IPMediumSignal 32/100
216.180.246.171
Location
United StatesMassy, Île-de-France
ASN
AS396982
Google LLC
First Seen
Sep 6, 2025
Last Seen
Jun 14, 2026
Found in 21 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
32%
Signal Score
32 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionMassy, Île-de-France
ASNAS396982
OrganizationGoogle LLC
Feed Intelligence Summary
21 reports32% confidence
21
Source reports
32%
Confidence score
Category tags
abuseaccess attemptsaccess controlaccount compromiseactive scanactive scanningactor listaptasiaattackattacker ipattacker-ipattacking-ipsaustraliaautomated threatautomated-attackbad reputationbad web botbankingblacklist candidateblacklisted ip addressblog spambotnetbotnet activitybotnet activity detectedbotnet-activitybrute forcebrute force attackbrute force attacksbrute force attemptbrute force attemptsbrute-forcec2 trafficcisco devicecisco exploitation attemptscloud infrastructurecloud infrastructure attackcloud servicescode executioncommand & controlcommand and controlcommand executioncommand injectioncommunication protocolcompromised credentialscompromised hostcowrie honeypotcowrie logscowrie ssh honeypotcowrie ssh logscredential accesscredential attackcredential brute-forcecredential guessingcredential stuffingcredential-stuffingcredit card servicesdata encryptiondata exfiltrationdata store exposuredatabase attackdatabase attacksdatabase securityddosddos attackddos attack indicatorsddos attacksddos preparationdecoy systemdefault credential abusedenial of servicedenial-of-servicedevice managementdionaea honeypotdistributed attacksdnsdns attackencryptionenterprise networkingenumerationeu cyber policieseuropeexfiltrationexploitexploit attemptexploit attemptsexploit kitexploit kit activityexploitationexploitation activityexploitation attemptexploitation attemptsexploited hostfailed loginfattfinancefinancial servicesfinancial technologyfinlandfranceftpftp brute forcegermanyhackinghoneynet connecthoneytrap honeypothttp brute forcehttp scannerhttp scanninghttp/shttpsidentity & access exploitationindicators-of-compromiseinformation gatheringinitial accessinjection activityinjection attacksinternet of thingsinternet-facingintrusion detectioniociot botnetiot device exploitationiot securityiot targetediot/ics attacklamplamp server attacklamp server targetinglamp stack attacklamp stack targetinglateral movementlcialinux serverlinux systemslinux-server-attacklogin attemptmailoney honeypotmalaysiamalicious activitymalicious scanmalicious sftp activitymalicious softwaremalicious ssh activitymalicious-login-attemptsmalwaremalware behaviourmalware capturemalware deliverymalware delivery attemptmalware distributionmirai botnetmisp threatmodbusmssqlnetworknetwork attacksnetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptsnetwork intrusion detectionnetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnokia_deepfield-benignnorth americanull scanoceaniaopen threatopportunistic-attackotx pulsenametip0fpassword attackpassword attackspayment processingphishingphishing attackphishing trapping of deathpinyinpla unitpolandport-scanningpossible mirai variantpotential botnetprocess injectionprotocol exploitationprotocol-abuseproxyransomwareransomware activityreconnaissanceregional securityremote accessremote servicesresearchedresource hijackingsansscanscannerscannersscanning activityscripting attackssecurity operationssecurity policysensor-taggedsentrypeer botnetserver exploitationservice scansftp access attemptsftp activitysftp attacksftp-attacksmb brute forcesmtpsmtp attackersmtp brute forcesocradar honeypotsoftware exploitationspamsql injectionsql injection attemptssshssh attackssh monitoringssh-brute-forcesyn scansystem accesst1018t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1027t1040t1041t1046t1053t1055t1059t1059.001t1059.003t1059.004t1059.007t1068t1071t1071.001t1076t1077t1078t1087t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1189t1190t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1505.002t1563t1565t1566t1589t1592t1595t1595.001t1595.002t1595.003tannertargeting databasetcp protocoltcp scantelecommunicationstelnet threattelnet-brute-forcethreat actorthreat detectionthreat intelligencethreat preventionthreat-intelligenceti advisorytor nodetpottsocudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized loginunauthorized-access-attemptunit coverunited statesusverified-benignvnc protocolvoipvoip attackvulnerability scanvulnerability-scanningvultr tokyowealth managementweb app attackweb application attackweb application attacksweb attackweb attacksweb exploitweb exploitationweb scannerweb serversweb spamweb trafficweb-application-attackxmas scan
Activity Timeline
Jun 14Jun 14
Threat Activity Heatmap
· Peak: 2026-06-14LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreLow Risk
32
SIGNAL
Signal Score
32%
Confidence
21
Reports
First seenSep 6, 2025
Last seenJun 14, 2026
GeolocationUS
CountryUnited States
LocationMassy, Île-de-France
ASNAS396982
OrgGoogle LLC
Coords48.7217, 2.2831
VirusTotal
Not checked
WHOIS
- raw
- NETWORK TRANSIT HOLDINGS LLC NTHL (NET-216-180-240-0-1) 216.180.240.0 - 216.180.247.255 IPXO LLC NET-216-180-246-0-24 (NET-216-180-246-0-1) 216.180.246.0 - 216.180.246.255 Internet Utilities NA LLC NETUTILS (NET-216-180-246-0-2) 216.180.246.0 - 216.180.246.255 Private Customer NET-216-180-246-0-24 (NET-216-180-246-0-3) 216.180.246.0 - 216.180.246.255
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 9 months ago · Last seen 13 days ago
Appeared in 21 threat reports