IPMediumSignal 100/100
209.97.182.13
Location
United KingdomSlough, England
ASN
AS14061
DigitalOcean, LLC
First Seen
Nov 7, 2024
Last Seen
Feb 26, 2026
Found in 22 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited Kingdom
United KingdomRegionSlough, England
ASNAS14061
OrganizationDigitalOcean, LLC
Feed Intelligence Summary
22 reports99% confidence
22
Source reports
99%
Confidence score
Category tags
abuseaccess attemptaccess controlactive scanningapacheapplication layer protocolasiaatif feedattackaustraliaauthentication abuseauthentication attackauthentication attacksauthentication failureauthentication failuresauto-generated securityautomated attackautomated attacksbad web botbanlist feedbinary defenseblacklisted ipblock listbotnetbrute forcebrute force attackbrute force attemptbrute_forcechina mobilecloud computingcloud migrationcloud securitycloud storagecolumnscommand and controlcommunication protocolcompany limitedcowrie honeypotcredential accesscredential harvestingcredential stuffingcredential stuffing attemptscredential_accessctadata exfiltrationddosddos attackdecoy systemdenial of servicedenial-of-servicedistributed attacksenumerationeuropeexploitexploited hostexternal_scanfail2ban alertfail2ban blocked ipsfail2ban triggerfail2ban triggeredfailed authenticationfailed loginfailed login attemptsfinlandfirewall blockftpftp brute forcegame_servergbgb-originating traffichackinghk abusehandlerhong konghttp brute forcehttp scannerhttp scanningindicatorinformation technologyinfrastructure acquisitionreconnaissanceiocipv4it infrastructurelogin attacklogin attempt failureslogin attemptslogin failuremailmalicious activitymalicious softwaremalwaremalware distributionmanualmod securitymulti-cloud managementnetworknetwork attacksnetwork intrusionnetwork intrusion attemptsnetwork intrusion detectionnetwork layer protocolnetwork probingnetwork reconnaissancenetwork scannetwork scanningnetwork securitynetwork service scanningnetwork_reconnaissanceoceaniapassword attackspassword crackingpgp signphishing attackping of deathpotential intrusionprocess injectionreconnaissanceremote accessremote access attackremote access attemptsremote servicesresearchedscanscannerscanning activitysecurity alertsecurity monitoringsecurity operationssecurity policysmtpsmtp scanningsocial engineeringsocradar honeypotsoftware developmentssh attackssh monitoringstaging_servert1016t1021t1021.001t1021.004t1040t1046t1055t1059t1059.001t1059.004t1059.005t1071.001t1076t1078t1078.001t1078.002t1078.003t1078.004t1083t1110t1110.001t1110.002t1110.003t1110.004t1133t1190t1203t1486t1496t1499.001t1499.002t1499.003t1563t1565t1566.001t1566.002t1566.003t1587.001t1588t1589t1590.001t1592t1595t1595.001t1595.002t1595.003tcp protocoltcp scantelecommunicationsthreat actorthreat feedthreat intelligencethreat preventiontraffic anomaliesudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized access attemptsunited kingdomus abuseus nonevalid accountsvoipweb application attackweb application attacksweb exploitationweb loginweb spamweb traffic
Activity Timeline
Feb 26Feb 26
Threat Activity Heatmap
· Peak: 2026-02-26LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
22
Reports
First seenNov 7, 2024
Last seenFeb 26, 2026
GeolocationGB
CountryUnited Kingdom
LocationSlough, England
ASNAS14061
OrgDigitalOcean, LLC
Coords51.5085, -0.1257
VirusTotal
Not checked
WHOIS
- description
- Data Sources: https://feeds.dshield.org/feeds/topips.txt https://feeds.dshield.org/feeds/top10.txt https://feeds.dshield.org/feeds/block.txt https://feeds.dshield.org/feeds/daily_sources THIS IS NOT A BLOCKLIST! DATA IS UNFILTERED AND CONTAINS FALSE POSITIVES.
- raw
- inetnum: 209.92.68.0 - 209.99.255.255 netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK descr: IPv4 address block not managed by the RIPE NCC remarks: ------------------------------------------------------ remarks: remarks: For registration information, remarks: you can consult the following sources: remarks: remarks: IANA remarks: http://www.iana.org/assignments/ipv4-address-space remarks: http://www.iana.org/assignments/iana-ipv4-special-registry remarks: http://www.iana.org/assignments/ipv4-recovered-address-space remarks: remarks: AFRINIC (Africa) remarks: http://www.afrinic.net/ whois.afrinic.net remarks: remarks: APNIC (Asia Pacific) remarks: http://www.apnic.net/ whois.apnic.net remarks: remarks: ARIN (Northern America) remarks: http://www.arin.net/ whois.arin.net remarks: remarks: LACNIC (Latin America and the Carribean) remarks: http://www.lacnic.net/ whois.lacnic.net remarks: remarks: ------------------------------------------------------ country: EU # Country is really world wide admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED mnt-by: RIPE-NCC-HM-MNT created: 2025-05-14T13:30:13Z last-modified: 2025-05-14T13:30:13Z source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT created: 1970-01-01T00:00:00Z last-modified: 2001-09-22T09:31:27Z source: RIPE # Filtered
- references
- https://blog.edie.io/2020/04/30/diy-ip-threat-feed/, https://github.com/tankmek/threatfeed, https://redpiranha.net, https://raw.githubusercontent.com/ahamed-rizvan/IOCs/refs/heads/main/Malicous%20IP%20Address.txt, https://blocklist.greensnow.co/greensnow.txt, https://www.binarydefense.com/banlist.txt, https://lists.blocklist.de/lists/all.txt, https://rules.emergingthreats.net/blockrules/compromised-ips.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 3 months ago
Appeared in 22 threat reports