IPMediumSignal 72/100
15.235.189.157
Location
CambodiaSihanoukville, Unknown
ASN
AS16276
Yoga, Subama
First Seen
Jul 7, 2024
Last Seen
Apr 23, 2026
Found in 27 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
72%
Signal Score
72 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryCambodia
CambodiaRegionSihanoukville, Unknown
ASNAS16276
OrganizationYoga, Subama
Feed Intelligence Summary
27 reports72% confidence
27
Source reports
72%
Confidence score
Category tags
abuseactive scanactive scanningadbhoney activityadbhoney attackadbhoney honeypotaptasiaattackaustraliaauthentication abuseauthentication attemptsauthentication failureautomated-attackbad reputationbad web botblog spambotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute force attemptsbrute-forcecacanadaciscocisco attackcisco devicecisco device targetingcisco exploitationcisco exploitation attemptcisco exploitation attemptscommand and controlcommand injectioncommunication protocolcompromised credentialscompromised hostconnected devicesconpotconpot honeypotconpot interactioncowriecowrie activitycowrie honeypotcowrie interactioncowrie interactionscowrie ssh honeypotcredential accesscredential attackcredential harvestingcredential stuffingcredential-stuffingcredentialaccessdata encryptiondata exfiltrationdata store exposuredatabase attackdatabase attacksdatabase intrusion attemptdatabase scandatabase securityddosddos attackddos probingdecoy systemdenial of servicedevice managementdictionary attackdionaeadionaea activitydionaea honeypotdionaea interactionsdionaea payloadsdistributed attacksdnsdns attackemailemailattackencryptionenterprise networkingenumerationeuropeexploitexploit attemptexploitationexploitation activityexploitation attemptexploitation attemptsexploited hostexternal threatfailed login attemptsfattfatt detectionsfatt signaturesfin scanfinlandfranceftpftp attacksftp brute forceftp brute-forceftp bruteforcegermanyhackinghoneynet connecthoneypot attackhoneytrap activityhoneytrap eventshoneytrap honeypothoneytrap interactionshttp attackhttp brute forcehttp probinghttp scannerics securityidentity & access exploitationimapimap attackindicatorindustrial control systemsindustrial iotinformation gatheringinfrastructure acquisitionreconnaissanceinitial accessinjection activityinjection attacksinternet of thingsiot analyticsiot applicationsiot platformsiot securityiot/ics attackipphoney honeypotlamplamp attacklamp exploitationlamp server attacklamp stack targetinglamp vulnerability exploitationlateral movementlateral movement techniqueslinuxlinux system targetinglinux-server-attacklogin attemptlogin attemptsmailoney activitymailoney eventsmailoney honeypotmailoney interactionsmalicious activitymalicious emailmalicious payload attemptmalicious payload attemptsmalicious payload detectionmalicious sftp activitymalicious softwaremalicious ssh activitymalicious trafficmalicious-login-attemptsmalwaremalware behaviourmalware capturemalware deliverymalware delivery attemptmalware detectionmalware download attemptsmanualmssqlmysqlnetworknetwork attacksnetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnorth americanull scanoceaniaonyphe-benignp0fp0f signaturespassword attackpassword attackspassword sprayingphishingphishing attackphishing trappolandport-scanningpossible botnet activitypossible exploit attemptpossible malware distributionpotential exploit activitypotential exploit attemptspotential intrusionpotential malware distributionpotential malware uploadprobingprocess injectionprotocol exploitationprotocol-abuseransomwarereconnaissanceredis honeypotredis honeypot attackredishoneypotredishoneypot activityremote accessremote access attackremote servicesresearchedresource developmentresource hijackingsansscannerscanning activityscripting attackssecurity operationssensor-taggedsentrypeer activitysentrypeer botnetsentrypeer eventssentrypeer interactionsserver exploitationservice exploitationservice scansftpsftp access attemptsftp attacksftp attackssftp attemptssftp-attacksgsingaporesipsip attackssip brute forcesip probingsip scanningsmart devicessmb attackssmb brute forcesmtpsmtp attacksmtp attackersmtp brute forcesmtp probingsocial engineeringsocradar honeypotspamsql injectionsql injection attemptssshssh attackssh attacksssh monitoringssh-brute-forcesurface websuricata alertssyn scant-pott1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1040t1041t1046t1055t1059t1059.001t1059.003t1059.004t1059.007t1068t1071t1071.001t1076t1077t1078t1078.001t1078.002t1078.003t1078.004t1087t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1199t1203t1204.002t1210t1486t1496t1497t1499.001t1499.002t1499.003t1505.002t1555t1555.003t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1583t1587.001t1588t1589t1590t1590.001t1592t1595t1595.001t1595.002t1595.003tannertanner activitytanner eventstanner interactionstargeting databasetcp protocoltcp scantcp/23tcp/3306telecommunicationstelnettelnet threattelnet-brute-forcethreat actorthreat detectionthreat intelligencetor nodetpotudp scanunauthorized accessunauthorized access attemptunauthorized loginunauthorized-access-attemptunited statesverified-benignvnc protocolvoipvoip attackvulnerability scanweb application attackweb application attacksweb application scanweb application scanningweb attackweb exploitationweb exploitsweb scannerweb serverweb server attacksweb spamweb trafficweb-application-attackwebscanwebscannerwindows system targetingxmas scan
Activity Timeline
Apr 23Apr 23
Threat Activity Heatmap
· Peak: 2026-04-23LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
72
SIGNAL
Signal Score
72%
Confidence
27
Reports
First seenJul 7, 2024
Last seenApr 23, 2026
GeolocationKH
CountryCambodia
LocationSihanoukville, Unknown
ASNAS16276
OrgYoga, Subama
Coords1.3521, 103.8200
VirusTotal
Not checked
WHOIS
- description
- Unknown source type: honeyaml
- raw
- inetnum: 15.0.0.0 - 15.255.255.255 netname: IANA-NETBLOCK-15 descr: This network range is not allocated to APNIC. descr: descr: If your whois search has returned this message, then you have descr: searched the APNIC whois database for an address that is descr: allocated by another Regional Internet Registry (RIR). descr: descr: Please search the other RIRs at whois.arin.net or whois.ripe.net descr: for more information about that range. country: AU admin-c: IANA1-AP tech-c: IANA1-AP remarks: For general info on spam complaints email [email protected]. remarks: For general info on hacking & abuse complaints email [email protected]. mnt-by: MAINT-APNIC-AP mnt-lower: MAINT-APNIC-AP status: ALLOCATED PORTABLE last-modified: 2008-09-04T06:51:28Z source: APNIC role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-AP tech-c: IANA1-AP nic-hdl: IANA1-AP remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: MAINT-APNIC-AP last-modified: 2018-06-22T22:34:30Z source: APNIC
- references
- https://github.com/telekom-security/tpotce, https://raw.githubusercontent.com/ahamed-rizvan/IOCs/refs/heads/main/Malicous%20IP%20Address.txt, https://example.com
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 1 month ago
Appeared in 27 threat reports