54.38.220.85 Threat Intelligence and Host Information

Jun 19, 2024 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 54.38.220.85 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 71/100

Host and Network Information

  • Mitre ATT&CK IDs: T1005 - Data from Local System, T1010 - Application Window Discovery, T1027 - Obfuscated Files or Information, T1055 - Process Injection, T1056.001 - Keylogging, T1057 - Process Discovery, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1105 - Ingress Tool Transfer, T1106 - Native API, T1114 - Email Collection, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1204 - User Execution, T1218 - Signed Binary Proxy Execution, T1518 - Software Discovery, T1546 - Event Triggered Execution, T1566 - Phishing, T1583.005 - Botnet, T1600 - Weaken Encryption

  • Tags: agent tesla, all octoseek, analyzer, appdata, apple, asprox, az09, banking, bot, bot network, breadcrumbs, briannsabey breadcrumbs, ck id, cobalt strike, command_and_control, compromise iocs, comspec, contacted, copy, core, cracked, create new, critical, cybercrime, dangerous, darkcomet, desktop, does not, domain, domains, email, email security, emotet, emotet malware, emotet trojan, emotet virus, endpoint na, endpoint secure, eternalblue, expiration, exploit, factory, fake net, filehashmd5, filehashsha1, filehashsha256, files, first, flawedammyy, gpt analyzer, hackers, hacktool, hallrender, hashes, hijacker, hklm, hostname, http get, installer, iocs, ipv4, json, lazarus, localappdata, malware, microsoft, mitre att, model, monitoring, ms17010, na stealthwatch, networm, next, no expiration, occurrences, occurrences ip, octoseek, open path, parking payload, pattern match, payload, pcap, pdf report, powershell, powershell code, programdata, pulse use, qbot, quasar rat, random, ransomware, referrer, registry keys, renos, resolutions, scan endpoints, systemroot, T1622 - Debugger Evasion, teams, tinba, tofsee, tracking, tsara brashears, upatre, url http, url https, usbank, value name, vba code, wannacry, wcry, webp, win64

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_emd, hphosts_psh

Malware Detected on Host

Count: 291 c3f581e74c9ea66cbddc97292cde4d9d7730e191633759eac6406dbc2fd5701c f5881674c47ad40d89154e329ceccec969e94014b057246d662af3ada3280dc8 8b00b439e5a574da01637bfcb1f4d954b901e8291a36a6f96c840793262f96ca 8be7b2b32a7480eff95031b5e75e9a16b6ad95e2e9d1bb06d35cad339129a010 061be5669e16a9d29beb697c901f254d2992ab50b2381eaced74febdfefbb1f4 757f9defef22bbfc88e85a8b3d8d7b7e2b73eec598c756dd8d99803c9f3914fe c70e7dc6ddddca133a8e0b8d433bfdd0b9c7699e641eac470c60d7398a89efbb 4bbda0be467e700ab418628ef45c587769236537aa0d13d84d3a31e19fa04e4b c663442ba07c72d93cbf098eadfe1475b7bc470e361c1736ab2b457a57f2cf94 9982ba1226a5664917b7f44dbdc25edb0fb2386b659fd7ab0655f66f5dd31db8

Open Ports Detected

53 80

CVEs Detected

CVE-2021-23017 CVE-2021-3618 CVE-2023-44487

Map

Whois Information

  • NetRange: 54.36.0.0 - 54.38.255.255
  • CIDR: 54.36.0.0/15, 54.38.0.0/16
  • NetName: RIPE
  • NetHandle: NET-54-36-0-0-1
  • Parent: NET54 (NET-54-0-0-0-0)
  • NetType: Early Registrations, Transferred to RIPE NCC
  • OriginAS:
  • Organization: RIPE Network Coordination Centre (RIPE)
  • RegDate: 2017-06-19
  • Updated: 2017-10-16
  • Ref: https://rdap.arin.net/registry/ip/54.36.0.0
  • OrgName: RIPE Network Coordination Centre
  • OrgId: RIPE
  • Address: P.O. Box 10096
  • City: Amsterdam
  • StateProv:
  • PostalCode: 1001EB
  • Country: NL
  • RegDate:
  • Updated: 2013-07-29
  • Ref: https://rdap.arin.net/registry/entity/RIPE
  • OrgTechHandle: RNO29-ARIN
  • OrgTechName: RIPE NCC Operations
  • OrgTechPhone: +31 20 535 4444
  • OrgTechEmail: hostmaster@ripe.net
  • OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN
  • OrgAbuseHandle: ABUSE3850-ARIN
  • OrgAbuseName: Abuse Contact
  • OrgAbusePhone: +31205354444
  • OrgAbuseEmail: abuse@ripe.net
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN
  • inetnum: 54.38.220.64 - 54.38.220.127
  • netname: OVH-DEDICATED-FO
  • country: DE
  • descr: Failover IPs
  • org: ORG-OG9-RIPE
  • admin-c: OTC13-RIPE
  • tech-c: OTC13-RIPE
  • status: LEGACY
  • mnt-by: OVH-MNT
  • created: 2018-03-08T08:10:04Z
  • last-modified: 2018-03-08T08:10:04Z
  • organisation: ORG-OG9-RIPE
  • org-name: OVH GmbH
  • org-type: OTHER
  • address: St. Johanner Str. 41-43
  • address: 66111 Saarbrucken
  • address: Deutschland
  • abuse-c: ACRO39426-RIPE
  • admin-c: OTC13-RIPE
  • mnt-ref: OVH-MNT
  • mnt-by: OVH-MNT
  • created: 2005-09-02T12:40:05Z
  • last-modified: 2021-02-26T13:10:09Z
  • role: OVH DE Technical Contact
  • address: OVH GmbH
  • address: St. Johanner Str. 41-43
  • address: 66111 Saarbrucken
  • address: Deutschland
  • admin-c: OK217-RIPE
  • tech-c: GM84-RIPE
  • nic-hdl: OTC13-RIPE
  • abuse-mailbox: abuse@ovh.net
  • mnt-by: OVH-MNT
  • created: 2009-09-16T16:09:57Z
  • last-modified: 2021-02-26T13:07:37Z
  • route: 54.38.0.0/16
  • origin: AS16276
  • mnt-by: OVH-MNT
  • created: 2017-10-06T07:58:11Z
  • last-modified: 2017-10-06T07:58:11Z

Links to attack logs

****** ****** ******

Share on: