IOC Radar
IPMediumSignal 82/100

206.189.57.73

Location
GermanyGermany
Frankfurt am Main, HE
ASN
AS14061
DigitalOcean, LLC
First Seen
Jul 1, 2025
Last Seen
May 25, 2026
Jul 1
First Seen
362d ago
May 25
Last Seen
34d ago
20
Reports
source reports
82%
Confidence
medium
Found in 20 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
82%
Signal Score
82 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

34 techniques

Network Information

CountryDEGermany
RegionFrankfurt am Main, HE
ASNAS14061
OrganizationDigitalOcean, LLC

Feed Intelligence Summary

20 reports82% confidence
20
Source reports
82%
Confidence score
Category tags
abuseactive scanactive scanningapacheapache attackerattackbad reputationbad web botbotnetbotnet activitybrute forcebrute force attackbrute force attemptbrute force attemptsbrute-forcecommand and controlcowrie honeypotcredential accesscredential stuffingdata encryptiondata exfiltrationdata store exposuredatabase attackddosdedecoy systemdenial of servicedionaea honeypotdistributed attacksencryptionenumerationeuropeexploitationexploitation activityftpftp brute forcegermanyhackinghoneytrap honeypothttp scanninghttps scanningidentity & access exploitationimapimap attackindicatorinformation technologyinjection activityit infrastructurelamplamp stack attacklateral movementmalicious activitymalicious network activitymalicious softwaremalwaremalware behaviourmalware capturenetworknetwork protocolnetwork scanningnetwork securitynetwork service scanningodin-benignpassword attackspassword sprayingpossible botnet activitypotential malware uploadprocess injectionprotocol exploitationransomwarereconnaissanceremote accessresearchedsansscannerscripting attacksservice scansftp attacksmtpsmtp attackersocradar honeypotsoftware developmentssh attackssh monitoringt1021t1021.002t1021.004t1040t1041t1055t1059t1059.007t1068t1071.001t1077t1078t1078.001t1110t1110.001t1110.002t1110.003t1110.004t1133t1189t1190t1203t1204t1204.002t1486t1496t1499.001t1499.002t1499.003t1565t1595t1595.001t1595.002t1595.003targeting databasetelnet threatthreat actorthreat detectionthreat intelligencetor nodeverified-benignweb application attackweb attackweb exploitation

Activity Timeline

1 total obs
May 25May 25

Threat Activity Heatmap

· Peak: 2026-05-25
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
82
SIGNAL
Signal Score
82%
Confidence
20
Reports
First seenJul 1, 2025
Last seenMay 25, 2026
GeolocationDE
CountryGermany
LocationFrankfurt am Main, HE
ASNAS14061
OrgDigitalOcean, LLC
Coords50.1188, 8.6843

VirusTotal

Not checked

WHOIS

description
dionaea, heralding, malicious, ssh, sftp, cowrie, LAMP, honeytrap
raw
inetnum: 206.168.80.0 - 206.190.219.255 netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK descr: IPv4 address block not managed by the RIPE NCC remarks: ------------------------------------------------------ remarks: remarks: For registration information, remarks: you can consult the following sources: remarks: remarks: IANA remarks: http://www.iana.org/assignments/ipv4-address-space remarks: http://www.iana.org/assignments/iana-ipv4-special-registry remarks: http://www.iana.org/assignments/ipv4-recovered-address-space remarks: remarks: AFRINIC (Africa) remarks: http://www.afrinic.net/ whois.afrinic.net remarks: remarks: APNIC (Asia Pacific) remarks: http://www.apnic.net/ whois.apnic.net remarks: remarks: ARIN (Northern America) remarks: http://www.arin.net/ whois.arin.net remarks: remarks: LACNIC (Latin America and the Carribean) remarks: http://www.lacnic.net/ whois.lacnic.net remarks: remarks: ------------------------------------------------------ country: EU # Country is really world wide admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED mnt-by: RIPE-NCC-HM-MNT created: 2023-11-21T14:36:56Z last-modified: 2023-11-21T14:36:56Z source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT created: 1970-01-01T00:00:00Z last-modified: 2001-09-22T09:31:27Z source: RIPE # Filtered
references
https://github.com/telekom-security/tpotce

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 1 month ago
Appeared in 20 threat reports