IPMediumSignal 60/100
62.60.131.235
Location
United KingdomTehran, England
ASN
AS208137
Feo Prest SRL
First Seen
Sep 27, 2025
Last Seen
May 12, 2026
Found in 10 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
60%
Signal Score
60 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited Kingdom
United KingdomRegionTehran, England
ASNAS208137
OrganizationFeo Prest SRL
Feed Intelligence Summary
10 reports60% confidence
10
Source reports
60%
Confidence score
Category tags
abuseactive scanactive scanningadbadbhoney honeypotasiaattackaustraliaautomated attackautomated attacksbad reputationbad web botbotnetbotnet activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute-forcebrute_forcebruteforcecisco asacisco devicecisco exploitation attemptscloud environmentcloud infrastructurecloud-infrastructurecloud_infrastructurecommand and controlcommunication protocolconnected devicescowrie honeypotcowrie ssh honeypotcredential accesscredential access attemptscredential attackcredential attackscredential brute forcecredential harvestingcredential stuffingdata exfiltrationdata store exposuredatabase securityddosddos attackdecoy systemdenial of servicedevice managementdigital oceandigitalocean infrastructuredionaea honeypotdistributed attacksdropperdropper activityenterprise networkingeuropeexploitexploit attemptsexploitationexploitation activityexploitation attemptsexploited hostexternal attackexternal-threatexternal_threatfattftpftp attacksftp brute forcehackinghoneytrap honeypothttp brute forcehttp scanneridentity & access exploitationindicators of compromiseindustrial iotinitial accessinitial_accessinjection activityinjection attacksinternet of thingsinternet-scanninginternet-wide observationinternet-wide scaniociot analyticsiot applicationsiot platformsiot securityipv4ipv4 activityipv4 indicatorsipv4-addressesipv4-scanningipv4_activityiranlamplamp server attacklamp stack exploitationmailoney activitymailoney honeypotmalicious activitymalicious infrastructuremalicious softwaremalwaremalware behaviourmalware capturemalware deliverymalware distributionmalware downloadmass-scanningmobilemobile securitymonthlymssql brute forcenetherlandsnetworknetwork attacksnetwork discoverynetwork enumerationnetwork infrastructurenetwork intrusion attemptnetwork intrusion attemptsnetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnetwork traffic analysisnetwork-based attack attemptsnetwork-reconnaissancenetwork_discoverynetwork_scannetwork_scanningnloceaniap0fpassword attackpassword attacksphishingphishing attackphishing trapport-scanningportscanpossible malware propagationpotential compromisepotential credential compromisepre-attackprocess injectionprotocol exploitationproxypublic cloud targetingransomwarerdp attacksreconnaissanceremote accessremote code executionremote servicesresearchedresource hijackingscannerscanner activityscannersscanning activityscripting attackssecurity operationssensor-taggedsentrypeer botnetserver exploitationservice scansftp access attemptssftp attacksftp attemptsingaporesmart devicessmb brute forcesmtpsmtp attackssocial engineeringsocradar honeypotspamsql injectionsshssh attackssh attacksssh monitoringt-pott1018t1021t1021.001t1040t1041t1046t1055t1059t1059.003t1059.004t1059.007t1064t1071.001t1076t1078t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1190t1203t1210t1486t1496t1497t1499.001t1499.002t1499.003t1505.002t1563t1565t1566.001t1566.002t1566.003t1566.004t1589t1590t1592t1595t1595.001t1595.002t1595.003tannertargeting databasetcp protocoltelnet attackstelnet threatthreat actorthreat detectionthreat intelligencethreat intelligence feedthreat-intelligencetor nodetpotunattributed activityunauthorized accessunauthorized access attemptunauthorized loginunited kingdomvnc protocolvoip attackvulnerability scanvulnerability-scanningvultrweb app attackweb application attackweb attackweb exploitationweb shell uploadsweb spamweb traffic
Activity Timeline
May 12May 12
Threat Activity Heatmap
· Peak: 2026-05-12LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreMedium Risk
60
SIGNAL
Signal Score
60%
Confidence
10
Reports
First seenSep 27, 2025
Last seenMay 12, 2026
GeolocationGB
CountryUnited Kingdom
LocationTehran, England
ASNAS208137
OrgFeo Prest SRL
Coords51.5072, -0.1276
VirusTotal
Not checked
WHOIS
- description
- Score: 60/100. Labels: abuseipdb:minimal, abuseipdb:reported, cowrie, firehol:firehol_anonymous, firehol:firehol_level1, firehol:firehol_proxies. 62.60.131.235 classified as commodity attacker using automated exploitation tooling (high confidence). Origin: enriched. Listed on: FireHOL (firehol_anonymous, firehol_level1); AbuseIPDB (minimal, reported).
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 8 months ago · Last seen 1 month ago
Appeared in 10 threat reports