31.214.178.55 Threat Intelligence and Host Information

ipinfopage

General

This page contains threat intelligence information for the IPv4 address 31.214.178.55 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

🟠 Elevated — 53/100

Geographic Location

Host and Network Information

View other sources: Spamhaus VirusTotal Shodan AbuseIPDB
Country: Spain
Noticed: 4 times
Protocols Attacked: SSH
Countries Attacked: Austria, Canada, Denmark, Finland, France, Germany, Ireland, Lithuania, Netherlands, New Zealand, Romania, Russian Federation, Spain, Sweden, United Kingdom of Great Britain and Northern Ireland, United States of America
Open Ports: 80
Tor Node: No
Associated Malware Samples: 1

MITRE ATT&CK TTPs

T1003.001 - LSASS Memory
T1003.004 - LSA Secrets
T1003 - OS Credential Dumping
T1004 - Winlogon Helper DLL
T1018 - Remote System Discovery
T1021.001 - Remote Desktop Protocol
T1021.006 - Windows Remote Management
T1027 - Obfuscated Files or Information
T1037.003 - Network Logon Script
T1040 - Network Sniffing
T1045 - Software Packing
T1057 - Process Discovery
T1059.006 - Python
T1059.007 - JavaScript
T1059 - Command and Scripting Interpreter
T1060 - Registry Run Keys / Startup Folder
T1062 - Hypervisor
T1068 - Exploitation for Privilege Escalation
T1071.004 - DNS
T1071 - Application Layer Protocol
T1076 - Remote Desktop Protocol
T1084 - Windows Management Instrumentation Event Subscription
T1105 - Ingress Tool Transfer
T1112 - Modify Registry
T1129 - Shared Modules
T1130 - Install Root Certificate
T1143 - Hidden Window
T1156 - Malicious Shell Modification
T1185 - Man in the Browser
T1192 - Spearphishing Link
T1193 - Spearphishing Attachment
T1210 - Exploitation of Remote Services
T1211 - Exploitation for Defense Evasion
T1212 - Exploitation for Credential Access
T1404 - Exploit OS Vulnerability
T1454 - Malicious SMS Message
T1476 - Deliver Malicious App via Other Means
T1553.003 - SIP and Trust Provider Hijacking
T1557 - Man-in-the-Middle
T1566 - Phishing
T1568.002 - Domain Generation Algorithms
T1568 - Dynamic Resolution
T1587.003 - Digital Certificates
T1596.001 - DNS/Passive DNS
T1596.004 - CDNs
T1602.001 - SNMP (MIB Dump)
T1602.002 - Network Device Configuration Dump

Passive DNS

whiterockcorporate.com