IPMediumSignal 41/100
187.72.139.28
Location
BrazilSão Paulo, Distrito Federal
ASN
AS16735
ALGAR TELECOM S/A
First Seen
May 22, 2025
Last Seen
Mar 28, 2026
Found in 16 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
41%
Signal Score
41 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryBrazil
BrazilRegionSão Paulo, Distrito Federal
ASNAS16735
OrganizationALGAR TELECOM S/A
Feed Intelligence Summary
16 reports41% confidence
16
Source reports
41%
Confidence score
Category tags
abuseaccess controlactive scanactive scanningasiaattackaustraliaauthentication attackbad reputationbad web botblacklisted ipbotnetbotnet activitybrazilbrute forcebrute force attackbrute force attemptc2command & controlcommand and controlcompromised hostcredential accesscredential stuffingdata exfiltrationdata store exposuredatabase securityddosddos attackdecoy systemdenial of servicedistributed attackseuropeexploitation activityexploited hostfinlandfranceftp brute forcegermanyhackinghoneynet connecthttp brute forceidentity & access exploitationindicatorinformation technologyinjection activityinjection attacksintrusion detectionit infrastructurelateral movementlogin attemptlogin enumerationmalaysiamalicious activitymalicious hostmalicious softwaremalwaremalware communicationnetworknetwork enumerationnetwork intrusionnetwork intrusion attemptnetwork intrusion detectionnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnorth americanoticeoceaniapassword attackpassword attackspolandprocess injectionprotocol exploitationransomwarereconnaissanceremote accessremote servicesresearchedscannerscannersscanning activitysecurity operationssecurity policyservice scansmb brute forcesmtp brute forcesocradar honeypotsoftware developmentsouth americassh attackt1003t1018t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1040t1046t1055t1059t1059.001t1059.003t1059.004t1068t1071t1071.001t1076t1078t1110t1110.001t1110.002t1110.003t1110.004t1133t1190t1203t1486t1496t1499.001t1499.002t1499.003t1563t1565t1573t1592t1595t1595.001t1595.002t1595.003tcp scantelnet threatthreat actorthreat intelligencethreat preventiontor nodetraffic anomalyudp scanunauthorized accessunauthorized access attemptunauthorized login attemptunited kingdomunited statesvulnerability scanweb application attackweb exploitation
Activity Timeline
Mar 28Mar 28
Threat Activity Heatmap
· Peak: 2026-03-28LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreMedium Risk
41
SIGNAL
Signal Score
41%
Confidence
16
Reports
First seenMay 22, 2025
Last seenMar 28, 2026
GeolocationBR
CountryBrazil
LocationSão Paulo, Distrito Federal
ASNAS16735
OrgALGAR TELECOM S/A
Coords-20.8336, -47.8408
VirusTotal
Not checked
WHOIS
- description
- List of SSH attacking IPs detected by Rimba Siber honeypot.
- raw
- % Copyright (c) Nic.br - Use of this data is governed by the Use and inetnum: 187.72.0.0/16 aut-num: AS16735 abuse-c: CST87 owner: ALGAR TELECOM S/A ownerid: 71.208.516/0001-74 responsible: Diretoria de Planejamento e Tecnologia country: BR owner-c: ALTSA49 tech-c: CNI15 inetrev: 187.72.139.0/24 nserver: nspar.ctbc.com.br nsstat: 20250920 AA nslastaa: 20250920 nserver: nssar.ctbc.com.br nsstat: 20250920 AA nslastaa: 20250920 created: 20090629 changed: 20130307 nic-hdl-br: ALTSA49 person: ALGAR TELECOM S/A e-mail: [email protected] country: BR created: 20140820 changed: 20250609 nic-hdl-br: CNI15 person: CTBC - N�cleo de Aministra��o de IPs e-mail: [email protected] country: BR created: 20060417 changed: 20250609 nic-hdl-br: CST87 person: Computer Security Incident Response Team e-mail: [email protected] country: BR created: 20051208 changed: 20141114
- references
- https://jamesbrine.com.au/bruteforce-ip-list-2025-08-27/, https://jamesbrine.com.au, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 2 months ago
Appeared in 16 threat reports