221.231.81.240 Threat Intelligence and Host Information
Jun 14, 2025
ipinfopage
General
IP Address
221.231.81.240
Location
🇨🇳 Shanghai, China
Network
AS4134
Threat Score
56/100
Attack Intelligence
MITRE ATT&CK Techniques
T1027 - Obfuscated Files or Information, T1037.003 - Network Logon Script, T1041 - Exfiltration Over C2 Channel, T1057 - Process Discovery, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1119 - Automated Collection, T1129 - Shared Modules, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1463 - Manipulate Device Communication, T1547 - Boot or Logon Autostart Execution, T1568 - Dynamic Resolution, T1583.005 - Botnet
Geographic Location
Country
China
City
Shanghai
Region
Shanghai
Coordinates
31.2222, 121.4581
Network Information
ASN
AS4134
Organization
Chinanet
Network
AS4134 Chinanet
WHOIS Information
inetnum
221.224.0.0 - 221.231.255.255
netname
CHINANET-JS
descr
Beijing 100088
country
CN
admin-c
CH360-AP
tech-c
CN142-AP
abuse-c
AC1573-AP
status
ALLOCATED PORTABLE
mnt-by
MAINT-CHINANET
mnt-lower
MAINT-CHINANET-JS
mnt-routes
MAINT-CHINANET-JS
mnt-irt
IRT-CHINANET-CN
last-modified
2022-02-28T06:53:44Z
irt
IRT-CHINANET-CN
address
100032
e-mail
anti-spam@chinatelecom.cn
abuse-mailbox
anti-spam@chinatelecom.cn
role
CHINANET JIANGSU
phone
+86-10-58501724
nic-hdl
CH93-AP
notify
jsipmanager@163.com
person
Chinanet Hostmaster
fax-no
+86-10-58501724
- Country: China
- Network:
- Noticed: 3 times
- Protocols Attacked: SSH
- Countries Attacked: United States of America
Malware Detected on Host
Count: 12 ea8d41968cd4065178c53f0950cbe80d1733dd381dcaf41a961a6fe21b0b2510 06548389fee79e5f399db95a33fb0f011f8c086e110b74cb908f2a6f91197584 12e3749c0ba68d7f54eee73af9bb86ecc4c277e3abe010b7da524902c9d16636 5f1d1a60b761dddbeab587cfb2ff0a32bd223fb62f9c433a374d3c02a5512bca 4fc173b8fa3df97641660b4893c332892db3f5b86ab33468074a4c4f740cc6e5 a97ef3f2b08583422c8d4b5ae249906c3d3ed8da78d03bbc02673779a1e2cfce e31cad4a6f8e2fa9724e81d5e22c020486964bbdf2dccce0db48fe7bbe3a4462 8c48cefd325524b87c5078b9a7b44cf047315c54bf33f919075770fa0cefca0e 94e466f90cbd0726758f44c656626630a2123fbc9d429a989d74fa567fd4e0fe 74fd4a6679efd733f68578c38f90f19cfd5de138d593ab0070a6c9ae7508eaff
Disclaimer
This page contains threat intelligence information for the IPv4 address 221.231.81.240 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.