IPMediumSignal 59/100
185.142.236.35
Location
NetherlandsAmsterdam, North Holland
ASN
AS12989
BlackHOST Ltd.
First Seen
Aug 26, 2020
Last Seen
Jun 18, 2026
Found in 40 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
59%
Signal Score
59 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryNetherlands
NetherlandsRegionAmsterdam, North Holland
ASNAS12989
OrganizationBlackHOST Ltd.
Feed Intelligence Summary
40 reports59% confidence
40
Source reports
59%
Confidence score
Category tags
abuseaccessaccess attemptaccess controlaccount compromiseackack scanactionactive scanactive scanningadbhoney activityadbhoney honeypotamerican expressamerican express companyapplication layer protocolaptatif feedattachment phishingattackauthentication attemptsauthentication brute forceauto-generated securityautomated emailbad reputationbad web botbanlist feedbase64base64 encodingbecbeningbening scannerbinary defenseblacklist candidateblacklisted ipbotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute force attemptsbrute-forcebrute_forcebulk emailciscocisco devicecisco device scanningcisco device targetedcisco exploitation attemptcisco exploitation attemptscitrix securitycommand and controlcommand injectioncommunication protocolcommunication securitycompromised credentials attemptconfigconnectconnect scanconpotconpot activityconpot honeypotconpot ics attackcowriecowrie activitycowrie attackcowrie honeypotcowrie interactionscowrie sshcowrie ssh attackcredential accesscredential harvestingcredential phishingcredential stuffingcrypto currencycryptocurrencyctacyber securitycyber threatsdata encryptiondata exfiltrationdata store exposuredatabase brute forcedatabase securityddosddos attackddos attacksddos attemptdecoy systemdenialdenial of servicedevice managementdictionary attackdionaeadionaea activitydionaea attackdionaea honeypotdionaea malware detectiondirectory traversaldistributed attackselasticpot dataelasticpot honeypotelasticsearch monitoringemailencryptionenterprise networkingenterprise securityenumerationenumeration activityenumeration attempteuropeexecutable fileexploit attemptsexploit probingexploit: web applicationexploitation activityexploitation of privilegeexploitation of vulnerabilityexternal scanfinfin scanfinancefinance and insurancefinancial servicesfirewall detectionfirewall probingftp brute forceftp scanfull connect scangithubglobalgroupshackingheralding activityhoneytrap activityhoneytrap honeypothttphttp brute forcehttp request anomalieshttp scannerhttp scanninghttps scanninghuaweiicmpicmp scanics securityidentity & access exploitationids evasionindexindicatorindustrial control systemsinfoinformation gatheringinformation technologyinfrastructure acquisitionreconnaissanceinitial accessinjection activityinjection attacksinput validationinternal scaninternet of thingsintrusion detectioniosiot botnetiot securityiot/ics attackipphoney honeypotkfsensor honeypotlamplamp attacklamp exploitation attemptslamp server targetlamp stack attacklamp stack targetinglatamlateral movementlinuxload balancerloginlogin attackmac osmailoney activitymailoney email spoofingmailoney honeypotmalicious activitymalicious login attemptsmalicious network activitymalicious payload detectionmalicious sftp activitymalicious sip activitymalicious softwaremalicious ssh activitymalicious_activitymalicious_trafficmalwaremalware behaviourmalware capturemalware detectionmalware distributionmalware distribution attemptmalware distribution attemptsmalware hostingmalware propagationmalware related activitymanualmass scanningmasscanmassive port scanmdatp commandmirai botnetmobile threatnation-state activitynetherlandsnetworknetwork attacksnetwork discoverynetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptsnetwork intrusion detectionnetwork mappingnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnetwork_intrusionnlnmapnorth americanull scanopen port detectionopen portsos detectionos fingerprintingpasswordpassword attackpassword attackspassword crackingpassword theftpayment fraudphishingphishing attackphishing campaignphishing trappingpossible exfiltrationpossible exploit attemptpossible malicious activitypossible reconnaissance activitypossible vulnerability probingpotential attack vectorpotential credential compromisepotential exploit attemptpotential intrusion attemptpotential malware deploymentpotential malware distributionpotential threat activitypotential vulnerability assessmentpotential vulnerability exploitationpotential vulnerability probingpotential vulnerability scanpotential vulnerability scanningprice requestprice request scamprobing activityprocess injectionprotocol exploitationprotocol