IPMediumSignal 65/100
185.177.72.54
Location
FranceVélizy-Villacoublay, ENG
ASN
AS211590
FBW NETWORKS
First Seen
Aug 11, 2025
Last Seen
Jun 22, 2026
Found in 25 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
65%
Signal Score
65 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryFrance
FranceRegionVélizy-Villacoublay, ENG
ASNAS211590
OrganizationFBW NETWORKS
IP Category
⟲
Proxy
Proxy server
Feed Intelligence Summary
25 reports65% confidence
25
Source reports
65%
Confidence score
Category tags
abuseaccess controlactive scanactive scanningapacheapache attackeraptasiaattackauthentication attacksbad reputationbad web botblacklist activityblacklist ipblock listblocklist_allblog spambotnetbotnet activitybrute forcebrute force attackbrute force attemptsbrute force botbrute-forcec2 communicationchina mobileciscocisco devicecisco logscnccolumnscommand & controlcommand and controlcommand executioncommunication protocolcompany limitedcompromised hostscowriecowrie honeypotcowrie logscredential accesscredential harvestingcredential stuffingcredential stuffing botdata encryptiondata exfiltrationdata store exposuredatabase attackdatabase probingdatabase securityddosddos attackddos attemptddos botdecoy systemdenial of servicedevice managementdhcpdhcp scandionaeadionaea honeypotdionaea logsdistributed attackselasticsearchelasticsearch scanemailencryptionenterprise networkingenumerationeuropeexploitexploit kit activityexploitation activityexploited hostfattfrfrancefraud ordersftpftp brute forceftp brute-forcehackinghk abusehandlerhoneytrap honeypothong konghttp floodhttp scannerhttp scanningidentity & access exploitationimapimap brute forceindicatorinformation gatheringinjection activityinjection attacksiociot securitylamplamp attacklateral movementldapldap scanmail protocol abusemailoney honeypotmailoney logsmalicious activitymalicious softwaremalicious-ipmalwaremalware behaviourmalware botnet activitymalware capturemalware distributionmemcached scanmssqlmssql brute forcenetworknetwork attacksnetwork infrastructurenetwork intrusion attemptsnetwork monitoringnetwork probingnetwork protocolnetwork scanningnetwork securitynetwork traffic analysisntpntp scanoracleoracle brute forceoracle databasep0fpassword attackspgp signphishingphishing attackphishing trapping of deathpossible malware propagationpostgrespostgresql brute forceprocess injectionprotocol exploitationproxyransomwarereconnaissanceredisredis brute forceremote accessremote servicesresearchedresource hijackingscams & fraudscanscannerscanning activityscripting attackssecurity operationssecurity policysensor-taggedsentrypeer botnetsentrypeer logsserver exploitationsftpsftp attacksipsip brute forcesip scanningsmbsmb brute forcesmtpsmtp scanningsnmpsnmp scansocial engineeringsocks5socks5 proxysocradar honeypotspamspam botsql injectionsshssh attackssh monitoringt1005t1016t1016.001t1016.002t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1021.007t1029t1036t1036.005t1036.007t1036.009t1040t1041t1046t1047t1053t1053.005t1055t1057t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1068t1071t1071.001t1071.004t1077t1078t1078.001t1082t1083t1087t1087.001t1087.002t1087.003t1105t1110t1110.001t1110.002t1110.003t1110.004t1113t1123t1133t1187t1189t1190t1199t1202t1203t1204t1204.002t1210t1211t1485t1486t1489t1490t1492t1496t1497t1497.001t1497.002t1499.001t1499.002t1499.003t1505.004t1555t1562t1562.001t1562.004t1565t1566t1566.001t1566.002t1566.003t1566.004t1571t1572t1573t1573.001t1573.002t1574t1574.001t1574.002t1574.008t1583t1583.001t1583.002t1583.003t1583.004t1583.005t1583.006t1588t1588.001t1588.002t1588.003t1588.004t1590t1590.001t1590.002t1590.003t1590.004t1590.005t1592t1592.001t1592.002t1592.003t1592.004t1595t1595.001t1595.002t1595.003tannertanner logstargeting databasetcp floodtelecommunicationstelnettelnet threatthreat actorthreat detectionthreat feedthreat intelligencethreat preventiontor nodetpotturkeyunited kingdomus abuseus nonevncvnc protocolvnc scanvoipvoip attackvulnerability scanvulnerability-exploitationweb app attackweb application attackweb attackweb exploitationweb spamweb traffic
Activity Timeline
Jun 22Jun 22
Threat Activity Heatmap
LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
65
SIGNAL
Signal Score
65%
Confidence
25
Reports
First seenAug 11, 2025
Last seenJun 22, 2026
GeolocationFR
CountryFrance
LocationVélizy-Villacoublay, ENG
ASNAS211590
OrgFBW NETWORKS
Coords53.1472, -2.2314
Proxy
VirusTotal
Not checked
WHOIS
- description
- Score: 100/100. Labels: abuseipdb:brute-force, abuseipdb:critical, abuseipdb:ddos, abuseipdb:exploited-host, abuseipdb:ftp-brute, abuseipdb:hacking. IP observed in Suricata network metadata
- raw
- inetnum: 185.177.72.0 - 185.177.72.255 netname: FR-FBW-NETWORKS-20161110 country: FR org: ORG-FNS23-RIPE admin-c: RC21564-RIPE tech-c: RC21564-RIPE abuse-c: ACRO59630-RIPE status: ALLOCATED PA mnt-routes: fr-rogercabot-mnt mnt-routes: lir-fr-fbw-networks-1-MNT mnt-by: lir-fr-fbw-networks-1-MNT mnt-by: RIPE-NCC-HM-MNT created: 2025-05-27T08:17:11Z last-modified: 2025-05-30T08:12:55Z source: RIPE organisation: ORG-FNS23-RIPE org-name: FBW NETWORKS SAS country: FR org-type: LIR address: 16 rue Grange Dame Rose address: 78140 address: V�lizy Villacoublay address: FRANCE phone: +33184207217 admin-c: GML75-RIPE tech-c: GML75-RIPE abuse-c: AR65110-RIPE mnt-ref: lir-fr-fbw-networks-1-MNT mnt-ref: RELCOMGROUP-EXT-MNT mnt-by: RIPE-NCC-HM-MNT mnt-by: lir-fr-fbw-networks-1-MNT created: 2021-09-16T10:31:33Z last-modified: 2022-06-01T14:17:54Z source: RIPE # Filtered person: Roget Cabot address: Le rove phone: +336000000000 nic-hdl: RC21564-RIPE mnt-by: fr-rogercabot-mnt created: 2025-03-12T13:21:26Z last-modified: 2025-03-12T13:21:26Z source: RIPE route: 185.177.72.0/24 origin: AS211590 mnt-by: lir-fr-fbw-networks-1-MNT created: 2025-05-27T09:25:15Z last-modified: 2025-05-27T09:25:15Z source: RIPE
- references
- https://github.com/telekom-security/tpotce, https://feeds.dshield.org/feeds/topips.txt, https://feeds.dshield.org/feeds/top10.txt, https://feeds.dshield.org/feeds/block.txt, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 10 months ago · Last seen 4 days ago
Appeared in 25 threat reports