IOC Radar
IPMediumSignal 44/100

154.90.39.229

Location
MalaysiaMalaysia
Kuala Lumpur, Kuala Lumpur
ASN
AS138915
Lightnode Limited
First Seen
Feb 16, 2025
Last Seen
Apr 6, 2026
Feb 16
First Seen
480d ago
Apr 6
Last Seen
66d ago
8
Reports
source reports
44%
Confidence
medium
Found in 8 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
44%
Signal Score
44 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

31 techniques

Network Information

CountryMYMalaysia
RegionKuala Lumpur, Kuala Lumpur
ASNAS138915
OrganizationLightnode Limited

Feed Intelligence Summary

8 reports44% confidence
8
Source reports
44%
Confidence score
Category tags
active scanaptasiaasyncratbotnetbotnet activitybrute forcec2cobaltstrikecommand & controlcommand and controlcredential harvestingcredential stuffingdanabotdata exfiltrationdata store exposuredeimosdistributed attacksexploitation activityhak5_cloud_c2havocidentity & access exploitationindicatorinfrastructure acquisitionreconnaissanceinjection activityiocmalaysiamalicious softwaremalwaremanualmymythicnetsupportratnetworknorth americaopen source intelligenceosintphishingphishing attackprocess injectionransomwareremcos trojanremote accessremote servicesresearchedsliversocial engineeringsupershellt1005t1016t1021.001t1027t1036t1053t1055t1059t1059.003t1071t1071.001t1078t1083t1105t1189t1190t1204t1486t1496t1499.002t1499.003t1547t1565t1566t1566.001t1566.002t1566.003t1573t1587.001t1590.001t1598threat actorthreat intelligencetor nodeunited states

Activity Timeline

1 total obs
Apr 6Apr 6

Threat Activity Heatmap

· Peak: 2026-04-06
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreMedium Risk
44
SIGNAL
Signal Score
44%
Confidence
8
Reports
First seenFeb 16, 2025
Last seenApr 6, 2026
GeolocationMY
CountryMalaysia
LocationKuala Lumpur, Kuala Lumpur
ASNAS138915
OrgLightnode Limited
Coords37.7510, -97.8220

VirusTotal

Not checked

WHOIS

raw
inetnum: 154.0.0.0 - 154.255.255.255 netname: ERX-NETBLOCK descr: Early registration addresses remarks: ------------------------------------------------------ remarks: Important: remarks: remarks: Networks in this range were allocated by InterNIC remarks: prior to the formation of Regional Internet remarks: Registries (RIRs): AfriNIC, APNIC, ARIN, LACNIC and RIPE NCC. remarks: remarks: Address ranges from this historical space have now remarks: been transferred to the appropriate RIR database.remarks: remarks: If your search has returned this record, it means the remarks: address range is not administered by APNIC. remarks: remarks: Instead, please search one of the following databases: remarks: remarks: - AfriNIC (Africa) remarks: website: http://www.afrinic.net/ remarks: command line: whois.afrinic.net remarks: remarks: - ARIN (Northern America) remarks: website: http://www.arin.net/ remarks: command line: whois.arin.net remarks: remarks: - LACNIC (Latin America and the Carribean) remarks: website: http://www.lacnic.net/ remarks: command line: whois.lacnic.net remarks: remarks: - RIPE NCC (Europe) remarks: website: http://www.ripe.net/ remarks: command line: whois.ripe.net remarks: remarks: For information on the Early Registration Transfer remarks: (ERX) project, see: remarks: remarks: http://www.apnic.net/db/erx remarks: remarks: ------------------------------------------------------ country: AU admin-c: IANA1-AP tech-c: IANA1-AP mnt-by: APNIC-HM mnt-lower: APNIC-HM status: ALLOCATED PORTABLE last-modified: 2015-08-28T00:31:22Z source: APNIC mnt-irt: IRT-APNIC-AP irt: IRT-APNIC-AP address: Brisbane, Australia e-mail: [email protected] abuse-mailbox: [email protected] admin-c: HM20-AP tech-c: NO4-AP auth: # Filtered remarks: APNIC is a Regional Internet Registry. remarks: We do not operate the referring network and remarks: are unable to investigate complaints of network abuse. remarks: For information about IRT, see www.apnic.net/irt remarks: [email protected] was validated on 2020-02-03 mnt-by: APNIC-HM last-modified: 2023-08-18T00:42:38Z source: APNIC role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-AP tech-c: IANA1-AP nic-hdl: IANA1-AP remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: MAINT-APNIC-AP last-modified: 2018-06-22T22:34:30Z source: APNIC
references
https://x.com/drb_ra/status/1891016305198747921, https://x.com/drb_ra/status/1891017174770184687, https://x.com/drb_ra/status/1891017249500053673, https://x.com/drb_ra/status/1891017269569818740, https://x.com/drb_ra/status/1891017289828303055, https://x.com/drb_ra/status/1891017310820819437, https://x.com/drb_ra/status/1891017331628732530, https://x.com/drb_ra/status/1891017866213732864, https://x.com/drb_ra/status/1891017884152836511, https://x.com/drb_ra/status/1891017901999587834, https://x.com/drb_ra/status/1891017920152543437, https://x.com/drb_ra/status/1891017936187314637, https://x.com/drb_ra/status/1891017954663293308, https://x.com/drb_ra/status/1891017971310436357, https://x.com/drb_ra/status/1891017990449041598, https://x.com/drb_ra/status/1891018008178340314, https://x.com/drb_ra/status/1891018027753161109, https://x.com/drb_ra/status/1891018047617393053, https://x.com/drb_ra/status/1891018067812982914, https://x.com/drb_ra/status/1891018087232606497, https://x.com/drb_ra/status/1891018106706763796, https://x.com/drb_ra/status/1891018127166599456, https://x.com/drb_ra/status/1891018147848716625, https://x.com/drb_ra/status/1891018164848226599, https://x.com/drb_ra/status/1891018184188100623, https://x.com/drb_ra/status/1891018203129692285, https://x.com/drb_ra/status/1891018220024263032, https://x.com/drb_ra/status/1891082429927989389, https://x.com/drb_ra/status/1891082449213345932, https://x.com/drb_ra/status/1891082468507136162, https://x.com/drb_ra/status/1891082487796732110, https://x.com/drb_ra/status/1891082508025950520, https://x.com/drb_ra/status/1891082525793046735, https://x.com/drb_ra/status/1891083044192166121, https://x.com/drb_ra/status/1891197305178526130, https://x.com/drb_ra/status/1891197322261868885, https://x.com/drb_ra/status/1891197356898471980, https://x.com/drb_ra/status/1891197375303004435, https://x.com/drb_ra/status/1891197393829319064, https://x.com/drb_ra/status/1891197410174476622, https://x.com/drb_ra/status/1891197926736544062, https://x.com/drb_ra/status/1891197944558198983, https://x.com/drb_ra/status/1891197962216202751, https://x.com/drb_ra/status/1891197980390072434, https://x.com/drb_ra/status/1891197996429152463, https://x.com/drb_ra/status/1891198015521636781, https://x.com/drb_ra/status/1891198032181412327, https://x.com/drb_ra/status/1891198051701739652, https://x.com/drb_ra/status/1891198070253092880, https://x.com/drb_ra/status/1891233969477194100, https://x.com/drb_ra/status/1891233988531880366, https://x.com/drb_ra/status/1891264768020807874

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 2 months ago
Appeared in 8 threat reports