23.129.64.149 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 23.129.64.149 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

• Tags: Bruteforce, Brute-Force, cyber security, ioc, malicious, Nextray, phishing, SSH, tor

• Known tor exit node

• View other sources: Spamhaus VirusTotal

• Contained within other IP sets: blocklist_de, blocklist_de_ssh, blocklist_net_ua, dm_tor, et_tor, haley_ssh, nixspam, sblam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, stopforumspam, tor_exits

• Known TOR node
• Country: United States
• Network: AS396507 emerald onion
• Noticed: 1 times
• Protcols Attacked: redis ssh
• Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America

Malware Detected on Host

Count: 29 b11e614cdd02aecb8d6ae65bf67bfac8cbefd68830065217e2cb48922743bb12 5a55cf9c74493e1a65a6402d0286a95fedd4007bb5354aab615d10a5eadbadef de4b25ebce3b052dcf15fe2d40af6e5faa696557397e10b20639b203161e8a15 c1392283ae24b836d9afc2f5dba43dbb5782e8b7c4074de7da7f7dcd8858f905 6c862c0c005e4b847c6ca4b8cdb464af557b2a6e38886cfd182b279857b79946 300097582262a8423d5c1f991c126542636816c3d41595954518de0eecbb158f 0da8af11f866aba6756024bbc81e5423a51fc60554d995555ed7676b442dc6cf 4f863408f9c715fb9d9ee667841b56f35cd98887cb713d38ff725ac452585397 3fd58e0f24d5044045324a49f667f34b78a6d88197ae74316d6ab7d67aec9885 f046b65739764aa74d38bfaf666094d45ad087b3bc6430c5a19c599b1735a54e

Open Ports Detected

22 443 80

Map

Whois Information

• NetRange: 23.129.64.0 - 23.129.64.255
• CIDR: 23.129.64.0/24
• NetName: EMERALD-ONION-TOR1
• NetHandle: NET-23-129-64-0-1
• Parent: NET23 (NET-23-0-0-0-0)
• NetType: Direct Allocation
• OriginAS: AS396507
• Organization: Emerald Onion (EO-95)
• RegDate: 2017-07-19
• Updated: 2021-02-27
• Comment: https://emeraldonion.org/
• Ref: https://rdap.arin.net/registry/ip/23.129.64.0
• OrgName: Emerald Onion
• OrgId: EO-95
• City: Seattle
• StateProv: WA
• PostalCode: 98104-1404
• Country: US
• RegDate: 2017-06-20
• Updated: 2018-11-15
• Ref: https://rdap.arin.net/registry/entity/EO-95
• OrgNOCHandle: NETWO8737-ARIN
• OrgNOCName: Network Operations
• OrgNOCPhone: +1-206-739-3390
• OrgNOCEmail: [email protected]
• OrgNOCRef: https://rdap.arin.net/registry/entity/NETWO8737-ARIN
• OrgAbuseHandle: ABUSE7315-ARIN
• OrgAbuseName: Abuse Management
• OrgAbusePhone: +1-206-739-3390
• OrgAbuseEmail: [email protected]
• OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE7315-ARIN
• OrgTechHandle: TECHN1592-ARIN
• OrgTechName: Technical Support
• OrgTechPhone: +1-206-739-3390
• OrgTechEmail: [email protected]
• OrgTechRef: https://rdap.arin.net/registry/entity/TECHN1592-ARIN

Links to attack logs

bruteforce-ip-list-2023-01-24 dolondon-ssh-bruteforce-ip-list-2023-02-21 vultrwarsaw-ssh-bruteforce-ip-list-2023-02-02 awssafrica-redis-bruteforce-ip-list-2022-04-01 dotoronto-ssh-bruteforce-ip-list-2023-03-20 nmap-scanning-list-2021-09-28