IOC Radar
IPMediumSignal 34/100

120.138.12.77

Location
IndiaIndia
Chennai, TN
ASN
AS24186
Railtel
First Seen
Jul 19, 2024
Last Seen
Feb 9, 2026
Jul 19
First Seen
695d ago
Feb 9
Last Seen
125d ago
7
Reports
source reports
34%
Confidence
medium
Found in 7 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
34%
Signal Score
34 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

33 techniques

Network Information

CountryINIndia
RegionChennai, TN
ASNAS24186
OrganizationRailtel

Feed Intelligence Summary

7 reports34% confidence
7
Source reports
34%
Confidence score
Category tags
active scanningarmasciiasiaasyncratbackdoorbase64-loaderbotnetbotnetdomaincensysclipboardhijackercode injectioncoinminercommand and controlcommand executioncredential accessdarktortilladarkvisionratdata exfiltrationdbatloaderdcratddosddos attacksddosagentdenial of servicedistributed attacksdlldocdropped-by-lummastealerelfencodedexeexploited hostfakecaptchagafgytgetshellguloaderhackinghajimehijackloaderhtahtmlindiaindicatorinternet of thingsiot botnetiot/ics attackjpg-base64-loaderlokilummastealermalicious powershell activitymalicious softwaremalwaremeterpretermipsmirai botnetmodiloadermoobotmozimsinetworknetwork scanningnetwork securityopendirprocess injectionprotocol exploitationps1quasarratraccoonclipperratreconnaissanceremcosratremote accessresearchedrev-base64-loadersaint helena, ascension and tristan da cunhascannerscripting attackssliversmartloadersmoke loadersshdkitt1027t1040t1055t1059t1059.001t1059.007t1071t1071.001t1078t1086t1105t1110.002t1133t1189t1190t1203t1204t1204.001t1204.002t1486t1496t1499.001t1499.002t1499.003t1565t1566t1583t1588t1589t1592t1595.001t1595.002t1595.003tcp/23telnet threattsunamiua-wgetvidarvipkeyloggerweb application attackweb exploitationxloaderxwormzip

Activity Timeline

1 total obs
Feb 9Feb 9

Threat Activity Heatmap

· Peak: 2026-02-09
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreLow Risk
34
SIGNAL
Signal Score
34%
Confidence
7
Reports
First seenJul 19, 2024
Last seenFeb 9, 2026
GeolocationIN
CountryIndia
LocationChennai, TN
ASNAS24186
OrgRailtel
Coords12.8996, 80.2209

VirusTotal

Not checked

WHOIS

raw
inetnum: 120.138.12.0 - 120.138.15.255 netname: RAILTEL-IN descr: RailTel Corporation is an Internet Service Provider. country: IN admin-c: NA1011-AP tech-c: NA1011-AP abuse-c: NA1011-AP status: ALLOCATED PORTABLE mnt-by: MAINT-IN-IRINN mnt-lower: MAINT-IN-RAILTEL mnt-routes: MAINT-IN-RAILTEL mnt-irt: IRT-RAILTEL-IN last-modified: 2022-05-17T12:25:08Z source: APNIC irt: IRT-RAILTEL-IN address: Plot No, 143 address: Sector 44 ,Gurugram address: Haryana ,122003 e-mail: [email protected] abuse-mailbox: [email protected] admin-c: NA1011-AP tech-c: NA1011-AP auth: # Filtered mnt-by: MAINT-IN-RAILTEL last-modified: 2022-05-12T07:26:27Z source: APNIC person: Network Administrator address: Plate-A, 6th Floor, Office Block Tower-2, address: East Kidwai Nagar, New Delhi-110023 country: IN phone: +91 11 22900600 e-mail: [email protected] nic-hdl: NA1011-AP mnt-by: MAINT-IN-RAILTEL fax-no: +91 11 22900699 last-modified: 2022-05-12T07:18:48Z source: APNIC route: 120.138.12.0/24 descr: Railtel origin: AS24186 mnt-by: MAINT-IN-RAILTEL last-modified: 2021-01-14T09:17:50Z source: APNIC
references
https://urlhaus.abuse.ch/browse/

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 4 months ago
Appeared in 7 threat reports