IPMediumSignal 60/100
198.235.24.67
Location
United StatesSanta Clara, California
ASN
AS396982
Palo Alto Networks, Inc
First Seen
Apr 18, 2023
Last Seen
Jun 5, 2026
Found in 31 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
60%
Signal Score
60 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionSanta Clara, California
ASNAS396982
OrganizationPalo Alto Networks, Inc
IP Category
⟲
Proxy
Proxy server
⊕
VPN
VPN exit node
Feed Intelligence Summary
31 reports60% confidence
31
Source reports
60%
Confidence score
Category tags
abuseaccessaccess controlaccount compromiseaccount securityack scanactive scanactive scanningactor listadbadbhoney activityadbhoney attackadbhoney detectionadbhoney exploitationadbhoney honeypotadbhoney related activityadministrative accessapacheapache attackerapplication layer protocolaptasiaattackattack preparatoryattacker-ipaustraliaauthentication abuseauthentication attackauthentication attacksauthentication attemptsauthentication failureautomated attackautomated attacksautomated threatautomated-attackautomated_attackbad reputationbad web botbanner grabbing attemptblacklist candidateblacklist ipblock listblocklist_allblog spambotnetbotnet activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptbrute force attemptsbrute force ftpbrute force sshbrute-forcebrute_forcebrute_force_attackbruteforcec2 communicationc2 servercanadachinachina mobilecisco asacisco attackcisco attackscisco brute forcecisco devicecisco device attackcisco device attackscisco device scanningcisco device targetedcisco device targetingcisco exploitationcisco exploitation attemptcisco exploitation attemptscisco-device-targetingcisco_device_attackcitrix attack attemptcitrix exploitation attemptcitrix securitycloud environmentcloud infrastructurecloud infrastructure attackcloud providercloud servicescloud_infrastructurecode executioncolumnscommand & controlcommand and controlcommand executioncommand injectioncommand injection attemptcommunication protocolcommunication securitycompany limitedcompromise attemptcompromised credentialscompromised hostcompromised host indicatorscompromised hostscompromised system attemptcompromised system detectionconnectconnect scanconpotconpot activityconpot attackconpot exploitationconpot honeypotconpot ics attackconpot ics attackscowriecowrie activitycowrie attackcowrie attackscowrie capturecowrie datacowrie detectioncowrie honeypotcowrie interactioncowrie interactionscowrie logscowrie sshcowrie ssh attackcowrie ssh attackscowrie ssh honeypotcowrie ssh logscredential accesscredential attackcredential attackscredential brute forcecredential brute-forcingcredential compromise attemptcredential guessingcredential harvestingcredential stuffingcredential-stuffingcredential_accesscredential_stuffingcvedata encryptiondata exfiltrationdata exfiltration attemptdata harvestingdata store exposuredata theftdatabase attackdatabase attacksdatabase exploitationdatabase probedatabase probingdatabase scandatabase securitydatabase targeteddatabase_serverdcom exploitationddosddos attackddos attack indicatorsddos attacksddos attemptddos preparationddos probedecoy systemdenial of servicedenial-of-servicedevice managementdictionary attackdictionary_attackdigital oceandionaeadionaea activitydionaea attackdionaea attack signaturesdionaea attacksdionaea capturedionaea detectiondionaea honeypotdionaea interactionsdionaea malware collectiondionaea malware detectiondionaea malware samplesdionaea payloadsdirectory traversaldirectory traversal attemptdistributed attacksdnsdns attackdropperelasticpot honeypotelasticsearch monitoringemailencryptionendpoint scanningenterprise networkingenterprise securityenumerationenumeration attempteu cyber policieseuropeexploitexploit attemptexploit attemptsexploit kit activityexploit probingexploit public-facing applicationexploit: web applicationexploitationexploitation activityexploitation attemptexploitation attemptsexploitation of privilegeexploitation of vulnerabilityexploitation_attemptexploited hostexternal access attemptsexternal network scanexternal remote servicesexternal scanexternal scanningexternal threatexternal-scanningfailed login attemptsfattfatt analysisfatt detectionsfatt signaturesfilefinfin scanfrancefraud voipftpftp attackftp attacksftp brute forceftp brute-forceftp scangithubgroupshackingheralding activityheralding scan activityhk abusehandlerhoneytrap activityhoneytrap datahoneytrap eventshoneytrap exploit attemptshoneytrap honeypothoneytrap interactionshong konghttp attackhttp brute forcehttp probinghttp request anomalieshttp scanhttp scannerhttp scanninghttp/shttpshttps scanningicmpics attackics securityics/scada attackidentity & access exploitationimapimap attackimap brute forceinbound scanindicatorindicators of compromiseindustrial control systemsinformation gatheringinfrastructure acquisitionreconnaissanceinfrastructure scanninginitial accessinitial_accessinitial_access_attemptinjection activityinjection attacksinput validationinternal scaninternet of thingsinternet-facinginternet-facing serviceinternet-wide monitoringinternet-wide observationinternet-wide scaninternet_scannersintrusion attemptintrusion detectioniociocsiot botnetiot device targetingiot exploitationiot securityiot targetediot/ics attackiot_attackipp honeyipphoney honeypotipv4ipv4 activityipv4 addressesipv4 threatsipv4_addressjapanknown malicious iplamplamp attacklamp attack attemptlamp attackslamp exploitlamp exploit attemptlamp exploit attemptslamp exploitationlamp exploitation attemptlamp exploitation attemptslamp server attacklamp server targetedlamp server targetinglamp stacklamp stack attacklamp stack attackslamp stack exploitationlamp stack targetinglamp vulnerability scanlamp_stack_attacklateral movementlcialinux serverslinux system targetinglinux systemslinux-server-attacklinux-server-targetinglinux_server_attacksload balancerloginlogin attemptlogin attemptsmail service attackmailoney activitymailoney attackmailoney detectionmailoney email spoofingmailoney eventsmailoney honeypotmailoney indicatorsmailoney interactionsmailoney relatedmalaysiamalicious activitymalicious activity detectedmalicious emailmalicious email activitymalicious email detectionmalicious file transfermalicious infrastructuremalicious ipmalicious ip detectedmalicious login attemptsmalicious network activitymalicious payloadmalicious payload attemptmalicious payload detectionmalicious scanmalicious sftp activitymalicious softwaremalicious ssh activitymalicious trafficmalicious-login-attemptsmalicious_trafficmalwaremalware analysismalware attemptmalware behaviourmalware capturemalware deliverymalware delivery attemptmalware detectionmalware distributionmalware distribution attemptmalware downloadmalware hostingmalware propagationmalware_activitymanualmass scanning activitymasscan activitymassive port scanmelbourne regionmicrosoft technologiesmiraimirai botnetmisp threatmobilemobile securitymonthlymssqlmultiple port scanmysql brute forcenetbiosnetworknetwork activitynetwork attacksnetwork discoverynetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork logonnetwork mappingnetwork monitoringnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scannetwork scanningnetwork securitynetwork service discoverynetwork service exploitationnetwork service scanningnetwork servicesnetwork traffic analysisnetwork-based attack attemptsnetwork-reconnaissancenetwork_enumerationnetwork_intrusionnetwork_reconnaissancenetwork_scanningnetworkscanningnmap scannmap scan detectednorth americanull scanoceaniaopen port detectionopen port discoveryopen proxyopen threatopencanaryoperating systemoperating system securityos detectionos fingerprintingosint enrichmentotx pulsenametip0fp0f network fingerprintingp0f os fingerprintingp0f passive fingerprintingp0f signaturespaloaltonetwors_com-benignpassword attackpassword attackspassword crackingpassword sprayingperimeter securitypgp signphishingphishing attackphishing trapphp exploitping of deathpinyinpla unitpop3 attackpop3 brute forceport-scanningportscanpossible botnet activitypossible exploit attemptpossible exploit attemptspossible malware activitypossible malware deploymentpossible malware distributionpossible malware dropperpossible malware propagationpossible mirai variantpossible vulnerability probingpossible vulnerability scanningpotential botnetpotential botnet activitypotential compromisepotential exploit activitypotential exploit targetingpotential intrusionpotential intrusion attemptpotential malicious activitypotential malware deliverypotential malware deploymentpotential malware distributionpotential malware downloadpotential reconnaissance activitypotential threat activitypotential vulnerability exploitationpotential vulnerability probingpotential vulnerability scanprivilege escalationprocess injectionprotocol abuseprotocol exploitationprotocol-abuseproxyproxy protocolpublic cloud targetingpythonransomwareransomware activityraspberry-pircerdp attacksrdp scanrdp scanningreconnaissancereconnaissance activityreconnaissance-activitiesredisredis exploit attemptredis exploitationredis exploitation attemptredis exploitation attemptsredis honeypotredis honeypot activityredishoneypot activityregional securityremote accessremote access abuseremote access attackremote access attemptsremote serviceremote service exploitationremote service interactionremote servicesremote_access_serviceresearchresearchedresource developmentresource hijackingrpcsansscams & fraudscanscannerscannersscanning activityscriptscripting attackssecurity eventsecurity operationssecurity policysensor-taggedsentrypeer activitysentrypeer botnetsentrypeer detectionsentrypeer eventssentrypeer exploitsentrypeer interactionssentrypeer p2p attackserver exploitationserver securityservice detectionservice discoveryservice enumerationservice probingservice scanservice scanningsftpsftp access attemptsftp access attemptssftp activitysftp attacksftp attackssftp attemptsftp attemptssftp intrusion attemptsftp probingsftp protocol abusesftp scanningsftp-attacksftp-brute-forceshell access attemptsshell upload attemptsingaporesipsip attackssip brute forcesip enumerationsip scansip scanningsip vulnerability scansip vulnerability scanningsip-scanningslugsmb attackssmtpsmtp attacksmtp attackersmtp attackssmtp brute forcesmtp probingsmtp scansmtp scanningsocial engineeringsoftware exploitationspamsql injectionsql injection attemptsql injection attemptssshssh attackssh attacksssh monitoringssh scanssh-brutessh-brute-forcestealth scansurface websuricata alertsuricata alertssynsyn scansystem accesst-pott1005t1016t1016.001t1018t1020t1021t1021.001t1021.002t1021.004t1021.006t1021.007t1021: remote servicest1027t1040t1040: network sniffingt1041t1046t1047t1048t1053t1053.005t1055t1057t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1064t1065t1068t1069.001t1071t1071.001t1071.002t1076t1077t1078t1078.001t1078.002t1078.003t1078.004t1078: valid accountst1083t1087t1088t1105t1110t1110.001t1110.002t1110.003t1110.004t1110: brute forcet1133t1187t1189t1190t1195t1199t1202t1203t1204t1204.002t1210t1213t1486t1496t1497.001t1498t1499.001t1499.002t1499.003t1505t1505.002t1505.004t1539t1550t1555t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1569t1572t1573t1573.001t1583t1583.001t1587.001t1588t1588.002t1589t1589.002t1590t1590.001t1590.004t1590.005t1590.006t1592t1592.002t1593t1595t1595.001t1595.002t1595.003t1595: active scanningt1608taiwantaiwan, province of chinatannertanner activitytanner attacktanner attack patternstanner detectiontanner eventstanner incidenttanner interactionstanner web attacktargeting databasetcptcp protocoltcp scantcp scanningtcp-scanningtcp/23tcp/3306telecommunicationstelnettelnet attackstelnet scantelnet threattelnet-brute-forcethreat actorthreat detectionthreat feedthreat intelligencethreat intelligence feedthreat preventionti advisorytokyotor nodetorontotpottpotcetsoctwudp port scanudp scanudp-scanningunattributed activityunauthenticated access attemptsunauthorized accessunauthorized access attemptunauthorized access attemptsunauthorized loginunauthorized login attemptsunauthorized network activityunauthorized-access-attemptunauthorized_access_attemptunit coverunited kingdomunited statesunknown actorunknown threat actorunsolicited port accessusus abuseus ip addressus nonevalid accountsverified-benignvnc protocolvoipvoip attackvoip systemsvpnvpn ipvulnerability scanvultrvultr infrastructure targetedvultr pariswafwebweb app attackweb application attackweb application attacksweb application probingweb application scanweb application scanningweb attackweb attacksweb exploitweb exploitationweb exploitsweb scannerweb server attacksweb server exploitationweb server targetedweb serversweb shellweb shell attemptweb shell detectionweb shell uploadsweb spamweb trafficweb-application-attackweb-application-attacksweb_attackweb_serverwindows system targetingwordpress attackwordpress targeted attacksxmasxmas scanxss
Activity Timeline
Jun 5Jun 5
Threat Activity Heatmap
· Peak: 2026-06-05LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
60
SIGNAL
Signal Score
60%
Confidence
31
Reports
First seenApr 18, 2023
Last seenJun 5, 2026
GeolocationUS
CountryUnited States
LocationSanta Clara, California
ASNAS396982
OrgPalo Alto Networks, Inc
Coords37.3833, -121.9830
ProxyVPN
VirusTotal
Not checked
WHOIS
- description
- IPv4 hosts detected port scanning DigitalOcean Toronto (CA) honeypot
- raw
- NetRange: 198.235.24.0 - 198.235.24.255 CIDR: 198.235.24.0/24 NetName: PAN-22 NetHandle: NET-198-235-24-0-1 Parent: NET198 (NET-198-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Palo Alto Networks, Inc (PAN-22) RegDate: 2021-12-20 Updated: 2021-12-20 Ref: https://rdap.arin.net/registry/ip/198.235.24.0 OrgName: Palo Alto Networks, Inc OrgId: PAN-22 Address: Palo Alto Networks Address: 3000 Tannery Way Address: Santa Clara, CA 95054 City: Santa Clara StateProv: CA PostalCode: 95054 Country: US RegDate: 2017-11-22 Updated: 2024-11-25 Ref: https://rdap.arin.net/registry/entity/PAN-22 OrgAbuseHandle: IPABU42-ARIN OrgAbuseName: IP Abuse OrgAbusePhone: +1-408-753-4000 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/IPABU42-ARIN OrgTechHandle: GNS20-ARIN OrgTechName: Global Network Services OrgTechPhone: +1-408-753-4000 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/GNS20-ARIN
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 3 years ago · Last seen 8 days ago
Appeared in 31 threat reports