81.171.28.45 Threat Intelligence and Host Information

Nov 24, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 81.171.28.45 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1059 - Command and Scripting Interpreter, T1071 - Application Layer Protocol, T1100 - Web Shell, T1105 - Ingress Tool Transfer, T1140 - Deobfuscate/Decode Files or Information, T1218 - Signed Binary Proxy Execution, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1497 - Virtualization/Sandbox Evasion, T1560 - Archive Collected Data, TA0011 - Command and Control

  • Tags: 114.114.114.114, aaaa, accept, acint, address, adload, agent, alexa top, algorithm, all search, appdata, apple, april, artemis, as13335, ascii text, asyncrat, attacker, august, authority, ave maria, azorult, bambernek, bambernek gen, bandoo, bank, barracuda et, behav, blacklist, blacklist http, body, body length, bradesco, c2, catalog file, cins active, cisco umbrella, citadel, ck id, class, cleaner, click, cname, cnc, cobalt strike, code, communicating, conduit, connection, connections ip, contacted, contact phone, cookie, copy, core, count blacklist, covid19, cowboy, crack, creation date, critical, cronup threat, cus cngts, CVE-2011-0611, CVE-2014-3153, CVE-2016-0189, CVE-2017-0147, CVE-2017-0199, CVE-2017-11882, CVE-2017-8570, CVE-2018-4893, CVE-2018-8174, CVE-2020-0601, CVE-2023-22518, cyber security, cyber threat, data, date, detection list, dns replication, dnssec, domains, domain status, done adding, downldr, download, emails, emotet, encrypt, engineering, error, et tor, exit, exploit, facebook, falcon sandbox, february, file, files domain, file size, files related, filetour, file type, final url, first, format, full name, fusioncore, general, general full, generator, genkryptik, gmbh version, google, hash, hashes, headers, heur, host, hostname, hotmail, html info, http, httphttps, http response, hybrid, iana id, identifier, iframe, illegal, imphash, info, infy, injector, inmortal, installcore, internet storm, ioc, ip address, ip summary, ipv4, june, kb body, kb script, key algorithm, key identifier, key info, key usage, known tor, kraken, legal, llc validity, local, look, magic iso8859, magic pdf, mail spammer, main, malicious, malicious site, malicious url, maltiverse, malware, malware site, march, matsnu, meta tags, million, miner, mirai, misc attack, mitre att, mon oct, namecheap, namecheap inc, name verdict, nanocore, netsky, Nextray, nircmd, no data, node tcp, node traffic, noname057, none file, number, nymaim, ogoogle trust, opencandy, open ports, otx octoseek, passive dns, patcher, path, pattern match, pdf document, pehash, phishing, phishing site, phishtank, ponmocup, pony, poor reputation, presenoker, pulse pulses, pulses none, pykspa, qakbot, quasar rat, ramnit, ransomware, record type, record value, redline stealer, referrer, refresh, registrar, registrar abuse, registrar url, registrar whois, related tags, relayrouter, remcos, resolver ip, resource, restart, reverse dns, riskware, root ca, runescape, safe site, sample, samples, san francisco, scan endpoints, scanning_host, search, server, service, service privacy, sha1, sha256, showing, show technique, simda, site, softcnapp, software, spammer, span, spyware, ssdeep, ssl certificate, status code, status page, stealer, strings, subject key, subject public, summary, suppobox, swrort, systweak, tag count, tag tag, target, team, team malware, team phishing, temp, text, text text, threat report, threat roundup, tiggre, tinba, title, tofsee, tools, tor known, tor relayrouter, tracking, traffic, trid adobe, trid file, trojanspy, tsara brashears, ttl value, tulach, type name, type textplain, union, unique, united, unknown, unruy, unsafe, url http, urls, url summary, usage, v3 serial, vawtrak, verify, vhash, virut, vph808, wacatac, webtoolbar, whois, whois lookups, whois record, win64, x509v3 key, xrat, xtrat, zbot, zeus

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: coinbl_hosts

Malware Detected on Host

Count: 54 857d2cf04412591b20a92dc23fcd7d4093b3b107fdb473d53cc16f8b1e73cfd6 c7edb9fb2f7aba1a40fe7df74ec005b99bf88144e801dae11f97819c03db7807 05c43d4f4f880f955b10322828aa6281e8d72c3ccc6c46116eb08dffe96b4296 90698496b4cd6a84b2cc7f9840277dcad20ac776d3dde073b757117e0976cf78 2a0a5a2432df750792a0e1609e7e5e4792887f67d191d1dcb693e69798f32263 f35874b3c45f7edb83e558c4d1ca9534f3e6c31fa978e73498ec5898d2ad33ed b9ad29ba83074d0338f86007eeb6850892448fbac16ed3e75167201f920a4c43 ad1df164713392e9e5bf8f34d8c641f687f0fe1b57f33f1e3b52036f9a46f657 7492f2456236b39432f3d6ce4994e172628c713e7f2c3ff5135ef09e8b60027b 9b926811d6e589d7e005a7674b3ede1e71b1b72de474ddf0861605f54ce293f1

Open Ports Detected

1022 443 53 80 8080

CVEs Detected

CVE-2016-20012 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2020-14145 CVE-2020-15778 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408

Map

Whois Information

  • inetnum: 81.171.0.0 - 81.171.31.255
  • netname: NL-LEASEWEB-20030512
  • country: NL
  • org: ORG-OB3-RIPE
  • admin-c: lswn1-RIPE
  • tech-c: lswn1-RIPE
  • status: ALLOCATED PA
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: LEASEWEB-NL-MNT
  • mnt-lower: LEASEWEB-NL-MNT
  • mnt-domains: LEASEWEB-NL-MNT
  • mnt-routes: LEASEWEB-NL-MNT
  • created: 2016-04-11T12:13:14Z
  • last-modified: 2017-11-16T10:29:04Z
  • organisation: ORG-OB3-RIPE
  • org-name: LeaseWeb Netherlands B.V.
  • country: NL
  • org-type: LIR
  • address: Postbus 93054
  • address: 1090BB
  • address: Amsterdam
  • address: NETHERLANDS
  • phone: +31203162880
  • fax-no: +31203162890
  • admin-c: lswn1-RIPE
  • abuse-c: LWAD-RIPE
  • mnt-ref: RIPE-NCC-HM-MNT
  • mnt-ref: LEASEWEB-NL-MNT
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: LEASEWEB-NL-MNT
  • created: 2004-04-17T11:42:05Z
  • last-modified: 2020-12-16T12:49:01Z
  • role: Leaseweb NL NOC
  • address: Hessenbergweg 95, 1101 CX. Amsterdam
  • admin-c: SPW1-RIPE
  • nic-hdl: lswn1-RIPE
  • mnt-by: LEASEWEB-NL-MNT
  • created: 2017-11-16T10:05:00Z
  • last-modified: 2022-07-05T12:59:36Z
  • route: 81.171.0.0/19
  • origin: AS60781
  • mnt-by: LEASEWEB-NL-MNT
  • created: 2016-06-21T14:35:06Z
  • last-modified: 2016-06-21T14:35:06Z
Share on: