5.42.65.67 Threat Intelligence and Host Information

Aug 26, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 5.42.65.67 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

Mitre ATT&CK IDs: T1053 - Scheduled Task/Job, T1070 - Indicator Removal on Host, T1090 - Proxy, T1140 - Deobfuscate/Decode Files or Information, T1547 - Boot or Logon Autostart Execution, T1564 - Hide Artifacts
Tags: active, avaddon, C2, cobaltstrike, conti, coroxy, cuba, droxidat, execution, icedid, maze, persistence, proxy malware, ryuk, Socks5ProxyBotnet, systembc, SystemBC, t1053, ta0003, threat, virustotal
View other sources: Spamhaus VirusTotal

Country: Russia
Network:
Noticed: 10 times
Protocols Attacked: Anonymous Proxy
Passive DNS Results: link-bot-torn.site

Malware Detected on Host

Count: 17 e8c1d2315e397e5c3b323e0243334c35babe5a4d72497daea2a97e7b998fa364 a022c2212d4dfe8e4ba1321df2674754e7ef6a2f2f9dcbfb0db30e6a499168d5 bffdd0e12f4513ac208a821f88d6da24bcea5ec6936624085fbca39027716d26 f72a77a6abed80ee7f1a5dd5d5b22ea8d377b89a681a75682c47992905e7f949 3bc9a13ed11a0da691a2b97ddd52168dbead463fd5371916a1d574184c422a3c b2b82c1977c17aec7ba0074f56c0d61100e616a0ce72dab748ec4269db6c0793 7ed9f4f6c6f6919e85b0f7b46ab95b356ca7702a1a3d415124753b4c77b12541 11f88c287b501abb341631221d59ef63089baa83faecbf222c3ba618e5f49456 d0861b2aed04474e7e0f524c0cf6f8495494fc509b0fb8dc94d89dd1dcbacc5e e1ea0c959e41ed64704af80b5887dc03c4c9cbe0916b62a4f3a8117ae0fd47de

Map

Whois Information

inetnum: 5.42.64.0 - 5.42.95.255
netname: RU-KSTV-20120516
country: RU
org: ORG-JKT4-RIPE
admin-c: DD2295-RIPE
tech-c: DD2295-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-by: KSTV-MNT
created: 2025-08-18T12:18:50Z
last-modified: 2025-08-18T12:18:50Z
organisation: ORG-JKT4-RIPE
org-name: CJSC Kolomna-Sviaz TV
country: RU
org-type: LIR
address: Gagarina str 70
address: 140407
address: Kolomna
address: RUSSIAN FEDERATION
phone: +74966165345
fax-no: +74966165000
admin-c: DD2295-RIPE
admin-c: DD2295-RIPE
abuse-c: KTN14-RIPE
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: KSTV-MNT
mnt-by: RIPE-NCC-HM-MNT
mnt-by: KSTV-MNT
created: 2007-08-10T12:13:34Z
last-modified: 2023-04-17T08:58:27Z
person: Dmitry Korovin
address: Moscow region
address: Kolomna 70 Gagarina
address: JSC KolomnaSvazTV
phone: +7 800 6005345
phone: +7 496 6165345
mnt-by: KSTV-MNT
nic-hdl: DD2295-RIPE
created: 2006-03-16T08:52:28Z
last-modified: 2021-06-07T11:15:34Z
route: 5.42.65.0/24
origin: AS39493
mnt-by: KSTV-MNT
created: 2025-01-20T09:15:31Z
last-modified: 2025-01-20T09:15:31Z

Links to attack logs

Share on: