IPMediumSignal 50/100
180.95.238.209
Location
ChinaLanzhou, Gansu
ASN
AS4837
China Unicom Gansu Province Network
First Seen
Aug 23, 2021
Last Seen
Jun 6, 2026
Aug 23
First Seen
1753d ago
Jun 6
Last Seen
5d ago
12
Reports
source reports
50%
Confidence
medium
1/91
VirusTotal
detections
Found in 12 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
50%
Signal Score
50 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryChina
ChinaRegionLanzhou, Gansu
ASNAS4837
OrganizationChina Unicom Gansu Province Network
Feed Intelligence Summary
12 reports50% confidence
12
Source reports
50%
Confidence score
Category tags
abuseactive scanactive scanningaptasiaattackaustraliabad reputationbad web botbankingbotnetbotnet activitybrute forcebrute force attackbrute-forcebrute-force attackbruteforcechinaciscocisco devicecisco exploitation attemptscncommand and controlcommunication protocolcommunication technologiescowriecowrie honeypotcowrie interactionscredential accesscredential harvestingcredential stuffingcredit card servicesdata exfiltrationdata store exposureddosdecoy systemdenial of servicedevice managementdionaeadionaea honeypotdistributed attacksemailenterprise networkingexploitexploit attemptexploitationexploitation activityexploited hostfattfinancefinance and insurancefinancial servicesfinancial technologyftpftp brute forcehackinghoneytrap datahoneytrap honeypothttp scannerhttp scanninghttpsidentity & access exploitationindicatorinfrastructure acquisitionreconnaissanceinjection activityintrusion detectionlamplamp stack attacklamp stack targetinglamp vulnerability scanlateral movementmailoney honeypotmalicious activitymalicious login attemptsmalicious softwaremalwaremalware behaviourmalware capturemalware propagationmanualmobile carriersmobile networksnetworknetwork attacksnetwork discoverynetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork probingnetwork protocolnetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisoceaniap0fpassword attackpassword attackspayment processingphishingphishing attackphishing trapportscanpossible mirai variantprobingprocess injectionprotocol exploitationreconnaissanceremote accessremote servicesresearchedresource hijackingscannerscannersscanningscanning activitysensor-taggedsentrypeer botnetsentrypeer detectionservice scansftpsftp activitysftp attacksftp exploitation attemptsipsip brute forcesip scanningsmtpsocial engineeringsshssh attackssh monitoringt1021t1021.001t1040t1041t1046t1055t1059t1059.004t1071.001t1076t1078t1110t1110.001t1110.002t1110.003t1110.004t1187t1189t1190t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1555t1563t1565t1566.001t1566.002t1566.003t1566.004t1587.001t1590.001t1595t1595.001t1595.002t1595.003tannertcp protocoltelecom servicestelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencetor nodetpotudp port scanunauthorized accessvoipvoip attackvulnerability scanvultrwealth managementweb app attackweb application attackweb exploitationweb scannerweb trafficwebscanwebscanner
Activity Timeline
Jun 6Jun 6
Threat Activity Heatmap
· Peak: 2026-06-06LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
50
SIGNAL
Signal Score
50%
Confidence
12
Reports
First seenAug 23, 2021
Last seenJun 6, 2026
GeolocationCN
CountryChina
LocationLanzhou, Gansu
ASNAS4837
OrgChina Unicom Gansu Province Network
Coords34.7732, 113.7220
WHOIS
- description
- IPv4 hosts detected port scanning Vultr Melbourne (Australia) honeypot
- raw
- inetnum: 180.95.128.0 - 180.95.255.255 netname: UNICOM-GS descr: China Unicom Gansu province network descr: China Unicom descr: No.21,Ji-Rong Street, descr: Beijing 100032 country: CN admin-c: CH1302-AP tech-c: YH137-AP abuse-c: AC1718-AP status: ALLOCATED PORTABLE remarks: service provider remarks: -------------------------------------------------------- remarks: To report network abuse, please contact mnt-irt remarks: For troubleshooting, please contact tech-c and admin-c remarks: Report invalid contact via www.apnic.net/invalidcontact remarks: -------------------------------------------------------- mnt-by: APNIC-HM mnt-lower: MAINT-CNCGROUP-GS mnt-routes: MAINT-CNCGROUP-RR mnt-irt: IRT-CU-CN last-modified: 2025-01-22T13:16:40Z source: APNIC irt: IRT-CU-CN address: No.21,Financial Street address: Beijing,100033 address: P.R.China e-mail: [email protected] abuse-mailbox: [email protected] admin-c: CH1302-AP tech-c: CH1302-AP auth: # Filtered remarks: [email protected] was validated on 2025-02-24 mnt-by: MAINT-CNCGROUP last-modified: 2025-09-04T05:18:38Z source: APNIC role: ABUSE CUCN country: ZZ address: No.21,Financial Street address: Beijing,100033 address: P.R.China phone: +000000000 e-mail: [email protected] admin-c: CH1302-AP tech-c: CH1302-AP nic-hdl: AC1718-AP remarks: Generated from irt object IRT-CU-CN remarks: [email protected] was validated on 2025-02-24 abuse-mailbox: [email protected] mnt-by: APNIC-ABUSE last-modified: 2025-02-24T06:17:45Z source: APNIC person: ChinaUnicom Hostmaster nic-hdl: CH1302-AP e-mail: [email protected] address: No.21,Jin-Rong Street address: Beijing,100033 address: P.R.China phone: +86-10-66259764 fax-no: +86-10-66259764 country: CN mnt-by: MAINT-CNCGROUP last-modified: 2017-08-17T06:13:16Z source: APNIC person: yun hu nic-hdl: YH137-AP e-mail: [email protected] address: 5/F Kaida Building 88 Qingyang Road Chengguan District,Lanzhou 730000,P.R. China phone: +86-931-2162064 fax-no: +86-931-2190000 country: CN mnt-by: MAINT-CNCGROUP-GS last-modified: 2008-09-04T07:30:40Z source: APNIC route: 180.95.128.0/17 descr: China Unicom Gansu Province Network country: CN origin: AS4837 mnt-by: MAINT-CNCGROUP-RR last-modified: 2009-08-06T06:39:25Z source: APNIC
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 4 years ago · Last seen 5 days ago
Appeared in 12 threat reports