147.45.125.182
Classification: Suspicious
147.45.125.182 is a suspicious IP address in San Francisco, US. Linked to Socgholish malware. 114 sightings from 5 threat sources, last seen 2026-09-03.
Current activity
- Open proxy — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: SOCGHOLISH (S1124)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Proxy | IPWhois.io | 2026-01-05 00:56:51 | 2026-09-03 02:55:08 | anonymization proxy | |
| Proxy | FireHOL | 2024-07-15 22:35:31 | 2025-10-07 10:54:33 | anonymization | |
| Bruteforce | Blocklist.net.ua | 2025-06-24 12:27:00 | 2025-06-25 12:15:40 | malicious-activity | |
| Mail Spammer | Blocklist.de | 2025-06-24 07:50:32 | 2025-06-25 07:37:21 | malicious-activity | |
| IMAP Attacker | Blocklist.de | 2025-06-24 07:30:24 | 2025-06-25 07:17:43 | malicious-activity | |
| FAKEUPDATES | ThreatFox Abuse.ch | 2024-04-29 14:18:54 | 2024-05-01 13:21:38 | malicious-activity | S1124 SocGholish |
Tags
keitarotds socgholish port:443 fakeupdate anonymization attacker imap pop3 sasl bot mail spam abuseWhois information
- AS name
- AS400992 Huize Holdings LLC
- AS registry
- ripencc
- AS date
- 1991-06-21 00:00:00
- AS CIDR
- 147.45.125.0/24
- CIDR
- 147.45.125.0/24
- Registrant
- Huize Holdings LLC
- Address
- NE Front St, Milford, DE 19963, USA
- City
- San Francisco
- State
- CA
- Postal code
- 94102
- Country
- US — United States 🇺🇸
- First indexed
- 2024-04-29 14:18:54
- Last updated
- 2026-09-03 02:55:09