IOC Radar
IPMediumSignal 54/100

122.96.28.54

Location
ChinaChina
Suzhou, JS
ASN
AS4837
CNC Group CHINA169 Jiangsu Province Network
First Seen
Feb 27, 2023
Last Seen
May 31, 2026
Feb 27
First Seen
1213d ago
May 31
Last Seen
25d ago
11
Reports
source reports
54%
Confidence
medium
6/91
VirusTotal
detections
Found in 11 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
54%
Signal Score
54 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

42 techniques

Network Information

CountryCNChina
RegionSuzhou, JS
ASNAS4837
OrganizationCNC Group CHINA169 Jiangsu Province Network

Feed Intelligence Summary

11 reports54% confidence
11
Source reports
54%
Confidence score
Category tags
active scanactive scanningaptasiaattackauto-generated securitybad web botbotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute force attemptsbrute-forcebrute-force attackc2 communicationchinacisco devicecisco device targetingcisco exploitation attemptscncommand & controlcommand and controlcommunication protocolcompromised credentialscompromised hostcowrie honeypotcowrie interactionscowrie ssh logscredential accesscredential harvestingcredential stuffingcredentialaccessdata exfiltrationdata store exposuredatabase securityddosddos attackdecoy systemdenial of servicedevice managementdionaea honeypotdistributed attacksemailemailattackenterprise networkingexploitationexploitation activityexploited hostfattftp brute forceftp brute-forcehackinghoneytrap datahoneytrap honeypothttp brute forcehttp scanningidentity & access exploitationimapindicatorinformation gatheringinjection activityinjection attacksintrusion detectioniot securityiot targetedlamplamp server targetinglamp stack attacklamp stack targetinglateral movementlogin attemptsmailoney honeypotmalicious activitymalicious login attemptsmalicious payload detectionmalicious softwaremalwaremalware behaviourmalware capturemalware distributionnetworknetwork discoverynetwork infrastructurenetwork reconnaissancenetwork scanningnetwork securitynetwork traffic analysisp0fpassword attackpassword attacksphishingphishing attackphishing trapping of deathpossible botnet activitypossible exploit attemptpossible mirai variantpotential exploit activitypotential malware distributionprocess injectionransomwarereconnaissanceresearchedresource hijackingscannerscanning activitysensor-taggedsentrypeer botnetsentrypeer detectionservice scansftp activitysftp attacksip scanningsmtpsocial engineeringsshssh attackssh monitoringsurface webt1021t1040t1041t1046t1055t1059t1059.003t1059.004t1071t1071.001t1078t1078.004t1105t1110t1110.001t1110.002t1110.003t1110.004t1189t1190t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1555t1565t1566t1566.001t1566.002t1566.003t1566.004t1573t1573.001t1583t1589t1595t1595.001t1595.002t1595.003tannertelecommunicationsthreat actorthreat detectionthreat intelligencetor nodetpottsecudp port scanunauthorized accessvoipvoip attackvulnerability scanweb app attackweb application attackweb exploitation

Activity Timeline

1 total obs
May 31May 31

Threat Activity Heatmap

· Peak: 2026-05-31
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
54
SIGNAL
Signal Score
54%
Confidence
11
Reports
First seenFeb 27, 2023
Last seenMay 31, 2026
GeolocationCN
CountryChina
LocationSuzhou, JS
ASNAS4837
OrgCNC Group CHINA169 Jiangsu Province Network
Coords32.0589, 118.7738

VirusTotal

6/ 91vendors flagged
7% detection rateJun 7, 2026

WHOIS

description
2025-02-19T06:49:21.000Z Honeypot : Mailoney : Source: 122.96.28.54 : Port: 25 : Data: ehlo hello
raw
inetnum: 122.96.0.0 - 122.97.255.255 netname: UNICOM-JS descr: China Unicom Jiangsu province network descr: China Unicom country: CN admin-c: CH1302-AP tech-c: LL58-AP abuse-c: AC1718-AP status: ALLOCATED PORTABLE remarks: -------------------------------------------------------- remarks: To report network abuse, please contact mnt-irt remarks: For troubleshooting, please contact tech-c and admin-c remarks: Report invalid contact via www.apnic.net/invalidcontact remarks: -------------------------------------------------------- mnt-by: APNIC-HM mnt-lower: MAINT-CNCGROUP-JS mnt-routes: MAINT-CNCGROUP-RR mnt-irt: IRT-CU-CN last-modified: 2023-10-21T03:35:28Z source: APNIC irt: IRT-CU-CN address: No.21,Financial Street address: Beijing,100033 address: P.R.China e-mail: [email protected] abuse-mailbox: [email protected] admin-c: CH1302-AP tech-c: CH1302-AP auth: # Filtered remarks: [email protected] was validated on 2025-02-24 mnt-by: MAINT-CNCGROUP last-modified: 2025-02-24T06:16:57Z source: APNIC role: ABUSE CUCN country: ZZ address: No.21,Financial Street address: Beijing,100033 address: P.R.China phone: +000000000 e-mail: [email protected] admin-c: CH1302-AP tech-c: CH1302-AP nic-hdl: AC1718-AP remarks: Generated from irt object IRT-CU-CN remarks: [email protected] was validated on 2025-02-24 abuse-mailbox: [email protected] mnt-by: APNIC-ABUSE last-modified: 2025-02-24T06:17:45Z source: APNIC person: ChinaUnicom Hostmaster nic-hdl: CH1302-AP e-mail: [email protected] address: No.21,Jin-Rong Street address: Beijing,100033 address: P.R.China phone: +86-10-66259764 fax-no: +86-10-66259764 country: CN mnt-by: MAINT-CNCGROUP last-modified: 2017-08-17T06:13:16Z source: APNIC person: Lan Li nic-hdl: LL58-AP e-mail: [email protected] address: No. 65 Beijing West Road,Nanjing,China phone: +86257900060 fax-no: +86252900280 country: CN mnt-by: MAINT-NEW last-modified: 2013-08-15T02:13:11Z source: APNIC route: 122.96.0.0/15 descr: CNC Group CHINA169 Jiangsu Province Network country: CN origin: AS4837 mnt-by: MAINT-CNCGROUP-RR last-modified: 2008-09-04T07:54:52Z source: APNIC
references
https://github.com/telekom-security/tpotce, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 3 years ago · Last seen 25 days ago
Appeared in 11 threat reports