finance, find, fin ivdo, fixed line, flag united, format, for privacy, found, france, france unknown, gafgyt, games, gecko, germany, germany mail, germany unknown, get http, gmt cache, gmt content, gmt contenttype, gmt server, gmt setcookie, gmt vary, google safe, grum, guard, hash avast, hashes, hashes cape, hat server, helloworld, heurunsec, hichina, hide artifacts, high, high assurance, historical otx, hitmen, holidaycheck ag, home, home network, honduras, HoneyNet Connect, honeytrap, host, hosting, hostmaster, hostname, hostnames, html public, http, http headers, http host, http request, huawei hg532, huawei remote, hx88x89, hx88x9ax1e, icmp traffic, ids detections, ietfdtd html, immobilien ag, impact ob0008, impact ta0040, inbound, inc orgid, inc usage, indicator facts, indonesia, information isp, install, installcore, instrumentation, intel, internalport, invalid pointer, invalid url, ioc, iocs, ios, ip address, ip check, ip country, ip summary, ip traffic, ipv4, ireland, ireland unknown, isp charter, isp hostname, issuing ca, javascript, javascript c, jujubox, june, kelihos, khtml, kraupa, kryptiklfq, kryptikpii, kryptikxp, kurt walther, kx82xd3x11, labs pulses, level 3, levelblue, licess, line isp, lnmp, lnmp a, location los, location oxford, location united, look, lowfi, lredmond, m1, magic pdf, mailoney, mail spammer, main, maldoc, malicious, malware, malware beacon, malware site, malware traffic, malware worm, masquerade, media center, medium, memcommit, memory pattern, memreserve, meta, method status, mexico, mexico unknown, michigan, microsoft, miniigd upnp, mirai, mirai variant, mitm, mitre att, modify system, module load, modules t1129, moldova related, moldova unknown, moved, mozilla, msdefender apr, msie, msms57295540, msms86718722, msr apr, ms windows, mtb apr, mtb aug, mutexes, mx81xd1r, name servers, net107, net1070000, nethandle, netherlands, netherlands asn, netrange, networks, next, next http, Nextray, nids, nod32, no data, nondns, ns nxdomain, null, number, nxdomain, ob0005 defense, object, object moved, odigicert inc, ogoogle trust, onelouder, onl our, open, open threat, os version, otx scoreblue, ouserver ca, overview ip, oxford, oxypumper, p0f, packing t1045, panda, panel forum, passive dns, path, pattern domains, payload hello, pcap, pdb path, pdf document, pdf execution, pe32, pedraz, pe resource, persistence, phishing, phishing bank, php, phy samo, .pl, please, plesk forum, poland, poland unknown, porn, pornhub.software, port, possible, post, postalcode, post http, post utcore, powershell, pragma, process32nextw, process t1543, project pi, pulse http, pulse pulses, pulses, pulses none, pulse submit, puma se, push, pushdo, quantum fiber, query, ransom, read, read c, reads software, realtek sdk, record type, record value, recycle bin, redacted for, regbinary, regdword, registrar, regsetvalueexa, related nids, related pulses, related tags, request, resolverror, response, reverse dns, rock, role title, rpcs, rsa ca, rsa tls, RTBH, russia as49505, sabey, safe site, sameorigin, sample, samples, sandbox, scan endpoints, scans show, script domains, script script, script urls, sea p, search, secure server, sensor-tagged, sentrypeer, serce internetu, server, server ca, server error, server header, servers, service, set cookie, sgeneric, sha256, shell, show, showing, shutdown, signals mutexes, sinkhole cookie, slcc2, slovakia, soa nxdomain, soap command, spammer, specified, spectrum, sports, ssdeep, ssl certificate, stateprov, status, stop, storage, stream, stwashington, subdomains, subject, summary, suricata, susp, suspicious, sweep, swipper, t1036, t1045, t1047, t1059 very, t1064, t1083 reads, t1129, t1189 found, ta0002 command, ta0003 create, tag count, tags, tanner, tcp, tcp syn, text c, thailand, timo salzsieder, title, title meta, tls rsa, tofsee, tools, total, tpot, tptjsw, trending videos, trid adobe, trojan, trojandropper, trojan features, trojanspy, tsara brashears, ttl value, tulach, type, type fixed, type get, type indicator, united, united kingdom, unknown, unsafe, updated date, url analysis, url hostname, url http, url https, urls, urls http, urls https, url summary, usage type, user, useragent, users, value snkz, vhash, vietnam, vipre, virtool, virus, virustotal, vitro, weather, web, whitelisted, whitesky, whois, whois lookup, win32, win32dh, win64, windows, windows check, windows create, windows nt, windows service, wordpress, world, wow64, write, write c, write file, wsasend, x8dxb7xb7, x92xac, x95xd3xa4, xb9x8b, x cache, xe e, x frame, xport, yara detections, yara rule, yomi hunter, zenbox, zune