scanpublicly exposed databasepythonransomwarereconnaissancereconnaissance activityredis honeypotredishoneypotredishoneypot activityremote accessremote access attemptsremote servicesresearchedresource hijackingsansscams & fraudscanscannerscanning activityschedule themescheduled task abusescriptscripting attackssecurity operationssecurity policysecurity probingsentrypeer activitysentrypeer botnetsentrypeer p2p attackserverserver exploitationserviceservice detectionservice discoveryservice enumerationservice scanservice version detectionseychellessftpsftp access attemptsftp activitysftp attacksftp attackssftp attemptsftp scanningshodan_io-benignsipsip attackssip brute forcesip scansip scanningslugsmtp brute forcesmtp probingsocial engineeringsql injectionsshssh attackssh monitoringssh scanstealth scanstealth scan techniquessurface websweep scansynsyn scant1003t1003.001t1016t1016.001t1018t1021t1021.001t1021.002t1021.003t1021.004t1021.006t1040t1041t1046t1053t1055t1056.001t1059t1059.001t1059.003t1059.004t1059.007t1068t1071t1071.001t1076t1077t1078t1078.001t1078.002t1078.004t1083t1095t1102t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1134t1187t1189t1190t1192t1199t1203t1204t1204.002t1205t1205 traffict1210t1213t1486t1490t1496t1498t1498 networkt1499t1499 endpointt1499.001t1499.002t1499.003t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1573t1583t1587.001t1588t1588.002t1589t1589.001t1589.002t1590t1590.001t1592t1595t1595.001t1595.002t1595.003t1598t1598.003t1608ta0001 initialta0005 defenseta0040 impacttannertanner activitytanner attacktanner web attacktargeting databasetariff server compromisetariff server themetariffs servertcptcp protocoltcp scantcp scanningtcp/23telecommunicationtelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencethreat preventiontor nodetpotcetsecudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized access attemptsunauthorized loginunauthorized login attemptsunauthorized network activityunauthorized probingunited kingdomunited statesus source ipuser enumerationverified-benignvnc protocolvoipvoip attackvulnerability scanwafweb application attackweb attackweb exploitationweb scannerweb serviceweb shell uploadweb trafficwells fargo bankwestpac new zealandwetransfer abusewindowsxmasxmas scanxss
Activity Timeline
Jun 18Jun 18
Threat Activity Heatmap
· Peak: 2026-06-18LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
59
SIGNAL
Signal Score
59%
Confidence
40
Reports
First seenAug 26, 2020
Last seenJun 18, 2026
GeolocationNL
CountryNetherlands
LocationAmsterdam, North Holland
ASNAS12989
OrgBlackHOST Ltd.
Coords52.3702, 4.8952
VirusTotal
Not checked
WHOIS
- description
- HoneyNet Event: 185.142.236.35 connected: 1 times over ports: 49153 Tags: Suricata,49153
- raw
- inetnum: 185.142.236.0 - 185.142.236.255 netname: BlackHOST-CLOUD descr: Black.HOST CLOUD Network descr: Specially crafted and optimized for bandwidth hungry applications descr: Direct all copyright, legal, spam and abuse complaints to: descr: https://black.host/legal/abuse country: NL org: ORG-BLCK1-RIPE admin-c: ABUS-BH tech-c: SPRT-BH status: ASSIGNED PA mnt-by: BlackHOST-LTD created: 2016-03-29T13:14:40Z last-modified: 2025-06-23T18:55:42Z source: RIPE organisation: ORG-BLCK1-RIPE org-name: Black HOST Ltd. descr: descr: Take advantage of the best deal of bandwidth on the planet. descr: UNMETERED Dedicated & VPS Servers, Premium web & email hosting descr: Check out our offer on: https://black.host descr: language: EN org-type: OTHER address: Rue de Jargonnant 2, 1207 Geneva, Switzerland admin-c: CREW-BH abuse-c: ABUS-BH tech-c: SPRT-BH mnt-ref: BlackHOST-LTD mnt-by: BlackHOST-LTD created: 2016-03-08T13:27:08Z last-modified: 2021-02-19T09:18:08Z source: RIPE # Filtered role: BlackHOST Abuse Team address: Switzerland abuse-mailbox: [email protected] remarks: remarks: Direct all copyright, legal, spam and abuse complaints to: remarks: https://black.host/legal/abuse remarks: nic-hdl: ABUS-BH mnt-by: BlackHOST-LTD created: 2016-03-07T16:25:43Z last-modified: 2017-12-19T21:48:20Z source: RIPE # Filtered role: BlackHOST Support Team address: Switzerland nic-hdl: SPRT-BH mnt-by: BlackHOST-LTD created: 2016-03-08T21:06:19Z last-modified: 2016-03-12T13:38:04Z source: RIPE # Filtered
- references
- https://github.com/telekom-security/tpotce, C_C March-2025-04-03 13_46_36.669.csv, https://blocklist.greensnow.co/greensnow.txt, https://www.binarydefense.com/banlist.txt, https://lists.blocklist.de/lists/all.txt, https://rules.emergingthreats.net/blockrules/compromised-ips.txt, ip.src.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 5 years ago · Last seen 5 days ago
Appeared in 40 threat reports