74.208.184.120 Threat Intelligence and Host Information

Jun 19, 2024 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 74.208.184.120 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

Mitre ATT&CK IDs: T1046 - Network Service Scanning, T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110.004 - Credential Stuffing, T1110 - Brute Force, T1595 - Active Scanning
Tags: abuseipdb, bruteforce, Bruteforce, Brute-Force, cowrie, port 22, scan, sip, sipvicious, ssh, SSH, tcp/22
View other sources: Spamhaus VirusTotal

Country: United States
Network: AS8560 1&1 ionos se
Noticed: 8 times
Protocols Attacked: ssh
Countries Attacked: Australia, United States of America
Passive DNS Results: www.gss.sahlerp.net www.yascp.sahlerp.net www.asb.sahlerp.net www.sts.sahlerp.net msa.sahlerp.net kcc.sahlerp.net maf.sahlerp.net asb.sahlerp.net aaa.sahlerp.net gss.sahlerp.net sts.sahlerp.net ip74-208-184-120.pbiaas.com demo.sahlerp.net emc.sahlerp.net eradah.sahlerp.net jotun.sahlerp.net bcscec.sahlerp.net saad.sahlerp.net cpce.sahlerp.net topten.sahlerp.net csce.sahlerp.net afic.sahlerp.net alessa.sahlerp.net salj.sahlerp.net supply.sahlerp.net demo2.sahlerp.net ft.sahlerp.net offroamazon47.isasecret.com

Open Ports Detected

443 80

Map

Whois Information

NetRange: 74.208.0.0 - 74.208.255.255
CIDR: 74.208.0.0/16
NetName: 1AN1-NETWORK
NetHandle: NET-74-208-0-0-1
Parent: NET74 (NET-74-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS8560
Organization: IONOS Inc. (11INT)
RegDate: 2006-11-22
Updated: 2017-08-09
Comment: For abuse issues, please use only abuse@1and1.com
Comment: For technical or network problems, please use noc@oneandone.net
Ref: https://rdap.arin.net/registry/ip/74.208.0.0
OrgName: IONOS Inc.
OrgId: 11INT
Address: 2 Logan Square
Address: 100 North 18th St
Address: Suite 400
City: Philadelphia
StateProv: PA
PostalCode: 19103
Country: US
RegDate: 2006-09-05
Updated: 2024-06-11
Comment: http://www.ionos.com
Comment: For abuse issues, please use only abuse@ionos.com
Ref: https://rdap.arin.net/registry/entity/11INT
OrgAbuseHandle: IADAR5-ARIN
OrgAbuseName: IAD-ARIN
OrgAbusePhone: +1-877-206-4253
OrgAbuseEmail: abuse@ionos.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/IADAR5-ARIN
OrgNOCHandle: 1NOC-ARIN
OrgNOCName: 1and1 Network Operations Center
OrgNOCPhone: +1-484-254-5555
OrgNOCEmail: noc@net.ionos.com
OrgNOCRef: https://rdap.arin.net/registry/entity/1NOC-ARIN
OrgTechHandle: 1NO-ARIN
OrgTechName: 1and1 ARIN Role
OrgTechPhone: +1-913-433-7549
OrgTechEmail: arin-role@net.ionos.com
OrgTechRef: https://rdap.arin.net/registry/entity/1NO-ARIN
RAbuseHandle: 1AD-ARIN
RAbuseName: 1and1 Abuse Department
RAbusePhone: +1-877-206-4253
RAbuseEmail: abuse@1and1.com
RAbuseRef: https://rdap.arin.net/registry/entity/1AD-ARIN
RNOCHandle: 1NOC-ARIN
RNOCName: 1and1 Network Operations Center
RNOCPhone: +1-484-254-5555
RNOCEmail: noc@net.ionos.com
RNOCRef: https://rdap.arin.net/registry/entity/1NOC-ARIN
RTechHandle: 1NO-ARIN
RTechName: 1and1 ARIN Role
RTechPhone: +1-913-433-7549
RTechEmail: arin-role@net.ionos.com
RTechRef: https://rdap.arin.net/registry/entity/1NO-ARIN

Links to attack logs

bruteforce-ip-list-2024-06-30 vultrwarsaw-ssh-bruteforce-ip-list-2024-06-25 vultrwarsaw-ssh-bruteforce-ip-list-2024-06-09

Share on: