IPMediumSignal 56/100
185.228.3.64
Location
United StatesLisbon, CA
ASN
AS206092
Turkbil
First Seen
Aug 5, 2024
Last Seen
May 11, 2026
Found in 5 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
56%
Signal Score
56 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionLisbon, CA
ASNAS206092
OrganizationTurkbil
IP Category
⟲
Proxy
Proxy server
⊕
VPN
VPN exit node
Feed Intelligence Summary
5 reports56% confidence
5
Source reports
56%
Confidence score
Category tags
active scanactive scanningadbhoney activityadbhoney honeypotattackaustraliabad web botbotnetbotnet activitybrute forcebrute force attackbrute force attemptsbrute-forcecommand and controlcommand injectioncommunication protocolcowrie activitycowrie attackcowrie honeypotcredential accesscredential harvestingcredential stuffingdata exfiltrationdata store exposureddosdecoy systemdenial of servicedionaea activitydionaea attackdionaea honeypotdistributed attacksdnsdns attackeuropeexploitexploitation activityfattftpftp brute forceftp brute-forcehackinghoneytrap activityhoneytrap honeypothttp scanneridentity & access exploitationinformation technologyinitial accessinjection activityiocit infrastructurelamplamp attacklamp stack attackmailoney activitymailoney honeypotmalicious activitymalicious softwaremalwaremalware behaviourmalware capturenetworknetwork intrusion attemptsnetwork scanningnetwork securitynorth americaoceaniaopen proxyp0fpassword attacksphishingphishing attackphishing trapprocess injectionprotocol exploitationproxyptreconnaissanceremote accessresearchedresource hijackingscannerscripting attackssensor-taggedsentrypeer activitysentrypeer botnetsftp activitysftp attacksip scanningsmtpsocial engineeringsoftware developmentspamssh attackssh monitoringt-pott1040t1041t1046t1055t1059t1059.004t1059.007t1071t1071.001t1078t1078.001t1078.004t1110t1110.001t1110.002t1110.003t1110.004t1190t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1565t1566.001t1566.002t1566.003t1566.004t1595t1595.001t1595.002t1595.003tannertanner attacktelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencetor nodetpottpotceunited statesvoipvoip attackvpnweb app attackweb application attackweb attackweb exploitationweb spamweb traffic
Activity Timeline
May 11May 11
Threat Activity Heatmap
· Peak: 2026-05-11LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreMedium Risk
56
SIGNAL
Signal Score
56%
Confidence
5
Reports
First seenAug 5, 2024
Last seenMay 11, 2026
GeolocationUS
CountryUnited States
LocationLisbon, CA
ASNAS206092
OrgTurkbil
Coords34.0544, -118.2440
ProxyVPN
VirusTotal
Not checked
WHOIS
- description
- 2025-02-09T01:21:18.546Z Honeypot : Tanner : Source: 185.228.3.64 : Port: 80 Post Data: {'version': '0.6.0', 'response': {'message': {'detection': {'version': '0.6.0', 'order': 1, 'name': 'index', 'type': 1}, 'sess_uuid': '32938f81-4716-4773-aea6-6ff3993dad4b'}}}
- raw
- No match found for natrohost.com.
- references
- https://github.com/telekom-security/tpotce
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 1 month ago
Appeared in 5 threat reports