IPMediumSignal 61/100
8.209.90.19
Location
GermanyFrankfurt am Main, Hesse
ASN
AS45102
Alibaba.com Singapore E-Commerce Private Limited
First Seen
Jun 28, 2024
Last Seen
Jun 3, 2026
Found in 29 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
61%
Signal Score
61 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryGermany
GermanyRegionFrankfurt am Main, Hesse
ASNAS45102
OrganizationAlibaba.com Singapore E-Commerce Private Limited
IP Category
⟲
Proxy
Proxy server
Feed Intelligence Summary
29 reports61% confidence
29
Source reports
61%
Confidence score
Category tags
abuseaccess controlaccount compromiseactive scanactive scanningapacheapache attackeraptasiaattackattack attemptattack vectorsattacker ipaustraliaauthentication abuseauthentication attemptsauto-generated securityautomated attackautomated attacksautomated threatautomated-attackbad reputationbad web botblacklisted ip addressblog spambotnetbotnet activitybotnet-activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptbrute force attemptsbrute-forcebrute_forcebruteforcec2c2 communicationc2 servercanadacertcisco devicecisco device attackcisco exploit attemptcisco exploitation attemptscisco network devicescitrix attack attemptcitrix securitycloud environmentcloud infrastructurecloud infrastructure attackcloud servicescloud_infrastructurecode executioncommand & controlcommand and controlcommand executioncommand injectioncommon vulnerabilitiescommunication protocolcompromise attemptcompromised credentialscompromised credentials attemptcompromised hostcompromised hostsconnect scanconpot exploitation attemptsconpot honeypotcowriecowrie honeypotcowrie interactioncowrie interactionscowrie ssh attackcowrie ssh attackscowrie ssh honeypotcredential accesscredential attackcredential attackscredential brute forcecredential harvestingcredential stuffingcredential-stuffingctacurlcvedata encryptiondata exfiltrationdata store exposuredata theftdatabase attackdatabase attacksdatabase login attemptdatabase securitydatabase-serverdcerpcddosddos attackddos probededecoy systemdenial of servicedevice managementdictionary attackdigital oceandionaeadionaea activitydionaea honeypotdionaea interactiondionaea interactionsdionaea malware collectiondionaea payloadsdistributed attacksdnsdns attackemerging threatsencryptionenterprise networkingenterprise securityenumerationeuropeexploitexploit attemptexploit attemptsexploit probingexploit targetingexploitationexploitation activityexploitation attemptexploitation attemptsexploitation of vulnerabilityexploited hostexternal access attemptsexternal scanexternal_threatfailed login attemptsfattfatt analysisfatt detectionsfatt signaturesfinfin port scanfin scanfinlandfrancefraud voipftpftp attackftp attacksftp brute forcegermanyhackinghoneynet connecthoneytrap activityhoneytrap datahoneytrap eventshoneytrap honeypothoneytrap interactionshttp attackhttp brute forcehttp probinghttp scannerhttp scanninghttp/shttpsicmpics securityidentity & access exploitationimapinbound scanindicatorindicators of compromiseindustrial control systemsinformation gatheringinfrastructure acquisitionreconnaissanceinfrastructure scanninginitial accessinjection activityinjection attacksinternet-facinginternet-facing serviceinternet-wide scanintrusion detectioniociocsiot securityiot/ics attackip-address-iocip-addressesipv4ipv4 threatsjapanlamplamp attacklamp attack attemptlamp attackslamp exploitation attemptslamp server attacklamp stacklamp stack attacklamp stack attackslamp stack targetinglamp vulnerability scanninglateral movementlateral movement techniqueslinux serverslinux systemslinux-server-attacklinux-systemlinux_server_attackslogin attemptmailoney activitymailoney eventsmailoney honeypotmailoney interactionsmalicious activitymalicious ip blockedmalicious ipsmalicious network activitymalicious softwaremalicious trafficmalicious-login-attemptsmalwaremalware analysismalware attemptmalware behaviourmalware capturemalware deliverymalware delivery attemptmalware detectionmalware distributionmalware downloadmalware_activitymanualmasscanmssqlnetworknetwork attacksnetwork discoverynetwork enumerationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork port scanningnetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service discoverynetwork servicesnetwork traffic analysisnetwork-based attack attemptsnetwork-devicenetwork_enumerationnetwork_reconnaissancenmapnorth americanull port scannull scanoceaniaoutbound communication blockingp0fp0f os fingerprintingp0f passive fingerprintingp0f signaturespassword attackpassword attacksphishingphishing attackphishing trapping of deathpolandport-scanningportscanpossible mirai variantpotential