IPMediumSignal 40/100
120.25.189.254
Location
ChinaShenzhen, Guangdong
ASN
AS37963
Alibaba.com LLC
First Seen
Jul 9, 2024
Last Seen
Jun 2, 2026
Found in 15 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
40%
Signal Score
40 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryChina
ChinaRegionShenzhen, Guangdong
ASNAS37963
OrganizationAlibaba.com LLC
IP Category
⟲
Proxy
Proxy server
⊕
VPN
VPN exit node
Feed Intelligence Summary
15 reports40% confidence
15
Source reports
40%
Confidence score
Category tags
active scanactive scanningasiabotnetbotnet activitybotnet iocsbotnet miraibotnet propagationbrute forcebrute force attackerchinacncommand and controlcommunication protocolconnected devicescredential accesscredential stuffingcryptocurrencycryptocurrency threatscryptojackingdata exfiltrationdata store exposureddosddos attacksdenial of servicedevice managementdistributed attacksencryptionexploitationexploitation activityfinancegorillabothttps proxyidentity & access exploitationindustrial iotinitial accessinjection activityinternet of thingsiocsiot analyticsiot applicationsiot botnetiot devicesiot platformsiot securityiot/ics attackipv4irclinuxmalicious softwaremalwaremirai botnetmirai internetnetworknetwork attacksnetwork protocolnetwork scanningnetwork securityoutlawprocess injectionprotocol exploitationproxyransomwarereconnaissanceresearchedresource hijackingscanning activityself-signedsmart devicesssh attacksslt1021t1021.001t1040t1053.005t1055t1059t1059.004t1071t1071.001t1078t1078.001t1105t1110.002t1190t1203t1486t1496t1497t1497.001t1498.001t1499.002t1499.003t1565t1595.001t1595.002t1595.003tcp protocoltelnet threatthingsthreat actortor nodetwittervpnxmrig
Activity Timeline
Jun 2Jun 2
Threat Activity Heatmap
· Peak: 2026-06-02LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Intelligence SummaryAI Generated
This Indicator of Compromise (IOC), an IPv4 address, represents a significant and active threat to organizational security. With a score of 40.038 and no whitelist status, it is strongly associated with malicious activities, including brute-force attacks and operation as a proxy. Furthermore, this IP address is linked to the Mirai botnet, a notorious threat primarily known for launching large-scale Distributed Denial of Service (DDoS) attacks and compromising IoT devices. Its attribution to the …
Threat ScoreMedium Risk
40
SIGNAL
Signal Score
40%
Confidence
15
Reports
First seenJul 9, 2024
Last seenJun 2, 2026
GeolocationCN
CountryChina
LocationShenzhen, Guangdong
ASNAS37963
OrgAlibaba.com LLC
Coords22.5318, 114.1374
ProxyVPN
VirusTotal
Not checked
WHOIS
- description
- proxy-proxy_http search result.
- raw
- inetnum: 120.24.0.0 - 120.27.255.255 netname: ALISOFT descr: Aliyun Computing Co., LTD descr: 5F, Builing D, the West Lake International Plaza of S&T descr: No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099 country: CN admin-c: ZM1015-AP tech-c: ZM877-AP tech-c: ZM876-AP tech-c: ZM875-AP abuse-c: AC1601-AP status: ALLOCATED PORTABLE mnt-by: MAINT-CNNIC-AP mnt-irt: IRT-ALISOFT-CN last-modified: 2023-11-28T00:57:00Z source: APNIC irt: IRT-ALISOFT-CN address: No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099 e-mail: [email protected] abuse-mailbox: [email protected] auth: # Filtered admin-c: ZM877-AP tech-c: ZM877-AP mnt-by: MAINT-CNNIC-AP last-modified: 2021-09-05T23:38:36Z source: APNIC role: ABUSE CNNICCN country: ZZ address: Beijing, China phone: +000000000 e-mail: [email protected] admin-c: IP50-AP tech-c: IP50-AP nic-hdl: AC1601-AP remarks: Generated from irt object IRT-CNNIC-CN abuse-mailbox: [email protected] mnt-by: APNIC-ABUSE last-modified: 2024-07-30T11:55:46Z source: APNIC person: Li Jia address: NO.969 West Wen Yi Road, Yu Hang District, Hangzhou country: CN phone: +86-0571-85022088 e-mail: [email protected] nic-hdl: ZM1015-AP mnt-by: MAINT-CNNIC-AP last-modified: 2014-07-30T02:02:01Z source: APNIC person: Guoxin Gao address: 5F, Builing D, the West Lake International Plaza of S&T address: No.391 Wen'er Road, Hangzhou City address: Zhejiang, China, 310099 country: CN phone: +86-0571-85022600 fax-no: +86-0571-85022600 e-mail: [email protected] nic-hdl: ZM875-AP mnt-by: MAINT-CNNIC-AP last-modified: 2014-07-30T01:56:01Z source: APNIC person: security trouble e-mail: [email protected] address: 5th,floor,Building D,the West Lake International Plaza of S&T,391#Wen??r Road address: Hangzhou, Zhejiang, China phone: +86-0571-85022600 country: CN mnt-by: MAINT-CNNIC-AP nic-hdl: ZM876-AP last-modified: 2021-04-13T23:22:33Z source: APNIC person: Guowei Pan address: 5F, Builing D, the West Lake International Plaza of S&T address: No.391 Wen'er Road, Hangzhou City address: Zhejiang, China, 310099 country: CN phone: +86-0571-85022088-30763 fax-no: +86-0571-85022600 e-mail: [email protected] nic-hdl: ZM877-AP mnt-by: MAINT-CNNIC-AP last-modified: 2013-07-09T01:34:02Z source: APNIC route: 120.24.0.0/14 descr: Hangzhou Alibaba Advertising Co.,Ltd. country: CN origin: AS37963 mnt-by: MAINT-CNNIC-AP last-modified: 2019-08-07T23:28:05Z source: APNIC route: 120.24.0.0/14 descr: Alibaba (US) Technology Co., Ltd. country: CN origin: AS45102 mnt-by: MAINT-CNNIC-AP last-modified: 2019-08-07T23:28:03Z source: APNIC
- references
- https://1275.ru/ioc/gs-25-1490-mirai-botnet-iocs_10200
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 12 days ago
Appeared in 15 threat reports