185.220.101.212

Classification: Malicious

185.220.101.212 is a malicious IP address in Berlin, DE. 92 sightings from 16 threat sources (Proxy, SSH Attacker), last seen 2026-10-12.

Current activity

  • Known attacker — Seen launching attacks over the Internet.
  • TOR node — Part of the TOR anonymization network.

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
DDoS Attacker Blocklist.net.ua 2020-09-05 03:59:51 2026-10-12 17:28:33 attacker malicious-activity
Empty reason Blocklist.net.ua 2026-09-04 17:16:16 2026-09-11 17:17:49 attacker malicious-activity
TOR Node IPWhois.io 2026-09-06 19:24:28 2026-09-06 19:24:28 anomalous-activity anonymization tor
Proxy FireHOL 2024-06-09 11:55:55 2025-10-07 03:01:37 anonymization
TOR Exit Node TorProject.org 2020-03-27 09:46:51 2021-09-17 04:48:51 anonymizer
ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic Emerging Threats 2020-03-21 02:06:07 2021-09-13 04:37:24 anonymization
ET TOR Known Tor Exit Node TCP Traffic Emerging Threats 2020-03-31 02:09:35 2021-09-13 04:35:32 anonymization
Malware Hybrid-Analysis 2021-07-28 13:30:50 2021-07-28 13:47:17
HTTP Spammer Sblam 2020-04-13 10:55:16 2021-07-20 06:35:06 malicious-activity
Malicious Host HoneyDB 2020-05-16 00:00:00 2021-07-08 00:00:00 malicious-activity
ET COMPROMISED Known Compromised or Hostile Host Traffic UDP Emerging Threats 2020-05-22 02:59:13 2021-06-20 16:27:50 malicious-activity
ET COMPROMISED Known Compromised or Hostile Host Traffic TCP Emerging Threats 2020-05-22 02:59:12 2021-06-20 16:27:47 malicious-activity
HTTP Spammer StopForumSpam.com 2020-04-09 02:40:33 2021-05-17 09:30:05 malicious-activity
SSH Attacker Blocklist.net.ua 2020-04-13 07:45:23 2021-05-17 05:36:16 malicious-activity
SSH Attacker Blocklist.de 2020-04-10 07:34:13 2021-05-17 04:41:27 malicious-activity
Bruteforce login attacker Blocklist.de 2020-06-18 08:26:50 2021-05-12 06:15:24 malicious-activity
HTTP Attacker Blocklist.de 2020-06-18 08:21:03 2021-05-12 06:06:38 malicious-activity
Parasite traffic on site rukozhopov.net. Blocklist.net.ua 2021-03-27 10:40:33 2021-04-26 01:55:57 malicious-activity
HTTP Spammer Cleantalk.org 2020-05-14 01:52:12 2021-04-13 11:33:09 malicious-activity
HTTP bot Blocklist.de 2020-07-05 02:10:47 2020-12-28 00:58:49 malicious-activity
DDoS attack Blocklist.net.ua 2020-10-16 01:42:12 2020-12-16 08:41:34 malicious-activity
SSH Attacker Telefonica CO SOC 2020-06-06 08:58:07 2020-07-11 09:58:08
HTTP Attacker BadIPs 2020-07-11 02:27:59 2020-07-11 08:34:54
Malicious host Darklist 2020-06-18 02:58:59 2020-06-18 02:58:59
HTTP Spammer Botscout 2020-05-03 07:54:01 2020-05-03 07:54:01
Anonymizer Maltiverse 2020-04-22 03:38:30 2020-04-22 03:38:30

Tags

tor anonymizer bot abuse ssh bruteforce apache ddos rfi attacker login joomla wordpress spam noscript anonymization

Whois information

AS name
AS60729 CIA TRIAD SECURITY LLC
AS registry
ripencc
AS date
2017-09-12 00:00:00
AS CIDR
185.220.101.0/24
CIDR
185.220.101.0/24
Registrant
CIA TRIAD SECURITY LLC
Address
Provider Markus Koch Heinestrasse 37 14621 Schoenwalde-Glien Siedlung DE
City
Berlin
Postal code
15562
Country
DE — Germany 🇩🇪
Contact email
[email protected]
First indexed
2020-03-21 02:06:07
Last updated
2026-10-12 17:28:33

Malicious IPs in the same CIDR

185.220.101.38 185.220.101.194 185.220.101.205 185.220.101.200 185.220.101.47 185.220.101.206 185.220.101.55 185.220.101.197 185.220.101.209 185.220.101.21 185.220.101.207 185.220.101.178 185.220.101.198 185.220.101.193 185.220.101.210 185.220.101.68 185.220.101.199 185.220.101.204 185.220.101.53 185.220.101.29 185.220.101.196 185.220.101.202 185.220.101.5 185.220.101.8 185.220.101.9