  • JARM: 07d2ad16d21d21d00042d43d000000eed8083ffe0365e3dd86aa60eff5d3bb

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, gpf_comics, stopforumspam_365d

Malware Detected on Host

Count: 1 24250f5c7e10b393522375639e605df99f876267a913ff303690a06f92727c55

Open Ports Detected

110 143 2077 2082 2083 2086 2087 2095 2096 3306 443 465 587 80 993 995

CVEs Detected

CVE-2025-30232

Map

Whois Information

  • inetnum: 213.136.80.0 - 213.136.94.255
  • netname: CONTABO
  • descr: Contabo GmbH
  • country: DE
  • org: ORG-GG22-RIPE
  • admin-c: MH7476-RIPE
  • tech-c: MH7476-RIPE
  • status: ASSIGNED PA
  • mnt-by: MNT-CONTABO
  • mnt-lower: MNT-CONTABO
  • mnt-domains: MNT-CONTABO
  • mnt-routes: MNT-CONTABO
  • created: 2015-03-05T08:10:15Z
  • last-modified: 2015-03-05T08:10:15Z
  • organisation: ORG-GG22-RIPE
  • org-name: Contabo GmbH
  • country: DE
  • org-type: LIR
  • address: Aschauer Strasse 32a
  • address: 81549
  • address: Munchen
  • address: GERMANY
  • phone: +498921268372
  • fax-no: +498921665862
  • abuse-c: MH12453-RIPE
  • mnt-ref: RIPE-NCC-HM-MNT
  • mnt-ref: MNT-CONTABO
  • mnt-ref: MNT-OCIRIS
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: MNT-CONTABO
  • created: 2009-12-09T13:41:08Z
  • last-modified: 2021-09-14T10:49:04Z
  • person: Johannes Selg
  • address: Contabo GmbH
  • address: Aschauer Str. 32a
  • address: 81549 Muenchen
  • phone: +49 89 21268372
  • fax-no: +49 89 21665862
  • nic-hdl: MH7476-RIPE
  • mnt-by: MNT-CONTABO
  • mnt-by: MNT-GIGA-HOSTING
  • created: 2010-01-04T10:41:37Z
  • last-modified: 2024-04-15T11:05:18Z
  • route: 213.136.92.0/23
  • descr: CONTABO
  • origin: AS51167
  • mnt-by: MNT-CONTABO
  • created: 2014-03-02T10:02:28Z
  • last-modified: 2014-03-02T10:02:28Z

Links to attack logs

anonymous-proxy-ip-list-2023-12-29 anonymous-proxy-ip-list-2024-02-03 anonymous-proxy-ip-list-2024-02-08 ****** anonymous-proxy-ip-list-2024-02-07 anonymous-proxy-ip-list-2024-02-02 anonymous-proxy-ip-list-2023-12-21 anonymous-proxy-ip-list-2023-12-22 anonymous-proxy-ip-list-2023-12-27 anonymous-proxy-ip-list-2023-12-03 anonymous-proxy-ip-list-2024-01-02 anonymous-proxy-ip-list-2024-02-18 anonymous-proxy-ip-list-2024-08-25 anonymous-proxy-ip-list-2023-12-25 anonymous-proxy-ip-list-2023-12-26 anonymous-proxy-ip-list-2024-01-29 anonymous-proxy-ip-list-2024-02-06 anonymous-proxy-ip-list-2023-12-05 anonymous-proxy-ip-list-2024-08-16 anonymous-proxy-ip-list-2024-08-24 anonymous-proxy-ip-list-2024-08-26 ****** anonymous-proxy-ip-list-2024-02-15 ****** anonymous-proxy-ip-list-2023-12-23 anonymous-proxy-ip-list-2024-01-01

Share on: