61.177.172.168 Threat Intelligence and Host Information

May 26, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 61.177.172.168 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 45/100

Host and Network Information

Mitre ATT&CK IDs: T1498 - Network Denial of Service, T1595 - Active Scanning
Tags: DDoS, portscan, RTBH, scan, sip, sipvicious, ssh, SSH
View other sources: Spamhaus VirusTotal

Country: China
Network:
Noticed: 15 times
Protocols Attacked: ssh
Countries Attacked: Australia, Poland, Sweden
Passive DNS Results: 7u6.xyz 6a66.vip 62k4.com 218n.cc 2k.mom i2n.cc 04316.cc gtm-sg-6l13ukk0m05.qu200.com s4f.cc 780z.com y387.lol k5x.xyz xn–ess553j.com 6k2.xyz 1234.lat 98s.us ccav.us uu8.xyz 28vk.top w5k.cc b84.us 9c7b.xyz www.fu2012.com fu2012.com

Malware Detected on Host

Count: 142 2c6366c9da05aa0de0a4ed3f4fd0baa91245de40474ce6a98fd233ebc1687bfc 30e65d9018d2d3990218a75c059dc0f2dcf4233deeb7c4641472e64ff3d2ff8c 84d812d14e61e579ab512d2b0431aeb4360a6d5109e00175ebc298ef8a671567 1dc125e91b2801222d692e194309b7e33392e49a344501172a3ffa5a05bf762d 348b4d087ef4d8f8ca547ab68f554fb6eada6b99f33ae6b75d9ed60ffee6cc7e aab680d516666cce60dd706f08dd614b9af02bf86e8c027dc70cbb9919e88308 32a3f553807f46c56f96a55ba94eac2436221a0d56c7a714f3183f49f028b284 23c990e6866cbaf7cd38b6518a1deaa27487b32b512654985e8be70356eed7d4 28396391c3f532d3378a23d8d22a0cd90ba0d50f4ebda70fd8e7c3e21fbf6165 ad4fa9a68d9a73f3a45a782c01621059265249198995c07dc6f86366a9e76b0f

Map

Whois Information

inetnum: 61.177.0.0 - 61.177.255.255
netname: CHINANET-JS
descr: CHINANET jiangsu province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN
admin-c: CH93-AP
tech-c: CJ186-AP
mnt-by: MAINT-CHINANET
mnt-lower: MAINT-CHINANET-JS
mnt-routes: maint-chinanet-js
status: ALLOCATED non-PORTABLE
last-modified: 2008-09-04T06:51:29Z
role: CHINANET JIANGSU
address: 260 Zhongyang Road,Nanjing 210037
country: CN
phone: +86-25-87799222
e-mail: jsipmanager@163.com
admin-c: CH360-AP
tech-c: CS306-AP
tech-c: CN142-AP
nic-hdl: CJ186-AP
notify: jsipmanager@163.com
mnt-by: MAINT-CHINANET-JS
last-modified: 2022-08-05T15:34:47Z
person: Chinanet Hostmaster
nic-hdl: CH93-AP
e-mail: anti-spam@chinatelecom.cn
address: No.31 ,jingrong street,beijing
address: 100032
phone: +86-10-58501724
fax-no: +86-10-58501724
country: CN
mnt-by: MAINT-CHINANET
last-modified: 2022-02-28T06:53:44Z

Links to attack logs

Share on: