IPMediumSignal 83/100
146.190.93.207
Location
United StatesSingapore, Unknown
ASN
AS14061
DigitalOcean, LLC
First Seen
Apr 13, 2025
Last Seen
Jun 8, 2026
Found in 19 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
83%
Signal Score
83 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionSingapore, Unknown
ASNAS14061
OrganizationDigitalOcean, LLC
Feed Intelligence Summary
19 reports83% confidence
19
Source reports
83%
Confidence score
Category tags
abuseaccess attemptaccess controlaccount compromiseactive scanactive scanningapacheapache attackerapplication layer protocolasiaattackattack origin: malaysiaattack sourceattack source ipattacker-ipaustraliaauthenticationauthentication abuseauthentication attackauthentication failuresauthentication_bypassautomated attackbad reputationbad web botblog spambotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute force attemptbrute force attemptsbrute-forcbrute-forcebrute_forcechinacisco devicecloud infrastructurecloud infrastructure attackcloud servicescommand and controlcommunication protocolcompromised hostcowrie honeypotcowrie interactionscredential accesscredential stuffingcredential_accessdata exfiltrationdata store exposuredatabase securityddosddos attackdecoy systemdenial of servicedevice managementdigitalocean vpsdionaea honeypotdionaea interactionsdistributed attacksenterprise networkingeuropeexploit attemptsexploitation activityexploitation attemptexploited hostexternal remote servicesfail2ban alertfail2ban triggeredfailed accessfailed loginfattfatt signaturesfinlandfranceftpftp brute forceftp brute-forcegame_servergeoipgermanyhackinghoneynet connecthoneytrap honeypothoneytrap interactionshttp brute forcehttp probinghttp scannerhttpsicmpidentity & access exploitationimap brute forceindiaindicatorinformation technologyinitial accessinjection activityinjection attacksintrusion detectioniot securityiot targetedipv4ipv4_addressit infrastructurelamplateral movementlcialogin attacklogin attemptlogin attempt monitoringlogin attemptslogin brute forcelogin failuremailmailoney honeypotmailoney interactionsmalaysiamalicious activitymalicious ip addressesmalicious network activitymalicious softwaremalwaremalware analysismalware behaviourmalware capturemalware distributionmod securitymultiple failed loginsnetworknetwork accessnetwork attacksnetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptsnetwork intrusion detectionnetwork layer protocolnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork_service_exploitationnorth americanoticeoceaniap0fp0f signaturespassword attackpassword attacksphishingphishing attackphishing trapping of deathpolandprocess injectionprotocol exploitationransomwarereconnaissanceremote accessremote serviceremote servicesremote_accessresearchedresource hijackingscanscannerscannersscanning activitysecurity operationssecurity policysensor-taggedsentrypeer botnetsentrypeer interactionsserver exploitationservice scansftp attacksgsingaporesmb brute forcesmtpsmtp brute forcesmtp probingsmtp scanningsocradar honeypotsoftware developmentspamsql injectionsshssh attackssh brute-force activityssh monitoringstaging_serversuricata alertsswedent-pott1005t1016t1018t1020t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1021.007t1021.008t1040t1041t1046t1053t1055t1059t1059.001t1059.003t1059.004t1068t1071t1071.001t1076t1078t1078.004t1083t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1505.002t1555t1563t1565t1566t1588t1588.002t1588.004t1589t1589.002t1592t1595t1595.001t1595.002t1595.003tannertanner interactionstargeting databasetcp protocoltcp scantelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencethreat preventiontor nodetpotudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized access attemptsunited kingdomunited statesvalid accountsvnc protocolvoipvoip attackvpsweb application attackweb exploitationweb spamweb traffic
Activity Timeline
Jun 8Jun 8
Threat Activity Heatmap
LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
83
SIGNAL
Signal Score
83%
Confidence
19
Reports
First seenApr 13, 2025
Last seenJun 8, 2026
GeolocationUS
CountryUnited States
LocationSingapore, Unknown
ASNAS14061
OrgDigitalOcean, LLC
Coords1.3212, 103.6950
VirusTotal
Not checked
WHOIS
- description
- Banned by Fail2Ban [sshd]
- raw
- inetnum: 146.0.0.0 - 146.255.255.255 netname: ERX-NETBLOCK descr: Early registration addresses country: AU admin-c: IANA1-AP tech-c: IANA1-AP abuse-c: AA1452-AP status: ALLOCATED PORTABLE remarks: ------------------------------------------------------ remarks: Important: remarks: remarks: Networks in this range were allocated by InterNIC remarks: prior to the formation of Regional Internet remarks: Registries (RIRs): AfriNIC, APNIC, ARIN, LACNIC and RIPE NCC. remarks: remarks: Address ranges from this historical space have now remarks: been transferred to the appropriate RIR database.remarks: remarks: If your search has returned this record, it means the remarks: address range is not administered by APNIC. remarks: remarks: Instead, please search one of the following databases: remarks: remarks: - AfriNIC (Africa) remarks: website: http://www.afrinic.net/ remarks: command line: whois.afrinic.net remarks: remarks: - ARIN (Northern America) remarks: website: http://www.arin.net/ remarks: command line: whois.arin.net remarks: remarks: - LACNIC (Latin America and the Carribean) remarks: website: http://www.lacnic.net/ remarks: command line: whois.lacnic.net remarks: remarks: - RIPE NCC (Europe) remarks: website: http://www.ripe.net/ remarks: command line: whois.ripe.net remarks: remarks: For information on the Early Registration Transfer remarks: (ERX) project, see: remarks: remarks: http://www.apnic.net/db/erx remarks: remarks: ------------------------------------------------------ mnt-by: APNIC-HM mnt-lower: APNIC-HM mnt-irt: IRT-APNIC-AP last-modified: 2022-09-16T01:40:59Z source: APNIC irt: IRT-APNIC-AP address: Brisbane, Australia e-mail: [email protected] abuse-mailbox: [email protected] admin-c: HM20-AP tech-c: NO4-AP auth: # Filtered remarks: APNIC is a Regional Internet Registry. remarks: We do not operate the referring network and remarks: are unable to investigate complaints of network abuse. remarks: For information about IRT, see www.apnic.net/irt remarks: [email protected] was validated on 2020-02-03 mnt-by: APNIC-HM last-modified: 2023-08-18T00:42:38Z source: APNIC role: ABUSE APNICAP address: Brisbane, Australia country: ZZ phone: +000000000 e-mail: [email protected] admin-c: HM20-AP tech-c: NO4-AP nic-hdl: AA1452-AP remarks: Generated from irt object IRT-APNIC-AP remarks: [email protected] was validated on 2020-02-03 abuse-mailbox: [email protected] mnt-by: APNIC-ABUSE last-modified: 2023-08-18T19:08:30Z source: APNIC role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-AP tech-c: IANA1-AP nic-hdl: IANA1-AP remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: MAINT-APNIC-AP last-modified: 2018-06-22T22:34:30Z source: APNIC
- references
- https://github.com/telekom-security/tpotce, https://redpiranha.net
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 6 days ago
Appeared in 19 threat reports