IPMediumSignal 74/100
45.79.207.111
Location
United StatesAtlanta, Georgia
ASN
AS63949
Linode
First Seen
Apr 30, 2025
Last Seen
Jun 19, 2026
Found in 22 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
74%
Signal Score
74 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionAtlanta, Georgia
ASNAS63949
OrganizationLinode
IP Category
⟲
Proxy
Proxy server
⊕
VPN
VPN exit node
Feed Intelligence Summary
22 reports74% confidence
22
Source reports
74%
Confidence score
Category tags
abuseaccess controlaccount compromiseackactive scanactive scanningadbadbhoney honeypotadbhoney related activityapplication layer protocolasiaattackattacker-ipaustraliaauthentication brute forceauthentication failureautomated attackautomated attacksautomated threatautomated-attackautomated_attackbad reputationbad web botblacklist activityblacklist checkblacklist hitblacklist ip activityblacklisted ip activityblacklisted ip addressblocklist_allblog spambotnetbotnet activitybotnet connection attemptsbotnet detectionbotnet-activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptbrute force attemptsbrute-forcebrute-force attackbrute_forcebruteforcec2c2 serverchinacisco devicecisco device attackcisco device targetingcisco exploitationcisco exploitation attemptcisco exploitation attemptscisco network devicescisco targetedcisco_device_attackclasscloud environmentcloud infrastructurecloud infrastructure attackcloud servicescode executioncommand & controlcommand and controlcommand executioncommand injectioncommand injection attemptcommon vulnerabilitiescommunication protocolcompromise attemptcompromised credentialscompromised devicecompromised hostcompromised hostscompromised systemconpot activityconpot attackconpot honeypotconpot ics attackscountcountrycowriecowrie activitycowrie attackcowrie attackscowrie emulationcowrie honeypotcowrie interactionscowrie logscowrie ssh attackcowrie ssh attackscowrie ssh honeypotcowrie ssh logscredential accesscredential access attemptcredential attackcredential attackscredential brute forcecredential brute-forcingcredential compromisecredential guessingcredential harvestingcredential stuffingcredential-harvestingcredential-stuffingcredential_stuffingcve exploitationdata encryptiondata exfiltrationdata store exposuredata theftdatabase attackdatabase attacksdatabase brute forcedatabase probingdatabase securitydatabase-serverdatabase_serverddosddos attackdecoy systemdenial of servicedevice managementdhcpdhcp activitydhcp discoverydhcp exploitationdhcp scandhcp scanningdhcp starvationdictionary attackdictionary_attackdigital oceandionaeadionaea activitydionaea attackdionaea attacksdionaea capturedionaea honeypotdionaea interactionsdionaea malware collectiondionaea malware samplesdirectory traversal attemptdistributed attacksdnsdns attackelasticpot honeypotelasticsearchelasticsearch activityelasticsearch attackselasticsearch brute forceelasticsearch exploitationelasticsearch monitoringelasticsearch scanelasticsearch scanningencryptionenterprise networkingenv-huntingeuropeeventsexploitexploit attemptexploit attemptsexploit kitexploit kit activityexploitationexploitation activityexploitation attemptexploitation of privilegeexploitation of vulnerabilityexploitation_attemptexploited hostexport-to-otxexposed services exploitationexternal access attemptsexternal threatexternal_threatfailed login attemptsfattfatt signaturesfieldfilefin scanfrancefraud voipftpftp attacksftp brute forceftp brute-forceftp scanninggalahgermanyhackingheralding activityheralding scan activityhoneypot 24h activityhoneytrap activityhoneytrap datahoneytrap exploit attemptshoneytrap honeypothoneytrap interactionshong konghttphttp brute forcehttp probinghttp scannerhttp scanninghttp/shttpsics attackics securityics/scadaics/scada attackidentity & access exploitationimapimap attackimap attacksimap brute forceindicatorindicators of compromiseindustrial control systemsinformation gatheringinfrastructure targetinginitial accessinitial_accessinjection activityinjection attacksinternet facing systemsinternet-facinginternet-facing assetsinternet-facing serviceinternet-wide monitoringintrusion attemptintrusion detectioniociocsiot securityiot targetediot/ics attackiot_attackip-address-iocipphoney honeypotipv4ipv4 addressesipv4 trafficipv4_addressitalyjapankill-chain exploitationkill-chain reconnaissancelamplamp attacklamp exploitationlamp exploitation attemptslamp server attacklamp server probelamp server targetinglamp stacklamp stack exploitationlamp stack targetedlamp stack targetinglamp_stack_attacklateral movementlcialdapldap attacksldap brute forceldap injection attemptsldap scanlinux serverslinux systemslinux-server-attacklinux-systemlinux_server_attackslow-riskmailoney attackmailoney honeypotmailoney interactionsmalaysiamalicious activitymalicious activity detectedmalicious file transfermalicious ip addressesmalicious ip listmalicious ipsmalicious payloadmalicious payload detectionmalicious