34.72.42.51 Threat Intelligence and Host Information
General
This page contains threat intelligence information for the IPv4 address 34.72.42.51 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.
Likely Malicious Host 🟠 63/100
Host and Network Information
-
Mitre ATT&CK IDs: T1046 - Network Service Scanning, T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1090 - Proxy, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110.004 - Credential Stuffing, T1110 - Brute Force, T1566 - Phishing
-
Tags: abuseipdb, babuk, bianlian, blackcat, bruteforce, cowrie, cyber security, dark, dark web, december, egregor, hunter, ioc, italian mario, july, june, lockbit, malicious, mario, mega, megacortex, Nextray, noescape, paulsan, phishing, ransomhouse, resecurity, samsam, ssh, SSH, white rabbit
-
JARM: 29d29d00000000022c29d29d29d29d1f4989c319e75da83988253a39553038
-
View other sources: Spamhaus VirusTotal
- Country: United States
- Network: AS396982 google
- Noticed: 50 times
- Protocols Attacked: ssh
- Countries Attacked: Canada, China, Czechia, Denmark, Estonia, France, Germany, India, Italy, Korea Republic of, Latvia, Lithuania, Norway, Poland, Romania, Singapore, Taiwan, Thailand, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
- Passive DNS Results: creatorhubtest.takwene.com goauditrealtime.takwene.com trendifymusic.net whatsapp.takwene.com testlark.zeeranks.com yt.zeeranks.com goapilive.takwene.com testlarkapi.zeeranks.com martxpresstest.martxpress.com go.takwene.com goapi.takwene.com almedra.com www.nationalmeat.net notificationsapi.takwene.com www.radiotalaat2000.com erp.takwene.com social.takwene.com pex.zeeranks.com mermaida.takwene.com mermaidaapi.takwene.com radiotalaat2000.com actseg.com www.actseg.com pexadmin.zeeranks.com otp.takwene.com bookvalue.me www.bookvalue.me www.homeegypt.net homeegypt.net gamevalley.com www.gamevalley.com adminartworks.zeeranks.com admin.martxpress.com devapi.martxpress.com www.dev.martxpress.com dev.martxpress.com martxpress.com www.martxpress.com www.takwene.com takwene.com productapi.takwene.com product.takwene.com youtube.zeeranks.com artworks.zeeranks.com social.zeeranks.com api.zeeranks.com api2.zeeranks.com martexpress.net test.martexpress.net
Open Ports Detected
CVEs Detected
CVE-2015-9251 CVE-2019-11358 CVE-2020-11022 CVE-2020-11023
Whois Information
- NetRange: 34.64.0.0 - 34.127.255.255
- CIDR: 34.64.0.0/10
- NetName: GOOGL-2
- NetHandle: NET-34-64-0-0-1
- Parent: NET34 (NET-34-0-0-0-0)
- NetType: Direct Allocation
- OriginAS:
- Organization: Google LLC (GOOGL-2)
- RegDate: 2018-09-28
- Updated: 2018-09-28
- Ref: https://rdap.arin.net/registry/ip/34.64.0.0
- OrgName: Google LLC
- OrgId: GOOGL-2
- Address: 1600 Amphitheatre Parkway
- City: Mountain View
- StateProv: CA
- PostalCode: 94043
- Country: US
- RegDate: 2006-09-29
- Updated: 2019-11-01
- Comment: *** The IP addresses under this Org-ID are in use by Google Cloud customers ***
- Comment:
- Comment: Direct all copyright and legal complaints to
- Comment: https://support.google.com/legal/go/report
- Comment:
- Comment: Direct all spam and abuse complaints to
- Comment: https://support.google.com/code/go/gce_abuse_report
- Comment:
- Comment: For fastest response, use the relevant forms above.
- Comment:
- Comment: Complaints can also be sent to the GC Abuse desk
- Comment: (google-cloud-compliance@google.com)
- Comment: but may have longer turnaround times.
- Comment:
- Comment: Complaints sent to any other POC will be ignored.
- Ref: https://rdap.arin.net/registry/entity/GOOGL-2
- OrgNOCHandle: GCABU-ARIN
- OrgNOCName: GC Abuse
- OrgNOCPhone: +1-650-253-0000
- OrgNOCEmail: google-cloud-compliance@google.com
- OrgNOCRef: https://rdap.arin.net/registry/entity/GCABU-ARIN
- OrgAbuseHandle: GCABU-ARIN
- OrgAbuseName: GC Abuse
- OrgAbusePhone: +1-650-253-0000
- OrgAbuseEmail: google-cloud-compliance@google.com
- OrgAbuseRef: https://rdap.arin.net/registry/entity/GCABU-ARIN
- OrgTechHandle: ZG39-ARIN
- OrgTechName: Google LLC
- OrgTechPhone: +1-650-253-0000
- OrgTechEmail: arin-contact@google.com
- OrgTechRef: https://rdap.arin.net/registry/entity/ZG39-ARIN
Links to attack logs
vultrmadrid-ssh-bruteforce-ip-list-2024-05-27 bruteforce-ip-list-2024-05-22 bruteforce-ip-list-2024-05-21 bruteforce-ip-list-2024-05-23 vultrwarsaw-ssh-bruteforce-ip-list-2024-06-01 bruteforce-ip-list-2024-05-16 bruteforce-ip-list-2024-05-27 vultrwarsaw-ssh-bruteforce-ip-list-2024-05-31 bruteforce-ip-list-2024-05-24
Share on: