IPMediumSignal 62/100

`147.185.132.90`

Location

United States

Santa Clara, California

ASN

AS396982

Palo Alto Networks, Inc

First Seen

May 31, 2024

Last Seen

Jun 18, 2026

May 31

First Seen

753d ago

Jun 18

Last Seen

5d ago

Reports

source reports

62%

Confidence

medium

Found in 37 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.

IPv4 Address

Network layer indicator observed in threat reports.

MISP Category

Network Activity

Confidence

62%

Signal Score

62 / 100

IDS Rule

Threat Context

MITRE ATT&CK TTPs

128 techniques

Network Information

Country

United States

RegionSanta Clara, California

ASNAS396982

OrganizationPalo Alto Networks, Inc

IP Category

⟲

Proxy

Proxy server

Feed Intelligence Summary

37 reports62% confidence

Source reports

62%

Confidence score

Category tags

abuseaccessaccess controlaccount compromiseaccount securityackack scanactionactive reconnaissanceactive scanactive scanningadbadb exploitadb scanningadbhoney activityadbhoney alertsadbhoney attacksadbhoney honeypotadbhoney interactionsadminadministrative accessadvertising campaignadvertising spamaegisamberandroid device attacksapacheapache attackerapi servicesapplication layer protocolaptasiaattackattack attemptattack sourceattack vectorsattacker ipattacker-ipaustraliaauthenticationauthentication abuseauthentication attackauthentication attemptauthentication attemptsauthentication failureauthentication_bypassautomated attackautomated attacksautomated botautomated enumerationautomated reconnaissance activityautomated threatautomated threatsautomated-attackautomated_attackbad reputationbad web botblacklist candidateblacklist ipblacklisted ip addressblock listblock rateblog spambotnetbotnet activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptbrute force attemptsbrute force ftpbrute force sshbrute-forcebrute_forcebruteforcebulk messagingc2c2 communicationc2 servercanadacertchina mobilecisco asacisco asa attackcisco attackcisco brute forcecisco devicecisco device attackcisco device attackscisco device targetedcisco device targetingcisco exploit attemptscisco exploitationcisco exploitation attemptcisco exploitation attemptscisco network devicescisco protocol attackscisco vulnerability scanningcisco-device-targetingcisco_device_attackcitrix attackcitrix attack attemptcitrix exploitation attemptscitrix securityclosecloud environmentcloud infrastructurecloud infrastructure attackcloud providercloud servicescode executioncolumnscommand & controlcommand and controlcommand executioncommand injectioncommand injection attemptcommon vulnerabilitiescommunication protocolcompany limitedcompromise attemptcompromised credentialscompromised credentials attemptcompromised hostcompromised hostscompromised system attemptcompromised systemsconfigconnectconnect scanconpot activityconpot attacksconpot exploitationconpot honeypotconpot ics attacksconpot ics exploitationconpot interactionconpot interactionscontent deliverycorazacowriecowrie activitycowrie attackcowrie attackscowrie datacowrie detected activitycowrie emulationcowrie honeypotcowrie honeypot detectioncowrie interactioncowrie interactionscowrie login attemptscowrie logscowrie sshcowrie ssh attackcowrie ssh attackscowrie ssh honeypotcredential accesscredential access attemptscredential attackcredential attackscredential brute forcecredential brute-forcingcredential compromisecredential guessingcredential harvestingcredential stuffingcredential theftcredential-guessingcredential-harvestingcredential-stuffingcredential_accesscredential_attackcredential_stuffingcssctacve exploitationcyber threatcyberattackdata encryptiondata exfiltrationdata exfiltration attemptdata harvesting attemptsdata scrapingdata store exposuredata theftdatabase activitydatabase attackdatabase attack attemptsdatabase attacksdatabase enumerationdatabase exploitationdatabase exploitation attemptsdatabase probingdatabase scandatabase securitydatabase_serverdcom exploitationddosddos attackddos attack indicatorsddos attacksddos attemptddos preparationddos probedecoy systemdefault credentialsdelhidenial of servicedenial-of-servicedevice managementdictionary attackdictionary_attackdigital oceandigitalocean environmentdionaeadionaea activitydionaea alertdionaea attackdionaea attacksdionaea capturedionaea detectiondionaea honeypotdionaea interactionsdionaea malware analysisdionaea malware collectiondionaea malware samplesdionaea payloadsdionaea signaturesdirectory traversaldirectory traversal attemptdistributed attacksdnsdns attackdropperdropselasticpot activityelasticpot attackselasticpot honeypotelasticsearch monitoringemailencryptionenterprise networkingenterprise securityenumerationenv-huntingeu cyber policieseuropeexecutable fileexfiltrationexploitexploit attemptexploit attemptsexploit kitexploit kit activityexploit probingexploit public-facing applicationexploit: web applicationexploitationexploitation activityexploitation attemptexploitation attemptsexploitation of vulnerabilityexploitation_attemptexploited hostexternal access attemptsexternal reconnaissanceexternal scanexternal scanningexternal threatexternal-threatexternal_threatfailed authenticationfailed login attemptsfattfatt analysisfatt detectionsfatt signaturesfilefinfin port scanfin scanfinancefinlandfirewall detectionfirewall eventsfrancefraudfraudulent activityftpftp activityftp attackftp attacksftp brute forceftp brute-forceftp_attackfullgeckogermanygithubgroupshackinghelloheralding activityheralding attacksheralding behaviorheralding probeshk abusehandlerhoneynet connecthoneytrap activityhoneytrap datahoneytrap eventshoneytrap exploit attemptshoneytrap honeypothoneytrap interactionshong konghttp attackhttp brute forcehttp probehttp probinghttp request anomalieshttp scannerhttp scanninghttp-attackshttp/shttpshttps probehttps probinghttps scanninghydraicmpics securityics/scada attackidentity & access exploitationillegal service advertisingimapinbound scanindiaindia phone numbersindia spamindicatorindustrial control systemsinfoinformation gatheringinfrastructure acquisitionreconnaissanceinfrastructure attackinfrastructure reconnaissanceinitial accessinitial access attemptinitial access vectorinitial_accessinjection activityinjection attacksintel macinternet exposureinternet facing systemsinternet of thingsinternet wide scaninternet-facinginternet-facing assetsinternet-facing serviceinternet-wide scaninternet_scaninternet_scannersintrusion detectioniociocsiot attackiot botnetiot device targetingiot exploit attemptsiot securityiot targetediot/ics attackiot_attackip-addressesipmi scanningipphoney activityipphoney honeypotipv4ipv4 addressesipv4 iocipv4 port scanningipv4 scanningipv4-iocipv4_addressjapankhtmlkill-chain exploitationkill-chain reconnaissancelajpat nagarlamplamp attacklamp attack attemptlamp exploitlamp exploit attemptslamp exploitationlamp exploitation attemptlamp exploitation attemptslamp server attacklamp server targetedlamp server targetinglamp stacklamp stack attacklamp stack exploitationlamp stack targetedlamp stack targetinglamp vulnerability exploitationlamp vulnerability scanlamp-attackslamp_stack_attacklateral movementlateral movement techniqueslcialinuxlinux serverslinux system targetinglinux systemslinux x8664linux-server-attacklinux-server-targetinglinux_server_attacksloginlogin attemptlogin attemptslogin failurelondonlow-riskmail service attackmailoney activitymailoney attackmailoney attacksmailoney eventsmailoney honeypotmailoney interactionsmalaysiamalicious activitymalicious activity detectedmalicious adb activitymalicious campaignmalicious code detectionmalicious email activitymalicious email detectionmalicious file transfermalicious ipmalicious ip activitymalicious ip detectedmalicious ip listmalicious ipsmalicious login attemptsmalicious network activitymalicious payloadmalicious payload attemptmalicious payload attemptsmalicious payload detectionmalicious python scriptsmalicious scanmalicious sftp activitymalicious sip activitymalicious softwaremalicious sshmalicious ssh activitymalicious trafficmalicious-login-attemptsmalicious_activitymalicious_trafficmalwaremalware activitymalware analysismalware attemptmalware behaviourmalware capturemalware deliverymalware delivery attemptmalware detectionmalware distributionmalware distribution attemptmalware downloadmalware droppermalware landingmalware propagationmalware_activitymanualmasscanmelbourne regionmicrosoft technologiesmiraimirai botnetmobilemobile securitymobile threatmssqlmysql brute forcenetworknetwork activitynetwork attacksnetwork device attacknetwork discoverynetwork enumerationnetwork exploitationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork mappingnetwork port scanningnetwork probingnetwork protocolnetwork reconnaissancenetwork reconnaissance activitynetwork scannetwork scanningnetwork scanning activitynetwork securitynetwork service exploitationnetwork service scanningnetwork servicesnetwork traffic analysisnetwork-discoverynetwork_intrusionnetwork_probingnetwork_reconnaissancenetwork_scannetwork_scanningnetwork_service_exploitationnginxnmapnmap scannorth americanull port scannull scanoceaniaopen port detectionopen port discoveryopen port enumerationopen proxyopen_port_discoveryopencanaryoperating systemoperating system securityopportunistic attackeros fingerprintingos xosintp0fp0f fingerprintingp0f network fingerprintingp0f passive fingerprintingp0f signaturespaloaltonetwors_com-benignparispassword attackpassword attackspassword sprayingpassword_attackpgp signphishingphishing attackphishing trapphone number spamphone spamphp exploitpingping of deathpolandport-scanningportscanpossible botnet activitypossible credential compromisepossible credential reusepossible exploit attemptpossible exploit attemptspossible malware distributionpossible malware heraldingpossible malware propagationpossible mirai variantpossible reconnaissancepossible reconnaissance activitypossible vulnerability exploitationpossible vulnerability scanningpotential botnetpotential botnet activitypotential data exfiltrationpotential exploitpotential exploit activitypotential exploit attemptspotential intrusionpotential intrusion attemptpotential malware activitypotential malware deliverypotential malware deploymentpotential malware distributionpotential threat actorpotential vulnerability exploitationpotential vulnerability scanpotential vulnerability scanningprivilege escalationprocess injectionprotocol exploitationprotocol-abuseproxyproxy protocolpythonransomwareransomware activityraspberry-pirdprdp scanningrdp_attackreconnaissancereconnaissance activityreconnaissance-activitiesreconnaissance_activityredis exploitationredis exploitation attemptredis exploitation attemptsredis honeypotredis honeypot activityredishoneypotredishoneypot activityregional securityremote accessremote access attackremote access attemptremote access attemptsremote code executionremote serviceremote servicesremote_accessremote_access_serviceremote_serviceresearchedresource hijackingrpcsansscada/icsscamscams & fraudscanscannerscanner detectionscanner ipsscannersscanning activityscriptscript kiddiescripting attackssecurity eventsecurity operationssecurity policysensor-taggedsentrypeer activitysentrypeer attacksentrypeer attackssentrypeer botnetsentrypeer detectionsentrypeer eventssentrypeer interactionsserverserver exploitationservice detectionservice discoveryservice enumerationservice probingservice scanservice scanningservice version detectionservice_enumerationsex industrysex services advertisementsex worksftpsftp abusesftp access attemptsftp access attemptssftp activitysftp attacksftp attackssftp attemptsftp attemptssftp exploitationsftp exploitation attemptsftp intrusion attemptsftp intrusion attemptssftp probingsftp scanningsftp-attacksftp-brute-forceshell accessshell access attemptssipsip attackssip brute forcesip enumerationsip probingsip protocolsip scanningsip vulnerability scansip-attackssip-scanningslugsmbsmb brute forcesmb_attacksmssms spamsms spam campaignsmtpsmtp attacksmtp attackersmtp attackssmtp brute forcesmtp probesmtp probingsmtp scanningsnmpsocial engineeringsocradarsocradar honeypotsoftware exploitationspamspam advertisementspam campaignsql injectionsql injection attemptsql injection attemptssql_attacksshssh attackssh attacksssh brute-forcessh monitoringssh-brute-forcessh_attackstealth scansurface websuricata alertssweep scansynsyn port scansyn scansystem discoveryt-pott1005t1016t1016.001t1016.002t1018t1020t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1021.007t1027t1040t1041t1046t1047t1053t1053.005t1055t1056t1056.001t1059t1059.001t1059.003t1059.004t1059.005t1059.006t1059.007t1059.008t1064t1068t1069.001t1071t1071.001t1071.004t1076t1077t1078t1078.001t1078.002t1078.003t1078.004t1082t1083t1087t1088t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1192t1195t1199t1203t1204t1204.002t1210t1213t1486t1490t1496t1497t1499.001t1499.002t1499.003t1505t1505.002t1505.004t1550t1550.002t1555t1555.003t1559t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1567.001t1572t1573t1573.001t1583t1583.001t1583.006t1583.007t1584t1584.004t1587.001t1588t1588.001t1588.002t1588.003t1588.004t1589t1589.001t1589.002t1590t1590.001t1590.003t1590.004t1590.005t1590.006t1591t1592t1592.001t1592.002t1592.003t1592.004t1595t1595.001t1595.002t1595.003t1598t1598.003t1598.004tannertanner activitytanner attackstanner detected activitytanner eventstanner exploit kittanner exploitationtanner exploitstanner honeypot activitytanner interactionstargeting databasetcptcp protocoltcp scantcp scanningtcp_scantelecommunicationstelephone harassmenttelnettelnet scanningtelnet threattelnet-brute-forcetelnet_attackthreat actorthreat detectionthreat feedthreat intelligencethreat intelligence feedthreat preventionthreat-intelligencethreat_intelligencetimeouttokyotor nodetorontotpottpotceubuntuudp port scanudp scanudp_scanunattributed activityunauthorized accessunauthorized access attemptunauthorized access attemptsunauthorized loginunauthorized login attemptsunauthorized probingunauthorized-access-attemptunited kingdomunited statesunited states of americaunknown threat actorunsolicited communicationunsolicited contactunsolicited messagingunusual network trafficusus noneus source ipverified-benignvnc protocolvoipvoip attackvoip attacksvoip servicesvulnerability scanvulnerability-scanningvultrvultr cloud infrastructurevultr hostingvultr infrastructure targetedvultr-platformvultr_platform_activityweak credentialswebweb apisweb app attackweb application attackweb application attacksweb application probingweb application scanweb application scanningweb applicationsweb attackweb attacksweb crawling detectionweb developmentweb exploit attemptsweb exploitationweb hostingweb infrastructureweb scannerweb server attackweb server attacksweb servicesweb shellweb shell attemptweb shell detectionweb shell uploadweb shell uploadsweb spamweb technologiesweb trafficweb-application-attackweb-application-attacksweb_application_attackweb_attackweb_serverwinwindowswindows ntwindows system targetingwordpress attackwordpress exploit attemptswordpress-exploitation-attemptsxmasxmas port scanxmas scan

Activity Timeline

1 total obs

Jun 18Jun 18

Threat Activity Heatmap

· Peak: 2026-06-18

Less

Mon

Wed

Fri

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Jan

Feb

Mar

Apr

May

Jun

24h

Dormant

Minimal

30d

Minimal

3mo

Minimal

Threat ScoreMedium Risk

SIGNAL

Signal Score

62%

Confidence

Reports

First seenMay 31, 2024

Last seenJun 18, 2026

GeolocationUS

CountryUnited States

LocationSanta Clara, California

ASNAS396982

OrgPalo Alto Networks, Inc

Coords37.3833, -121.9830

Proxy

VirusTotal

Not checked

WHOIS

description: IPv4 hosts detected port scanning DigitalOcean London (UK) honeypot
raw: NetRange: 147.185.132.0 - 147.185.139.255 CIDR: 147.185.136.0/22, 147.185.132.0/22 NetName: PAN-22 NetHandle: NET-147-185-132-0-1 Parent: NET147 (NET-147-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Palo Alto Networks, Inc (PAN-22) RegDate: 2023-09-07 Updated: 2023-09-07 Ref: https://rdap.arin.net/registry/ip/147.185.132.0 OrgName: Palo Alto Networks, Inc OrgId: PAN-22 Address: Palo Alto Networks Address: 3000 Tannery Way Address: Santa Clara, CA 95054 City: Santa Clara StateProv: CA PostalCode: 95054 Country: US RegDate: 2017-11-22 Updated: 2024-11-25 Ref: https://rdap.arin.net/registry/entity/PAN-22 OrgAbuseHandle: IPABU42-ARIN OrgAbuseName: IP Abuse OrgAbusePhone: +1-408-753-4000 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/IPABU42-ARIN OrgTechHandle: GNS20-ARIN OrgTechName: Global Network Services OrgTechPhone: +1-408-753-4000 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/GNS20-ARIN

`147.185.132.90`

MITRE ATT&CK TTPs

Network Information

IP Category

Feed Intelligence Summary

Activity Timeline

Threat Activity Heatmap

VirusTotal

WHOIS

Export & API

IOC Journey