IPMediumSignal 100/100
185.167.96.146
Location
NetherlandsAmsterdam, North Holland
ASN
AS41436
Cloudwebmanage EU
First Seen
Oct 13, 2020
Last Seen
Aug 5, 2025
Found in 22 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryNetherlands
NetherlandsRegionAmsterdam, North Holland
ASNAS41436
OrganizationCloudwebmanage EU
Feed Intelligence Summary
22 reports99% confidence
22
Source reports
99%
Confidence score
Category tags
abuseaccessaccess controlaccount compromiseaccount securityackack scanactive scanningadbhoney honeypotadministrative accessapacheapache attackerapplication scanningattackauthentication failurebotnetbrute forcebrute force attackbrute force attacksbrute force attemptsc2certciscocisco attackcisco devicecisco device attackcisco device targetingcisco exploit attemptcisco exploitation attemptcisco exploitation attemptscitrix attack attemptcitrix brute forcecitrix exploitation attemptcitrix exploitation attemptscitrix securitycommand and controlcommunication protocolcompromise attemptcompromised credentialsconnectconnect scanconpotconpot emulationconpot honeypotcowriecowrie activitycowrie emulationcowrie honeypotcowrie interactionscowrie loginscredential accesscredential harvestingcredential stuffingdata exfiltrationdatabase attackdatabase probingdatabase securityddosddos attacksddos attemptdecoy systemdenial of servicedevice managementdictionary attackdionaeadionaea activitydionaea capturedionaea emulationdionaea honeypotdionaea interactionsdistributed attacksemailenterprise networkingenterprise securityenumerationenumeration attemptexploitexploit attemptexploitationexploitation of privilegeexternal scanfinfin port scanfin scanfirewall detectionfirewall probingftpftp brute forcegithubgroupsheralding activityhoneytrap emulationhoneytrap honeypothttp brute forcehttp probehttp scannerhttp scanninghttpshttps probehttps scanningicmpicmp scanics securityimap brute forceindicatorindustrial control systemsinformation gatheringinfrastructure acquisitionreconnaissanceinitial accessinternet of thingsintrusion detectioniot botnetiot/ics attacklamplamp attacklamp attack attemptlamp exploitationlamp exploitation attemptslamp stack attacklamp stack targetinglateral movementlogin attemptmail protocol attacksmailoney activitymailoney honeypotmalicious activitymalicious softwaremalicious_activitymalwaremalware attemptmalware behaviourmalware capturemalware hostingmanualmariadbmass port scanningmass scanningmasscanmasscan activitymassive port scanmassive scanningmirai botnetmysql brute forcenetworknetwork activitynetwork attacksnetwork discoverynetwork enumerationnetwork infrastructurenetwork intrusion attemptsnetwork mappingnetwork monitoringnetwork port scanningnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scannetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnlnmapnmap scannmap scan detectednorth americanull port scannull scanopen port detectionoperating systemoperating system detectionoperating system securityos detectionos fingerprintingpassword attackpassword attacksphishingphishing attackphishing trappop3 brute forcepossible malware distributionpossible malware probingpossible vulnerability probingpossible vulnerability scanpossible vulnerability scanningpotential attack vectorpotential exploit targetingpotential intrusion attemptpotential malware deploymentpotential reconnaissance activitypotential vulnerability assessmentpotential vulnerability exploitationpotential vulnerability scanningprivilege escalationprocess injectionprotocol exploitationpythonreconnaissancereconnaissance activityremote accessremote service exploitationremote servicesresearchedresource hijackingscanscannerscanning activityscriptscripting attackssecurity eventsecurity policysecurity probingsentrypeer activitysentrypeer botnetserver exploitationservice detectionservice discoveryservice enumerationservice version detectionsftpsftp access attemptssftp activitysftp attacksftp attemptsipsip scanningslugsmb scanningsmtpsmtp brute forcesmtp probingsocial engineeringsocradarsql injectionsql injection attemptsshssh attackssh monitoringstealthstealth scanstealth scan techniquessurface websweep scansynsyn port scansyn scant1016t1016.001t1018t1021t1021.001t1021.002t1021.004t1021.006t1040t1041t1046t1047t1048t1053t1053.005t1055t1057t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1065t1068t1069.001t1071t1071.001t1076t1078t1078.001t1078.004t1082t1083t1088t1110t1110.001t1110.002t1110.003t1110.004t1133t1134t1187t1189t1190t1199t1203t1204t1204.002t1210t1213t1486t1496t1499.001t1499.002t1499.003t1505.002t1539t1555t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1583t1583.001t1587.001t1588t1588.002t1588.004t1588.005t1589t1589.001t1589.002t1590.001t1595t1595.001t1595.002t1595.003t1608tannertanner activitytcptcp protocoltcp scantelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencethreat preventiontsecudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized access attemptsunauthorized login attemptunauthorized probingunited statesunsolicited network probeus sourceuser enumerationversion detectionvnc protocolvoipvoip attackvulnerability scanweb application attacksweb attackweb exploitationweb shell uploadweb trafficxmasxmas port scanxmas scanzmap
Activity Timeline
Aug 5Aug 5
Threat Activity Heatmap
· Peak: 2025-08-05LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
22
Reports
First seenOct 13, 2020
Last seenAug 5, 2025
GeolocationNL
CountryNetherlands
LocationAmsterdam, North Holland
ASNAS41436
OrgCloudwebmanage EU
Coords52.3675, 4.9041
VirusTotal
Not checked
WHOIS
- description
- Port Scan 2023-11-16T21:10:20.881Z -> 185.167.96.146 scanned port 7474 on one of our servers
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 5 years ago · Last seen 10 months ago
Appeared in 22 threat reports