23.94.213.172 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 23.94.213.172 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 33/100

Host and Network Information

• Tags: 2026-02, Automated, cisco, cowrie, malicious, OpenCTI, sentrypeer, sftp, sip, ssh

• View other sources: Spamhaus VirusTotal

• Country: United States
• Network:
• Noticed: 4 times
• Protocols Attacked: ssh
• Passive DNS Results: rpc.qingmuhy.com tz.qingmuhy.com zyhelper.com

Open Ports Detected

10080 10084 1012 10302 1050 10554 11000 11112 1200 12000 12156 12428 12497 12553 14006 14344 1455 1500 16037 16094 16992 16993 17779 1800 18037 18048 19080 1911 1925 1969 2002 20256 2121 21256 21274 21305 21309 2181 22 22000 22345 2480 2628 30002 30004 30443 3047 31444 35531 37215 4000 4063 4242 4433 4434 4440 4443 45003 46000 49080 4949 5000 50070 52311 5232 53485 5456 55000 5555 5804 5992 6664 6667 7071 7171 7480 7657 7777 7782 8037 8060 8098 8131 8188 8291 8530 8566 8704 8849 8880 9039 9095 9139 9171 9184 9195 9441 9443 9704 9876 9981

Map

Whois Information

• NetRange: 23.94.0.0 - 23.95.255.255
• CIDR: 23.94.0.0/15
• NetName: CC-16
• NetHandle: NET-23-94-0-0-1
• Parent: NET23 (NET-23-0-0-0-0)
• NetType: Direct Allocation
• OriginAS:
• Organization: HostPapa (HOSTP-7)
• RegDate: 2013-08-16
• Updated: 2024-02-02
• Comment: Geofeed https://geofeeds.oniaas.io/geofeeds.csv
• Ref: https://rdap.arin.net/registry/ip/23.94.0.0
• OrgName: HostPapa
• OrgId: HOSTP-7
• Address: 325 Delaware Avenue
• Address: Suite 300
• City: Buffalo
• StateProv: NY
• PostalCode: 14202
• Country: US
• RegDate: 2016-06-06
• Updated: 2025-10-05
• Ref: https://rdap.arin.net/registry/entity/HOSTP-7
• OrgAbuseHandle: NETAB23-ARIN
• OrgAbuseName: NETABUSE
• OrgAbusePhone: +1-905-315-3455
• OrgAbuseEmail: net-abuse-global@hostpapa.com
• OrgAbuseRef: https://rdap.arin.net/registry/entity/NETAB23-ARIN
• OrgTechHandle: NETTE9-ARIN
• OrgTechName: NETTECH
• OrgTechPhone: +1-905-315-3455
• OrgTechEmail: net-tech-global@hostpapa.com
• OrgTechRef: https://rdap.arin.net/registry/entity/NETTE9-ARIN
• RAbuseHandle: NETAB27-ARIN
• RAbuseName: NETABUSE-COLOCROSSING
• RAbusePhone: +1-800-518-9716
• RAbuseEmail: abuse@colocrossing.com
• RAbuseRef: https://rdap.arin.net/registry/entity/NETAB27-ARIN
• RTechHandle: NETTE11-ARIN
• RTechName: NETTECH-COLOCROSSING
• RTechPhone: +1-800-518-9716
• RTechEmail: support@colocrossing.com
• RTechRef: https://rdap.arin.net/registry/entity/NETTE11-ARIN

Links to attack logs

digitaloceanlondon-ssh-bruteforce-ip-list-2026-02-12