IOC Radar
IPMediumSignal 70/100

47.252.34.1

Location
United StatesUnited States
Charlottesville, VA
ASN
AS45102
Alibaba Cloud - US
First Seen
Jan 25, 2026
Last Seen
Jun 12, 2026
Jan 25
First Seen
150d ago
Jun 12
Last Seen
13d ago
17
Reports
source reports
70%
Confidence
medium
Found in 17 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
70%
Signal Score
70 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

38 techniques

Network Information

CountryUSUnited States
RegionCharlottesville, VA
ASNAS45102
OrganizationAlibaba Cloud - US

Feed Intelligence Summary

17 reports70% confidence
17
Source reports
70%
Confidence score
Category tags
abuseaccess controlactive scanactive scanningattackattacker ipattacker-ipaustraliaauthentication attemptautomated attackautomated attack attemptsbad reputationbad web botblocklist_allblog spambotnetbotnet activitybotnet communicationbrute forcebrute force attackbrute force attemptbrute-forcec2 activityciscocisco devicecisco exploitation attemptcisco exploitation attemptscode executioncode injectioncommand & controlcommand and controlcommand executioncommunication protocolcompromised systemcowriecowrie datacowrie honeypotcredential accesscredential harvestingcredential stuffingdata exfiltrationdata store exposuredatabase attackdatabase securityddosddos attackddos attacksdecoy systemdenial of servicedevice managementdionaeadionaea honeypotdistributed attacksenterprise networkingexploitexploitationexploitation activityexploited hostfattftpftp brute forceftp brute-forcehackinghoneytrap datahoneytrap honeypothttp brute forcehttp scannerhttp scanningidentity & access exploitationindicatorinitial accessinjection activityinjection attacksinternet of thingsintrusion detectioniociot botnetiot securityiot targetediot/ics attacklamplamp server attacklamp stack attacklamp stack targetinglateral movementlogin attemptmailoney honeypotmalicious activitymalicious ipmalicious softwaremalwaremalware behaviourmalware capturemalware distributionmiraimirai botnetnetworknetwork attacksnetwork infrastructurenetwork intrusion attemptsnetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnorth americaoceaniaopenctip0fpassword attackpassword attacksphishingphishing attackphishing trapping of deathpossible mirai variantprocess injectionprotocol exploitationransomwarereconnaissanceremote access attemptresearchedresource hijackingscanscannerscanning activityscripting attackssecurity policysensor-taggedsentrypeer activitysentrypeer botnetsentrypeer detectionservice scansftpsftp access attemptsftp activitysftp attacksipsip brute forcesip scanningsmtpsmtp brute forcesocial engineeringsocradar honeypotspamsshssh attackssh monitoringt1021t1021.001t1021.002t1040t1041t1046t1055t1059t1059.003t1059.004t1059.007t1071t1071.001t1078t1110t1110.001t1110.002t1110.003t1110.004t1133t1189t1190t1203t1204.002t1486t1496t1499.001t1499.002t1499.003t1565t1566.001t1566.002t1566.003t1590t1595t1595.001t1595.002t1595.003tannertargeting databasetcptcp protocoltelecommunicationstelnettelnet threatthreat actorthreat detectionthreat intelligencethreat preventiontor nodetpotudp port scanunauthorized accessunited statesusvoidtrapvoipvoip attackvulnerability scanweb app attackweb application attackweb attackweb exploitationweb spamweb traffic

Activity Timeline

1 total obs
Jun 12Jun 12

Threat Activity Heatmap

· Peak: 2026-06-12
Less
More
Mon
Wed
Fri
Jun
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
70
SIGNAL
Signal Score
70%
Confidence
17
Reports
First seenJan 25, 2026
Last seenJun 12, 2026
GeolocationUS
CountryUnited States
LocationCharlottesville, VA
ASNAS45102
OrgAlibaba Cloud - US
Coords38.6583, -77.2481

VirusTotal

Not checked

WHOIS

description
2026-01-25T12:41:42.000Z Honeypot : Honeytrap : Source: 47.252.34.1 : Port: 2222 Message: {'protocol': 'tcp', 'payload': {'data_hex': '5353482d322e302d6c6962737368325f312e31312e310d0a', 'length': 24, 'sha512_hash': '4a10eb30789cac63757289093c81dde877d6caff293379f2fa077bd20d79b4445834113087a1723ad81aae6aaf034184d3f3cca7f6143e130313831ce04060dc', 'md5_hash': '6d77b1f2c88d516169b8623a90b65b2c'}}
raw
Alibaba Cloud LLC AL-3 (NET-47-250-0-0-1) 47.250.0.0 - 47.254.255.255 Alibaba Cloud - US ALIBABA CLOUD - US (NET-47-252-0-0-1) 47.252.0.0 - 47.252.127.255
references
https://github.com/telekom-security/tpotce, https://voidvendor.com/intel, https://malware-filter.gitlab.io/malware-filter/botnet-filter.txt

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 5 months ago · Last seen 13 days ago
Appeared in 17 threat reports