81.177.139.61 Threat Intelligence and Host Information

Nov 25, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 81.177.139.61 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1053 - Scheduled Task/Job, T1080 - Taint Shared Content, T1102 - Web Service, T1210 - Exploitation of Remote Services, T1486 - Data Encrypted for Impact, T1490 - Inhibit System Recovery, T1566 - Phishing

  • Tags: agent tesla, cobalt strike, cobaltstrike, cyber security, desktop, domains, emotet, emotet malware, eternalblue, fake net, fallout, first, flawedammyy, hashes, ioc, iocs ip, malicious, malware, microsoft, Nextray, phishing, qbot, systembc, trickbot, trojan, wannacry, wannycry, wcry

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: cleanmx_phishing

Malware Detected on Host

Count: 76 bed44642a14179c8df277f8a660fa1f54645bd16f4e42793bb599123cd35d473 b73ee66a2dc7780e89dca1d353c31527d1e8dfcf6701010e99c232948697e105 7833a9b638d820de4ed8bce8c52dce2e2c2211de0aa44323c091c126cd0b552b 687c4ebae2133a5decd1e6a67290230376af445c1546650f3d867cbd95d6c60e 6bb12f500c1870d7f0dc11abe8c1c0aeeaa52e862016e2c9d9e1dc5bb903982c 119a149b05a56d1e5f54699d399e64a27cb8c263a4ec907b60c4d8ebc89a5459 16c8eb2895674df597e9a27251d6a4c2f23b3aeca184aaa727f5ad84a6793db8 ebf94006b3ec4d7b6b86038c7f5ff275dcd8d27fa18a3345381ce0711b54c7e7 bb813556d40e578e2b5a5f7017e53d5457b94f52672b60b63ebab42133fc2583 4e5a670e9c1471cd1da4dcc40ff5c7b62d76cc2301933d41829d2bde18fb7de6

Open Ports Detected

21 22 2222 443 80

CVEs Detected

CVE-2016-20012 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2020-14145 CVE-2020-15778 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408

Map

Whois Information

  • inetnum: 81.177.139.0 - 81.177.139.255
  • netname: AVGURO-NET
  • descr: Avguro Technologies Ltd. Hosting service provider
  • descr: Moscow, Russia
  • country: RU
  • admin-c: SU407-RIPE
  • tech-c: SU407-RIPE
  • abuse-c: ATA95-RIPE
  • status: ASSIGNED PA
  • mnt-by: AS8342-MNT
  • created: 2010-05-04T13:54:02Z
  • last-modified: 2019-01-30T08:42:03Z
  • person: Sergey Ulyashin
  • address: Avguro Technologies Ltd.
  • address: 18, 912, Yunnatov str.
  • address: 127083, Moscow, Russia
  • phone: +74952293031
  • fax-no: +74952293031
  • nic-hdl: SU407-RIPE
  • created: 2007-08-07T13:30:58Z
  • last-modified: 2020-06-04T12:20:02Z
  • mnt-by: AS8342-MNT
  • route: 81.177.128.0/19
  • descr: RTCOMM-RU
  • origin: AS8342
  • mnt-by: AS8342-MNT
  • created: 2015-03-05T10:00:46Z
  • last-modified: 2015-03-05T10:00:46Z
Share on: