IPMediumSignal 57/100
204.76.203.210
Location
United StatesEygelshoven, Limburg
ASN
AS51396
Intelligence Hosting LLC
First Seen
Jan 29, 2025
Last Seen
Jun 12, 2026
Found in 30 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
57%
Signal Score
57 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionEygelshoven, Limburg
ASNAS51396
OrganizationIntelligence Hosting LLC
IP Category
⟲
Proxy
Proxy server
⊕
VPN
VPN exit node
Feed Intelligence Summary
30 reports57% confidence
30
Source reports
57%
Confidence score
Category tags
abuseabuse detectionaccess controlaccount compromiseactive scanactive scanningadbhoney honeypotaerospace & defenseanonymity network abuseapacheapache attackeraptasiaattackattacker ipattacker-ipaustraliaauthentication attemptsautomated attack attemptsbad reputationbad web botbankingblacklist activityblacklist ipblocklist_allblog spambotnetbotnet activitybrute forcebrute force attackbrute force attemptsbrute-forcebruteforcec2canadaciscocisco asacisco brute forcecisco devicecisco exploitation attemptcisco exploitation attemptscloud infrastructurecloud infrastructure attackcloud servicescode executioncode injectioncommand & controlcommand and controlcommand executioncommand injectioncommunication protocolcommunication technologiescompromised credentialscompromised hostconsumer goodscowriecowrie honeypotcowrie ssh attackcredential accesscredential harvestingcredential stuffingcredential theftcredential-accesscredit card servicescvedata encryptiondata exfiltrationdata store exposuredatabase attackdatabase securityddosddos attackddos attacksddos reflectiondecoy systemdefensedefense contractingdefense logisticsdefense systemsdefense technologydenial of servicedevice managementdhcpdhcp enumerationdigital oceandigitalocean ipdionaeadionaea honeypotdirectory traversaldistributed attackselasticsearchelasticsearch exploitation attemptsemailencryptionenterprise networkingenumerationeuropeexit node threatexploitexploitationexploitation activityexploited hostexploitsfattfinancefinance and insurancefinancial servicesfinancial technologyfrancefraudfraud detectionfraudulent activityftpftp brute forceftp brute-forcegermanyhackinghoneytrap datahoneytrap honeypothttp brute forcehttp scannerhttpsidentity & access exploitationimapimap brute forceindicatorinformation gatheringinformation technologyinfrastructure scanninginjection activityinjection attacksinternet of thingsintrusion detectioniociot botnetiot securityiot targetediot/ics attackipqsipv4it infrastructurejapanlamplamp exploitation attemptslamp stack targetinglamp vulnerability scanlateral movementldapldap enumerationlogin attacklogin attemptslogin_attemptmailoney attackmailoney honeypotmalicious activitymalicious emailmalicious email detectionmalicious ipmalicious network activitymalicious payloadmalicious payload detectionmalicious scanmalicious softwaremalwaremalware behaviourmalware capturemalware distributionmediamelbourne regionmemcached exploitation attemptsmilitary operationsmiraimirai botnetmobile carriersmobile networksmonthlymssqlmssql brute forcenational securitynetherlandsnetworknetwork activitynetwork attacksnetwork enumerationnetwork infrastructurenetwork monitoringnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnetwork-reconnaissancenetwork_activitynlnorth americantpntp amplification attackoceaniaopen proxyopenctioracleoracle brute forcep0fpassword attackpassword attackspayment processingphishingphishing attackphishing trapping of deathportscanpossible botnet nodepossible reconnaissancepostgrespostgresql brute forcepotential compromisepotential threat actorprocess injectionprotocol exploitationproxyproxy detectionproxy protocolqhoneypot activityransomwarerdprdp exploitationreconnaissancereconnaissance activityredisredis exploitation attemptsremote accessremote servicesresearchedresource hijackingretail tradescams & fraudscanscannerscanner ipscannersscanning activityscripting attackssecurity operationssecurity policysensor-taggedsentrypeer botnetsentrypeer detectionserver exploitationservice enumerationservice probingservice scansftpsftp attacksftp attackssipsip attackssip brute forcesip scanningsmbsmb scanningsmtpsmtp probingsnmpsocial engineeringsocks5socks5 proxy detectionsocradar honeypotsoftware developmentspamspammingsql injectionsshssh attackssh exploitationssh monitoringsynt1018t1021t1021.001t1021.002t1040t1041t1046t1055t1059t1059.003t1059.004t1059.005t1059.007t1071t1071.001t1076t1077t1078t1083t1110t1110.001t1110.002t1110.003t1110.004t1133t1189t1190t1195t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1505.004t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1567.001t1583t1589t1590t1592t1595t1595.001t1595.002t1595.003tannertargeting databasetcptcp protocoltcp scantelecom servicestelecommunicationstelnettelnet threatthreat actorthreat detectionthreat intelligencethreat preventiontortor detectiontor networktor nodetpottraffic anomalyudp port scanudp scanunauthorized accessunauthorized access attemptunited kingdomunited statesunknown threat actorvncvnc protocolvoidtrapvoipvoip attackvpnvpn detectionvpn ipvulnerability scanvultrvultr infrastructure targetedwealth managementweb app attackweb applicationweb application attackweb attackweb attacksweb exploit attemptweb exploitationweb spamweb trafficxss
Activity Timeline
Jun 12Jun 12
Threat Activity Heatmap
· Peak: 2026-06-12LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
57
SIGNAL
Signal Score
57%
Confidence
30
Reports
First seenJan 29, 2025
Last seenJun 12, 2026
GeolocationUS
CountryUnited States
LocationEygelshoven, Limburg
ASNAS51396
OrgIntelligence Hosting LLC
Coords37.7510, -97.8220
ProxyVPN
VirusTotal
Not checked
WHOIS
- raw
- inetnum: 204.75.230.0 - 204.76.255.255 netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK descr: IPv4 address block not managed by the RIPE NCC remarks: ------------------------------------------------------ remarks: remarks: For registration information, remarks: you can consult the following sources: remarks: remarks: IANA remarks: http://www.iana.org/assignments/ipv4-address-space remarks: http://www.iana.org/assignments/iana-ipv4-special-registry remarks: http://www.iana.org/assignments/ipv4-recovered-address-space remarks: remarks: AFRINIC (Africa) remarks: http://www.afrinic.net/ whois.afrinic.net remarks: remarks: APNIC (Asia Pacific) remarks: http://www.apnic.net/ whois.apnic.net remarks: remarks: ARIN (Northern America) remarks: http://www.arin.net/ whois.arin.net remarks: remarks: LACNIC (Latin America and the Carribean) remarks: http://www.lacnic.net/ whois.lacnic.net remarks: remarks: ------------------------------------------------------ country: EU # Country is really world wide admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED mnt-by: RIPE-NCC-HM-MNT created: 2025-07-08T14:17:14Z last-modified: 2025-07-08T14:17:14Z source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT created: 1970-01-01T00:00:00Z last-modified: 2001-09-22T09:31:27Z source: RIPE # Filtered
- references
- https://www.ipqualityscore.com/sample-ip-blacklist.txt, https://github.com/telekom-security/tpotce, https://jamesbrine.com.au/vultrparis-portscan-bruteforce-ip-list-2026-02-27/, https://jamesbrine.com.au, https://jamesbrine.com.au/vultrtokyo-portscan-bruteforce-ip-list-2026-02-26/, https://jamesbrine.com.au/vultrparis-portscan-bruteforce-ip-list-2026-02-26/, https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-02-26/, https://jamesbrine.com.au/digitaloceansingapore-portscan-bruteforce-ip-list-2026-02-26/, https://jamesbrine.com.au/digitaloceanlondon-portscan-bruteforce-ip-list-2026-02-26/, https://jamesbrine.com.au/digitaloceantoronto-portscan-bruteforce-ip-list-2026-02-26/, https://jamesbrine.com.au/digitaloceantoronto-portscan-bruteforce-ip-list-2026-02-25/, https://jamesbrine.com.au/digitaloceanlondon-portscan-bruteforce-ip-list-2026-02-25/, https://jamesbrine.com.au/digitaloceansingapore-portscan-bruteforce-ip-list-2026-02-25/, https://jamesbrine.com.au/vultrtokyo-portscan-bruteforce-ip-list-2026-02-25/, https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-02-25/, https://jamesbrine.com.au/vultrparis-portscan-bruteforce-ip-list-2026-02-25/, https://jamesbrine.com.au/digitaloceanlondon-portscan-bruteforce-ip-list-2026-02-24/, https://jamesbrine.com.au/vultrparis-portscan-bruteforce-ip-list-2026-02-24/, https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-02-24/, https://jamesbrine.com.au/vultrtokyo-portscan-bruteforce-ip-list-2026-02-24/, https://jamesbrine.com.au/digitaloceantoronto-portscan-bruteforce-ip-list-2026-02-24/, https://jamesbrine.com.au/digitaloceansingapore-portscan-bruteforce-ip-list-2026-02-24/, https://jamesbrine.com.au/digitaloceansingapore-portscan-bruteforce-ip-list-2026-02-22/, https://voidvendor.com/intel, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 11 days ago
Appeared in 30 threat reports