softwaremalicious trafficmalicious-ipmalicious-login-attemptsmalwaremalware behaviourmalware capturemalware deliverymalware delivery attemptmalware distributionmalware downloadmalware propagationmalware_activitymemcache brute forcememcached amplification attackmemcached attacksmemcached scanmemcached scanningmispmssqlmssql attacksmssql brute forcemysql brute forcenetworknetwork attacksnetwork discoverynetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork monitoringnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scannetwork scanningnetwork securitynetwork service scanningnetwork servicesnetwork trafficnetwork traffic analysisnetwork-devicenetwork_reconnaissancenetwork_scannetwork_scanningnginxnorth americantpntp amplificationntp amplification attackntp attacksntp scanntp scanningnull scanoceaniaopen proxyopen source databaseopencanaryopportunistic attackopportunistic attackeroracleoracle attacksoracle brute forceoracle database attackosintp0fp0f network fingerprintingp0f os fingerprintingp0f passive fingerprintingp0f signaturespassword attackpassword attackspassword sprayingpathperimeter securityphishingphishing attackphishing trapping of deathpolandport-scanningportscanpossible botnet activitypossible exploit attemptpossible malware distributionpossible mirai variantpostgrespostgres brute forcepostgresql attackspostgresql brute forcepotential attackpotential exploit activitypotential malware deliverypotential malware distributionpotential_attackprivilege escalationprocess injectionprotocol exploitationprotocol-abuseproxyqhoneypot activityqhoneypot targetransomwareraspberry-pireconnaissancereconnaissance_activityredisredis attacksredis brute forceredis exploit attemptredis exploitationredis honeypotredpiranha referenceremote accessremote access attemptsremote service exploitationremote servicesremote_access_serviceresearchedresource hijackingscams & fraudscanscannerscannersscanning activityscorescripting attackssecurity operationssecurity policysensor-taggedsentrypeer botnetsentrypeer detectionsentrypeer exploitsentrypeer interactionsserver exploitationserver securityserviceservice enumerationservice scanservice scanningseveresftp access attemptsftp activitysftp attacksftp attackssftp exploitationsftp protocolsftp protocol abusesftp-attackshell access attemptssip brute forcesip protocolsip scanningsmbsmb attackssmb brute forcesmb scanningsmb vulnerability scansmtpsmtp attackersmtp brute forcesmtp probingsnmpsnmp attackssnmp enumerationsnmp querysnmp scansocial engineeringsocks5socks5 proxysocks5 proxy activitysocks5 proxy detectionsocks5 proxy scanningsocks5 proxy usagesocradar honeypotsoftware exploitationspamsql injectionsql injection attemptsql injection attemptssshssh attackssh attacksssh bruteforcessh monitoringssh protocolssh scanningssh-brute-forcesuricata alertsuricata alertssynsystem reconnaissancet-pott1005t1016t1018t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1021.007t1021.008t1027t1040t1041t1046t1047t1055t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1068t1071t1071.001t1076t1077t1078t1078.001t1078.002t1078.003t1078.004t1083t1087t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1189t1190t1195t1199t1203t1204.002t1210t1486t1496t1498t1499.001t1499.002t1499.003t1505t1505.002t1505.004t1550t1550.002t1550.003t1552t1555t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1569t1572t1573t1583t1588t1589t1590t1590.002t1590.004t1590.005t1590.006t1592t1592.002t1595t1595.001t1595.002t1595.003tannertanner activitytanner interactionstargeting databasetcp protocoltcp scanningtelecommunicationstelnettelnet attackstelnet threattelnet-brute-forcethreat actorthreat actor: unknownthreat detectionthreat feedthreat intelthreat intelligencethreat preventionthreat_intelligencetokyotor nodetotal eventstpottpotceturkeytypeudp port scanunauthorized accessunauthorized access attemptunauthorized loginunauthorized-access-attemptunited kingdomunited statesunknown threat actorusus ip addressvaluevncvnc attacksvnc protocolvnc scanningvoipvoip attackvpnvpn ipvulnerability scanvultrvultr infrastructurevultr parisvultr_platform_activityweak credentialsweb app attackweb application attackweb application attacksweb application scanningweb attackweb attacksweb exploitationweb shellweb shell attemptweb shell detectionweb shell uploadsweb spamweb trafficweb-application-attackweb-serverweb_attackweb_serverxmas scan
Activity Timeline
Jun 19Jun 19
Threat Activity Heatmap
· Peak: 2026-06-19LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
74
SIGNAL
Signal Score
74%
Confidence
22
Reports
First seenApr 30, 2025
Last seenJun 19, 2026
GeolocationUS
CountryUnited States
LocationAtlanta, Georgia
ASNAS63949
OrgLinode
Coords33.7488, -84.3877
ProxyVPN
VirusTotal
Not checked
WHOIS
- description
- IPv4 hosts detected port scanning DigitalOcean London (UK) honeypot
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 5 days ago
Appeared in 22 threat reports