exploit attemptspotential intrusionpotential threat actorprivilege escalationprocess injectionprotocol exploitationprotocol-abuseproxyproxy accessransomwarerdp attacksrdp scanningreconnaissancereconnaissance activityremote accessremote servicesresearchedresource hijackingrtbhscams & fraudscannerscanner activityscannersscanning activityscripting attackssecurity eventsecurity operationssecurity policysensor-taggedsentrypeer activitysentrypeer botnetsentrypeer detectionsentrypeer eventssentrypeer interactionsserver exploitationservice discoveryservice enumerationservice scanservice scanningsftp access attemptsftp activitysftp attacksftp attemptssftp-attackshell accesssip attackssip brute forcesip scanningsippsmtpsmtp attackssmtp brute forcesmtp probingsmtp scanningsocial engineeringsocradarsocradar honeypotsoftware exploitationspamsql injectionsql injection attemptsql injection attemptssshssh attackssh attacksssh monitoringssh-brute-forcestealth scansuricata alertsuricata alertssynsyn port scansyn scansystem accesst-pott1005t1016t1016.001t1018t1020t1021t1021.001t1021.002t1021.003t1021.004t1027t1040t1041t1046t1047t1053t1055t1059t1059.003t1059.004t1059.007t1068t1071t1071.001t1076t1077t1078t1078.001t1083t1087t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1187t1189t1190t1199t1203t1204.002t1210t1486t1496t1499.001t1499.002t1499.003t1505.002t1550t1550.002t1550.003t1555t1555.003t1563t1565t1566t1566.001t1566.002t1566.003t1573t1573.001t1583t1587.001t1588t1589t1590t1590.001t1590.004t1590.005t1590.006t1592t1592.002t1595t1595.001t1595.002t1595.003tannertanner activitytanner eventstanner interactionstargeting databasetcp protocoltcp scantcp scanningtelecommunicationstelnet attackstelnet threattelnet-brute-forcethreat actorthreat detectionthreat intelligencethreat intelligence feedthreat preventiontokyotor nodetorontotpottraffic anomaliesudp port scanudp scanunauthorized accessunauthorized access attemptunauthorized loginunauthorized-access-attemptunauthorized_access_attemptunited kingdomunited statesunknown threat actorvnc protocolvoipvoip attackvulnerability scanvultrweak credentialsweb app attackweb application attackweb application attacksweb application scanningweb attackweb attacksweb exploitweb exploitationweb exploitsweb login attemptweb shell uploadweb shell uploadsweb spamweb trafficweb-application-attackweb-serverweb_attackwgetxmasxmas port scanxmas scan
Activity Timeline
Jun 3Jun 3
Threat Activity Heatmap
· Peak: 2026-06-03LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
61
SIGNAL
Signal Score
61%
Confidence
29
Reports
First seenJun 28, 2024
Last seenJun 3, 2026
GeolocationDE
CountryGermany
LocationFrankfurt am Main, Hesse
ASNAS45102
OrgAlibaba.com Singapore E-Commerce Private Limited
Coords50.1188, 8.6843
Proxy
VirusTotal
Not checked
WHOIS
- description
- IPv4 hosts detected port scanning DigitalOcean Toronto (CA) honeypot
- raw
- inetnum: 6.0.0.0 - 9.128.255.255 netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK descr: IPv4 address block not managed by the RIPE NCC remarks: ------------------------------------------------------ remarks: remarks: For registration information, remarks: you can consult the following sources: remarks: remarks: IANA remarks: http://www.iana.org/assignments/ipv4-address-space remarks: http://www.iana.org/assignments/iana-ipv4-special-registry remarks: http://www.iana.org/assignments/ipv4-recovered-address-space remarks: remarks: AFRINIC (Africa) remarks: http://www.afrinic.net/ whois.afrinic.net remarks: remarks: APNIC (Asia Pacific) remarks: http://www.apnic.net/ whois.apnic.net remarks: remarks: ARIN (Northern America) remarks: http://www.arin.net/ whois.arin.net remarks: remarks: LACNIC (Latin America and the Carribean) remarks: http://www.lacnic.net/ whois.lacnic.net remarks: remarks: ------------------------------------------------------ country: EU # Country is really world wide admin-c: IANA1-RIPE tech-c: IANA1-RIPE status: ALLOCATED UNSPECIFIED mnt-by: RIPE-NCC-HM-MNT created: 2024-12-09T14:26:02Z last-modified: 2024-12-09T14:26:02Z source: RIPE role: Internet Assigned Numbers Authority address: see http://www.iana.org. admin-c: IANA1-RIPE tech-c: IANA1-RIPE nic-hdl: IANA1-RIPE remarks: For more information on IANA services remarks: go to IANA web site at http://www.iana.org. mnt-by: RIPE-NCC-MNT created: 1970-01-01T00:00:00Z last-modified: 2001-09-22T09:31:27Z source: RIPE # Filtered
- references
- https://github.com/telekom-security/tpotce, http://cinsscore.com/list/ci-badguys.txt, https://list.rtbh.com.tr/output.txt
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 1 year ago · Last seen 11 days ago
Appeared in 29 threat reports