221.231.81.248 Threat Intelligence and Host Information

Jun 14, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 221.231.81.248 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 54/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1037.003 - Network Logon Script, T1041 - Exfiltration Over C2 Channel, T1057 - Process Discovery, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1119 - Automated Collection, T1129 - Shared Modules, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1463 - Manipulate Device Communication, T1568 - Dynamic Resolution, T1583.005 - Botnet

  • Tags: aaaa, accept, accept encoding, active related, advanced email, advertising botnet, adware, a li, alienvault, all octoseek, amazon ses, apple, april, artro, as14061, as15169 google, as16276, as20940, as4808 china, as4812 china, as4837 china, as56047 china, as58461, as58542 tianjij, as9009 m247, as9808 china, ascii text, authority, autoit, b body, body, body length, botnet, bundled, china unknown, ciphersuite, cnc, communicating, compiler, connection, contacted, contacted urls, control panel, cookie, copy, creation date, date, date fri, default, delete, delete c, delphi, dns replication, domain, dropper, dynamicloader, entries, exe32, execution, exif standard, explorer, february, files, file type, final url, find, font format, gecko, gmt path, hichina, high, historical ssl, http, http response, indicator role, intel, ip address, ipv4, item, javascript, javascript code, jpeg image, json, kb file, khtml, lenovo type, local, malware, markus, mbs, medium, meta, mining, moved, ms windows, name servers, network, next, ns nxdomain, nxdomain, open threat, packer, parent domain, passive dns, pe32, pe32 compiler, pecompact, pepo campaigns, pe resource, pulse pulses, pulses, pulse submit, record value, referrer, resolutions, scan endpoints, search, servers, service, set cookie, sha256, show, siblings, siblings domain, smartchat, span, spyware, ssl certificate, status, status code, suspicious, switch, tabx explorer, target, text, tiff image, title added, twitter, typosquatting, united, unknown, url analysis, url http, urls, vary, web open, whitelisted, whois domain, whois record, whois whois, win16 ne, win32, win32 exe, win32upatre feb, win64, windows, windows activex, windows nt, write, write c, yara rule, zusy

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 11 ea8d41968cd4065178c53f0950cbe80d1733dd381dcaf41a961a6fe21b0b2510 05350d1780b11da105b91e2d6c46f95ee6462ca008f89733b6a3bf14c8c08918 abff102a04ecd32432bb7f7cc676966cfc356a19420f67483401f83921787edc 0040e0b39bcd3ab53adee5bba02e336ee96839282c93bc41ca057b4dcf6069d0 d26f4052b01952274e4973307d61b5968cfa8c0c4f91c0f7039fd858e56d844e 58c54d6f7d70220287cae2cad452bd1a398a55a1bc0f812d49044336746a8cd6 14ea03cf8e3bbfa81c316d1248eaee5df7bf2409bf550640f288c0134b2f3b33 c06f820b7c881618372fcf508a460a10c8738d897b09b8845affd2829d6dd100 32e9750bc1d261f2c69a3ed0658fd0670dba0c9491c0aaff5de5d388280c45a5 e2e1e760fe0a4d38852d655f595a2078ddfa8d1d1bdccedd2293fb670d7b1187

Map

Whois Information

  • inetnum: 221.224.0.0 - 221.231.255.255
  • netname: CHINANET-JS
  • descr: CHINANET jiangsu province network
  • descr: China Telecom
  • descr: A12,Xin-Jie-Kou-Wai Street
  • descr: Beijing 100088
  • country: CN
  • admin-c: CH93-AP
  • tech-c: CJ186-AP
  • abuse-c: AC1573-AP
  • status: ALLOCATED PORTABLE
  • mnt-by: APNIC-HM
  • mnt-lower: MAINT-CHINANET-JS
  • mnt-routes: MAINT-CHINANET-JS
  • mnt-irt: IRT-CHINANET-CN
  • last-modified: 2021-06-15T08:06:37Z
  • irt: IRT-CHINANET-CN
  • address: No.31 ,jingrong street,beijing
  • address: 100032
  • e-mail: anti-spam@chinatelecom.cn
  • abuse-mailbox: anti-spam@chinatelecom.cn
  • admin-c: CH93-AP
  • tech-c: CH93-AP
  • mnt-by: MAINT-CHINANET
  • last-modified: 2025-04-24T03:21:26Z
  • role: ABUSE CHINANETCN
  • country: ZZ
  • address: No.31 ,jingrong street,beijing
  • address: 100032
  • phone: +000000000
  • e-mail: anti-spam@chinatelecom.cn
  • admin-c: CH93-AP
  • tech-c: CH93-AP
  • nic-hdl: AC1573-AP
  • abuse-mailbox: anti-spam@chinatelecom.cn
  • mnt-by: APNIC-ABUSE
  • last-modified: 2025-04-24T03:21:54Z
  • role: CHINANET JIANGSU
  • address: 260 Zhongyang Road,Nanjing 210037
  • country: CN
  • phone: +86-25-87799222
  • e-mail: jsipmanager@163.com
  • admin-c: CH360-AP
  • tech-c: CS306-AP
  • tech-c: CN142-AP
  • nic-hdl: CJ186-AP
  • notify: jsipmanager@163.com
  • mnt-by: MAINT-CHINANET-JS
  • last-modified: 2022-08-05T15:34:47Z
  • person: Chinanet Hostmaster
  • nic-hdl: CH93-AP
  • e-mail: anti-spam@chinatelecom.cn
  • address: No.31 ,jingrong street,beijing
  • address: 100032
  • phone: +86-10-58501724
  • fax-no: +86-10-58501724
  • country: CN
  • mnt-by: MAINT-CHINANET
  • last-modified: 2022-02-28T06:53:44Z

Links to attack logs

****** ****** ******

Share on: