IPMediumSignal 40/100
152.67.120.34
Location
AustraliaSydney, New South Wales
ASN
AS31898
Oracle Cloud Infrastructure (ap-sydney-1)
First Seen
Sep 25, 2023
Last Seen
Jun 9, 2026
Found in 5 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
40%
Signal Score
40 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryAustralia
AustraliaRegionSydney, New South Wales
ASNAS31898
OrganizationOracle Cloud Infrastructure (ap-sydney-1)
Feed Intelligence Summary
5 reports40% confidence
5
Source reports
40%
Confidence score
Category tags
abuseack scanactive scanactive scanningauaustraliabad reputationbotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute force attemptsbrute-forcecode executioncommand and controlcommand executioncommunication protocolcowrie honeypotcowrie interactionscredential accesscredential stuffingdata exfiltrationdata store exposureddosdecoy systemdionaea honeypotdionaea interactionsdistributed attacksexploit attemptexploitation activityexploited hostfattfatt signaturesfin scanftpftp brute forcehackinghoneytrap honeypothoneytrap interactionshttp probinghttp scanneridentity & access exploitationindicatorinitial accessinjection activityintrusion detectionmailoney honeypotmailoney interactionsmalicious activitymalicious softwaremalwaremalware behaviourmalware capturemanualnetworknetwork intrusion attemptsnetwork intrusion detectionnetwork probingnetwork scanningnetwork securitynull scanoceaniap0fp0f passive fingerprintingp0f signaturespassword attacksphishingphishing attackphishing trapprocess injectionprotocol exploitationreconnaissanceremote accessremote servicesresearchedresource hijackingscannerscanning activitysecurity operationssensor-taggedsentrypeer botnetsentrypeer interactionsservice discoveryservice scansmtpsmtp probingsoftware exploitationssh attackssh monitoringsuricata alertssyn scant1018t1021t1021.001t1027t1040t1046t1055t1059t1071.001t1076t1078t1110t1110.001t1110.002t1110.003t1110.004t1190t1203t1486t1496t1499.001t1499.002t1499.003t1563t1565t1595t1595.001t1595.002t1595.003tannertanner interactionstelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencetor nodetpotudp port scanvoipvoip attackweb trafficxmas scan
Activity Timeline
Jun 9Jun 9
Threat Activity Heatmap
· Peak: 2026-06-09LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
40
SIGNAL
Signal Score
40%
Confidence
5
Reports
First seenSep 25, 2023
Last seenJun 9, 2026
GeolocationAU
CountryAustralia
LocationSydney, New South Wales
ASNAS31898
OrgOracle Cloud Infrastructure (ap-sydney-1)
Coords-33.8688, 151.2090
VirusTotal
Not checked
WHOIS
- description
- Port Scan 2024-10-01T00:10:01.000Z -> 152.67.120.34 scanned port on one of our servers
- raw
- inetnum: 152.0.0.0 - 152.255.255.255 netname: ERX-NETBLOCK descr: Early registration addresses remarks: ------------------------------------------------------ remarks: Important: remarks: remarks: Networks in this range were allocated by InterNIC remarks: prior to the formation of Regional Internet remarks: Registries (RIRs): AfriNIC, APNIC, ARIN, LACNIC and RIPE NCC. remarks: remarks: Address ranges from this historical space have now remarks: been transferred to the appropriate RIR database.remarks: remarks: If your search has returned this record, it means the remarks: address range is not administered by APNIC. remarks: remarks: Instead, please search one of the following databases: remarks: remarks: - AfriNIC (Africa) remarks: website: http://www.afrinic.net/ remarks: command line: whois.afrinic.net remarks: remarks: - ARIN (Northern America) remarks: website: http://www.arin.net/ remarks: command line: whois.arin.net remarks: remarks: - LACNIC (Latin America and the Carribean) remarks: website: http://www.lacnic.net/ remarks: command line: whois.lacnic.net remarks: remarks: - RIPE NCC (Europe) remarks: website: http://www.ripe.net/ remarks: command line: whois.ripe.net remarks: remarks: For information on the Early Registration Transfer remarks: (ERX) project, see: remarks: remarks: http://www.apnic.net/db/erx remarks: remarks: ------------------------------------------------------ country: AU admin-c: IANA1-AP tech-c: IANA1-AP mnt-by: APNIC-HM mnt-lower: APNIC-HM status: ALLOCATED PORTABLE last-modified: 2015-08-28T00:31:18Z source: APNIC mnt-irt: IRT-APNIC-AP irt: IRT-APNIC-AP address: Brisbane, Australia e-mail: [email protected] abuse-mailbox: [email protected] admin-c: HM20-AP tech-c: NO4-AP auth: # Filtered remarks: APNIC is a Regional Internet Registry. remarks: We do not operate the referring network and remarks: are unable to investigate complaints of network abuse. remarks: For information about IRT, see www.apnic.net/irt remarks: [email protected] was validated on 2020-02-03 mnt-by: APNIC-HM last-modified: 2023-08-18T00:42:38Z source: APNIC role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-AP tech-c: IANA1-AP nic-hdl: IANA1-AP remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: MAINT-APNIC-AP last-modified: 2018-06-22T22:34:30Z source: APNIC
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 2 years ago · Last seen 13 days ago
Appeared in 5 threat reports