185.140.53.9
Classification: Suspicious
185.140.53.9 is a suspicious IP address in London, GB. Linked to Remcos, Nanocore malware. 30 sightings from 12 threat sources, last seen 2026-09-11.
MITRE ATT&CK associations
Malware families: REMCOS (S0332) NANOCORE (S0336) AGENT TESLA (S0331)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Mail Spammer | Barracuda | 2024-10-20 05:03:54 | 2026-09-11 01:52:03 | attacker malicious-activity | |
| Agent Tesla | Maltrail | 2025-02-25 16:38:25 | 2025-03-24 11:42:54 | malicious-activity | S0331 Agent Tesla |
| Nanocore RAT | ThreatFox Abuse.ch | 2021-11-11 00:08:53 | 2023-09-29 18:29:36 | malicious-activity | S0336 NanoCore |
| Remcos | ThreatFox Abuse.ch | 2023-09-10 23:17:23 | 2023-09-12 22:19:33 | malicious-activity | S0332 Remcos |
| Backdoor.MSIL.Agent | Hybrid-Analysis | 2021-09-23 16:00:39 | 2021-09-23 16:00:39 | ||
| TrojanX | Hybrid-Analysis | 2021-09-23 15:45:07 | 2021-09-23 15:45:07 | ||
| Malware | Hybrid-Analysis | 2021-06-18 07:32:04 | 2021-06-18 07:32:04 | ||
| HTTP Spammer | StopForumSpam.com | 2020-10-07 06:20:33 | 2021-05-10 19:24:06 | malicious-activity | |
| malicious.25f2f7 | Hybrid-Analysis | 2021-04-13 15:37:16 | 2021-04-13 15:37:16 | ||
| RATX | Hybrid-Analysis | 2021-03-10 12:30:22 | 2021-03-10 12:30:22 | ||
| ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic | Emerging Threats | 2020-10-06 05:04:20 | 2021-02-19 16:03:19 | anonymization | |
| ET TOR Known Tor Exit Node TCP Traffic | Emerging Threats | 2020-10-06 05:03:28 | 2021-02-19 16:00:26 | anonymization | |
| TOR Exit Node | TorProject.org | 2020-10-03 06:02:55 | 2021-02-17 17:28:22 | anonymizer | |
| HTTP Spammer | Sblam | 2020-11-02 12:40:50 | 2021-02-16 06:38:44 | malicious-activity | |
| Parasite traffic on site gammapharm.com. | Blocklist.net.ua | 2021-01-14 11:35:12 | 2021-02-11 11:23:24 | malicious-activity | |
| ET COMPROMISED Known Compromised or Hostile Host Traffic UDP | Emerging Threats | 2021-02-06 10:16:27 | 2021-02-08 14:44:54 | malicious-activity | |
| ET COMPROMISED Known Compromised or Hostile Host Traffic TCP | Emerging Threats | 2021-02-06 10:16:24 | 2021-02-08 14:44:51 | malicious-activity | |
| Malicious Host | HoneyDB | 2020-10-18 00:00:00 | 2021-02-08 00:00:00 | malicious-activity | |
| HTTP Spammer | Cleantalk.org | 2021-01-29 11:13:43 | 2021-01-29 22:18:21 | malicious-activity | |
| HTTP Spammer | Botscout | 2021-01-23 23:54:07 | 2021-01-23 23:54:07 | malicious-activity | |
| SSH Attacker | Blocklist.net.ua | 2020-11-04 02:08:57 | 2021-01-12 11:11:38 | malicious-activity | |
| AD.Nanocore | Hybrid-Analysis | 2020-07-01 15:00:36 | 2020-07-01 15:00:36 | ||
| GenKryptik.EMOR | Hybrid-Analysis | 2020-06-18 13:15:10 | 2020-06-18 13:15:10 | ||
| MSIL_Kryptik.AWS.gen | Hybrid-Analysis | 2020-06-15 20:17:10 | 2020-06-15 20:17:10 | ||
| AGEN.1131750 | Hybrid-Analysis | 2020-04-25 17:45:20 | 2020-04-25 17:45:20 |
Tags
c2 historicalandnew nanocore rat port:1818 nancrat port:9124 remcos port:3007 remcosrat remvio socmer port:1121 tor anonymizer bot abuse port:1110Whois information
- AS name
- AS201801 Zerospace Cloud
- AS registry
- ripencc
- AS date
- 2016-02-24 00:00:00
- AS CIDR
- 185.140.53.0/24
- CIDR
- 185.140.53.0/24
- Registrant
- Zerospace Cloud
- Address
- Suite 9, Ansuya Estate Revolution Avenue Mahe, Seychelles
- City
- London
- Postal code
- WC1V
- Country
- GB — United Kingdom 🇬🇧
- Contact email
- [email protected]
- First indexed
- 2020-04-25 17:45:20
- Last updated
- 2026-09-11 01:52:04