223.113.121.94 Threat Intelligence and Host Information

Jun 16, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 223.113.121.94 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

Mitre ATT&CK IDs: T1046 - Network Service Scanning, T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110.004 - Credential Stuffing, T1110 - Brute Force, T1498 - Network Denial of Service, T1595 - Active Scanning
Tags: abuseipdb, atif feed, attack, auto-generated security, banlist feed, binary defense, brute force, brute-force, bruteforce, Bruteforce, Brute-Force, cowrie, cyber security, DDoS, ioc, login, malicious, Nextray, phishing, portscan, RTBH, scan, scanner, sftp, sip, sipvicious, ssh, SSH, tcp, Telnet
JARM: 2ad2ad0002ad2ad22c2ad2ad2ad2adc2ddcfd203d071c45b4b0ffe3d7b4b89
View other sources: Spamhaus VirusTotal

Country: China
Network:
Noticed: 50 times
Protocols Attacked: ssh
Countries Attacked: Australia, Canada, Czechia, Denmark, Estonia, France, Germany, Korea Republic of, Latvia, Lithuania, Norway, Poland, Romania, Sweden, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: oa.gidg.com.cn rd.wx.hcl.ink xcx.gidg.com.cn rsb.gidg.com.cn

Malware Detected on Host

Count:

Open Ports Detected

161 18010 18020 18030 22022 7547 80 8024

CVEs Detected

CVE-2016-10735 CVE-2018-14040 CVE-2018-14042 CVE-2018-20676 CVE-2018-20677 CVE-2019-8331 CVE-2021-3618 CVE-2023-44487 CVE-2024-6484

Map

Whois Information

inetnum: 223.64.0.0 - 223.117.255.255
netname: CMNET
descr: China Mobile Communications Corporation
descr: Mobile Communications Network Operator in China
descr: Internet Service Provider in China
country: CN
org: ORG-CM1-AP
admin-c: HL1318-AP
tech-c: HL1318-AP
abuse-c: AC2006-AP
status: ALLOCATED PORTABLE
mnt-by: APNIC-HM
mnt-lower: MAINT-CN-CMCC
mnt-routes: MAINT-CN-CMCC
mnt-irt: IRT-CHINAMOBILE-CN
last-modified: 2020-10-20T00:58:37Z
irt: IRT-CHINAMOBILE-CN
address: China Mobile Communications Corporation
address: 29, Jinrong Ave., Xicheng District, Beijing, 100032
e-mail: abuse@chinamobile.com
abuse-mailbox: abuse@chinamobile.com
admin-c: CT74-AP
tech-c: CT74-AP
mnt-by: MAINT-CN-CMCC
last-modified: 2025-03-07T06:38:53Z
organisation: ORG-CM1-AP
org-name: China Mobile
org-type: LIR
country: CN
address: 29, Jinrong Ave.
phone: +86-10-5268-6688
fax-no: +86-10-5261-6187
e-mail: hostmaster@chinamobile.com
mnt-ref: APNIC-HM
mnt-by: APNIC-HM
last-modified: 2023-09-05T02:14:48Z
role: ABUSE CHINAMOBILECN
country: ZZ
address: China Mobile Communications Corporation
address: 29, Jinrong Ave., Xicheng District, Beijing, 100032
phone: +000000000
e-mail: abuse@chinamobile.com
admin-c: CT74-AP
tech-c: CT74-AP
nic-hdl: AC2006-AP
abuse-mailbox: abuse@chinamobile.com
mnt-by: APNIC-ABUSE
last-modified: 2025-03-07T06:39:27Z
person: haijun li
nic-hdl: HL1318-AP
e-mail: hostmaster@chinamobile.com
address: 29,Jinrong Ave, Xicheng district,beijing,100032
phone: +86 1052686688
fax-no: +86 10 52616187
country: CN
mnt-by: MAINT-CN-CMCC
abuse-mailbox: abuse@chinamobile.com
last-modified: 2016-11-29T09:38:38Z
route: 223.112.0.0/14
descr: China Mobile communications corporation
origin: AS9808
mnt-by: MAINT-CN-CMCC
last-modified: 2012-02-15T08:53:41Z

Links to attack logs

Share on: