IOC Radar
IPMediumSignal 75/100

159.223.17.100

Location
GermanyGermany
Frankfurt am Main, Hesse
ASN
AS14061
DigitalOcean, LLC
First Seen
Mar 13, 2026
Last Seen
May 28, 2026
Mar 13
First Seen
104d ago
May 28
Last Seen
28d ago
10
Reports
source reports
75%
Confidence
medium
Found in 10 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
75%
Signal Score
75 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

18 techniques

Network Information

CountryDEGermany
RegionFrankfurt am Main, Hesse
ASNAS14061
OrganizationDigitalOcean, LLC

Feed Intelligence Summary

10 reports75% confidence
10
Source reports
75%
Confidence score
Category tags
abuseaccount compromiseactive scanactive scanningattackaustraliabad reputationblocklist_allbotnetbotnet activitybrute forcebrute force attackcloud infrastructurecloud infrastructure attackcloud servicescommunication protocolcowriecowrie honeypotcredential accesscredential stuffingdata store exposuredatabase attackddosdedecoy systemdenial of servicedionaeadionaea honeypoteuropeexploitation activityfattftpgermanyhackinghoneytrap honeypothttp scanneridentity & access exploitationmailoney honeypotmalicious activitymalwaremalware behaviourmalware capturenetworknetwork intrusion attemptsnetwork scanningnetwork securitynorth americaoceaniap0fpassword attacksphishingphishing attackphishing trapportscanprotocol exploitationproxyreconnaissanceresearchedresource hijackingsansscannerscannerssensor-taggedsentrypeer botnetservice scansmtpssh attackssh monitoringsystem accesst1021t1040t1071.001t1078t1110.001t1110.002t1110.003t1110.004t1133t1190t1203t1496t1499.001t1499.002t1595t1595.001t1595.002t1595.003tannertargeting databasetelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencetor nodetpotunited statesvoipvoip attackvultrweb application attackweb exploitweb exploitationweb traffic

Activity Timeline

1 total obs
May 28May 28

Threat Activity Heatmap

· Peak: 2026-05-28
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
75
SIGNAL
Signal Score
75%
Confidence
10
Reports
First seenMar 13, 2026
Last seenMay 28, 2026
GeolocationDE
CountryGermany
LocationFrankfurt am Main, Hesse
ASNAS14061
OrgDigitalOcean, LLC
Coords37.7510, -97.8220

VirusTotal

Not checked

WHOIS

raw
NetRange: 159.223.0.0 - 159.223.255.255 CIDR: 159.223.0.0/16 NetName: DO-13 NetHandle: NET-159-223-0-0-1 Parent: NET159 (NET-159-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: DigitalOcean, LLC (DO-13) RegDate: 2020-11-03 Updated: 2020-11-03 Ref: https://rdap.arin.net/registry/ip/159.223.0.0 OrgName: DigitalOcean, LLC OrgId: DO-13 Address: 105 Edgeview Drive, Suite 425 City: Broomfield StateProv: CO PostalCode: 80021 Country: US RegDate: 2012-05-14 Updated: 2025-04-11 Ref: https://rdap.arin.net/registry/entity/DO-13 OrgNOCHandle: NOC32014-ARIN OrgNOCName: Network Operations Center OrgNOCPhone: +1-646-827-4366 OrgNOCEmail: [email protected] OrgNOCRef: https://rdap.arin.net/registry/entity/NOC32014-ARIN OrgAbuseHandle: DIGIT19-ARIN OrgAbuseName: DigitalOcean Abuse OrgAbusePhone: +1-646-827-4366 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/DIGIT19-ARIN OrgTechHandle: NOC32014-ARIN OrgTechName: Network Operations Center OrgTechPhone: +1-646-827-4366 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/NOC32014-ARIN
references
https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-03-29/, https://jamesbrine.com.au

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 3 months ago · Last seen 28 days ago
Appeared in 10 threat reports