IPMediumSignal 48/100
36.106.167.97
Location
ChinaTianjin, Tianjin
ASN
AS17638
Chinanet TJ
First Seen
Mar 15, 2021
Last Seen
Jun 9, 2026
Found in 11 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
48%
Signal Score
48 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryChina
ChinaRegionTianjin, Tianjin
ASNAS17638
OrganizationChinanet TJ
Feed Intelligence Summary
11 reports48% confidence
11
Source reports
48%
Confidence score
Category tags
abuseactive scanactive scanningadbhoney honeypotasiaattackaustraliabad reputationbad web botbotnetbotnet activitybrute forcebrute force attackbrute force attacksbrute-forcec2chinacisco devicecisco exploitation attemptscivil servicescncommand & controlcommand and controlcommunication protocolcompromised credentialscompromised hostcowriecowrie honeypotcowrie ssh logscredential accesscredential harvestingcredential stuffingdata exfiltrationdata store exposuredatabase probingdatabase securityddosdecoy systemdenial of servicedevice managementdionaeadionaea honeypotdistributed attackselasticpot honeypotelasticsearch monitoringenterprise networkingexploitexploitationexploitation activityexploitation of vulnerabilityexploited hostfattftpftp brute forceftp brute-forcegovernment technologyhackinghoneytrap datahoneytrap honeypothttp scannerhttp scanningidentity & access exploitationinbound scanindicatorinformation technologyinjection activityintrusion detectioniot securityit infrastructurelamplamp server targetinglamp stack attacklamp stack targetinglateral movementmailoney honeypotmalicious activitymalicious softwaremalicious trafficmalwaremalware behaviourmalware capturenetworknetwork infrastructurenetwork scanningnetwork securitynetwork traffic analysisoceaniap0fpassword attacksphishingphishing attackphishing trappossible mirai variantpotential vulnerability exploitationprocess injectionprotocol exploitationpublic administrationpublic infrastructurepublic policyransomwarereconnaissanceredis exploitationredis honeypotregulatory agenciesresearchedresource hijackingscannerscanning activityscripting attackssensor-taggedsentrypeer botnetsentrypeer detectionservice scansftp activitysftp attacksip brute forcesip scanningsmtpsocial engineeringsocradar honeypotsoftware developmentssh attackssh monitoringt1021t1040t1041t1055t1059t1059.004t1059.007t1071t1071.001t1078t1110t1110.001t1110.002t1110.003t1110.004t1189t1190t1203t1204.002t1486t1496t1497t1499.001t1499.002t1499.003t1565t1566.001t1566.002t1566.003t1566.004t1595t1595.001t1595.002t1595.003tannertargeting databasetelecommunicationstelnet threatthreat actorthreat detectionthreat intelligencetor nodetpotudp port scanvoipvoip attackvulnerability scanvulnerability-exploitationweb app attackweb application attackweb attackweb exploitationweb traffic
Activity Timeline
Jun 9Jun 9
Threat Activity Heatmap
LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
48
SIGNAL
Signal Score
48%
Confidence
11
Reports
First seenMar 15, 2021
Last seenJun 9, 2026
GeolocationCN
CountryChina
LocationTianjin, Tianjin
ASNAS17638
OrgChinanet TJ
Coords39.1424, 117.1727
VirusTotal
Not checked
WHOIS
- description
- Score: 60/100. Labels: abuseipdb:brute-force, abuseipdb:exploited-host, abuseipdb:ftp-brute, abuseipdb:hacking, abuseipdb:low, abuseipdb:multi-reported. 36.106.167.97 classified as attacker with unclear intent (low confidence). Origin: enriched.
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 5 years ago · Last seen 2 days ago
Appeared in 11 threat reports