IOC Radar
IPMediumSignal 100/100

118.193.240.214

Location
ChinaChina
Xi'an, Shaanxi
First Seen
Feb 27, 2025
Last Seen
Nov 26, 2025
Feb 27
First Seen
472d ago
Nov 26
Last Seen
201d ago
9
Reports
source reports
99%
Confidence
medium
Found in 9 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

72 techniques

Network Information

CountryCNChina
RegionXi'an, Shaanxi
OrganizationShanghai ruisu network technology co., LTD

Feed Intelligence Summary

9 reports99% confidence
9
Source reports
99%
Confidence score
Category tags
abuseaccount compromiseactive scanningaptapt groupasiaautomotive manufacturingbackdoorbeta versionbig game huntingbig-game huntingbodybotnetbrute forcebrute_forcebuttoncactuscertchinacisco securecivil servicesclosecloud c2cloud computingcloud migrationcloud securitycloud servicescloud services c2cloud services exploitationcloud storagecncobalt strikecobaltstrikecode executioncode injectioncommand and controlcommand executioncommunication technologiescontactcookiecouriercredential accesscredential harvestingcredential stuffingcredential_accessctacyber espionage campaigndata accessdata copyingdata encryptiondata exfiltrationdata extortiondata leakdata leak sitedata theftdata transferdistributed attacksdll sideloadingdouble extortiondropbox c2electronics manufacturingenergyenergy distributioneuropeevoraexfiltrationextortionfileless malwarefindfooterformftpgermanygithubgithub iocsgovernment technologyhasheshong konghtranindicatorindustrial automationindustrial iotindustrial productioningress tool transferinitial accessinput validation bypassinterlockiocsjapanlateral movementlinklotus blossomlotus-blossommainmalicious downloadmalicious softwaremalwaremalware analysismalware distributionmanualmanufacturing technologymediametadata analysismetasploitmobile carriersmobile networksmulti-cloud managementmulti-stage attacknetworknetwork iocsnetwork probingnetwork securitynetwork traffic analysisnetwork_reconnaissancenorth americaoil & gasopenpath traversalpersistence mechanismpersistence mechanismsphilippinesphishingphishing attackphp-cgipolandpower generationpower systemsprocess injectionprocess manufacturingprotocol exploitationpublic administrationpublic infrastructurepublic policyquality controlransomwareratreconnaissanceregexpandsz dregulatory agenciesreloadremote accessremote access trojanremote servicesrenewable energyresearchedscriptservicedll tsmallsocial engineeringsocial media securityspanssh attackstarsupply chain managementsystem disruptiont1001t1003t1005t1016t1021t1021.001t1027t1030t1036t1040t1041t1049t1053t1055t1056t1059t1059.001t1059.005t1070t1071t1071.001t1076t1078t1078.001t1082t1083t1087t1090t1102t1105t1110t1110.002t1112t1113t1124t1132t1133t1134t1136t1140t1190t1204t1486t1490t1496t1499.001t1499.002t1499.003t1505t1518t1526t1543t1547t1550t1562t1563t1565t1566t1566.001t1566.002t1566.003t1569t1569.002t1571t1573t1574t1583t1584t1595t1595.001t1595.002t1595.003taiwantaowutargeting:japantelecom servicestelecommunicationstelnet threattetraloaderthreat spotlightthreatstop storytrojan malwarettpsturkeytwittertwitter c2united statesvenom proxyvietnamweb application exploitationworldwide secrets blogwritezimbrazimbra c2

Activity Timeline

1 total obs
Nov 26Nov 26

Threat Activity Heatmap

· Peak: 2025-11-26
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
9
Reports
First seenFeb 27, 2025
Last seenNov 26, 2025
GeolocationCN
CountryChina
LocationXi'an, Shaanxi
OrgShanghai ruisu network technology co., LTD
Coords34.2658, 108.9540

VirusTotal

Not checked

WHOIS

description
CC=CN ASN=ASNone

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 6 months ago
Appeared in 9 threat reports