185.239.242.18
Classification: Suspicious
185.239.242.18 is a suspicious IP address in Vancouver, CA. Linked to Warzonerat malware. 51 sightings from 7 threat sources (Proxy), last seen 2025-10-07.
MITRE ATT&CK associations
Malware families: WARZONERAT (S0670)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Proxy | FireHOL | 2023-01-02 19:02:24 | 2025-10-07 03:22:10 | anonymization | |
| Ave Maria | ThreatFox Abuse.ch | 2023-09-26 11:17:12 | 2023-09-28 10:53:02 | malicious-activity | S0670 WarzoneRAT |
| ET COMPROMISED Known Compromised or Hostile Host Traffic UDP | Emerging Threats | 2020-12-09 11:48:15 | 2021-01-11 11:22:49 | malicious-activity | |
| ET COMPROMISED Known Compromised or Hostile Host Traffic TCP | Emerging Threats | 2020-12-09 11:48:14 | 2021-01-11 11:22:47 | malicious-activity | |
| SSH Attacker | Blocklist.net.ua | 2020-12-09 09:16:31 | 2020-12-21 09:01:30 | malicious-activity | |
| Mail Spammer | Abuseat.org | 2020-12-08 04:18:15 | 2020-12-18 05:48:27 | ||
| SSH Attacker | Blocklist.de | 2020-12-05 08:35:35 | 2020-12-12 10:15:55 | malicious-activity | |
| Malicious Host | HoneyDB | 2020-12-05 00:00:00 | 2020-12-10 00:00:00 | malicious-activity |
Tags
avemariarat c2 historicalandnew warzonerat port:5200 ave_maria warzone rat avemaria anonymization ssh bruteforce bot abuseWhois information
- AS name
- AS852 TELUS Communications Inc
- AS registry
- ripencc
- AS date
- 2018-01-05 00:00:00
- AS CIDR
- 185.239.242.0/24
- Registrant
- TELUS Communications Inc
- City
- Vancouver
- Postal code
- V5Z
- Country
- CA — Canada 🇨🇦
- First indexed
- 2020-12-05 08:35:35
- Last updated
- 2026-09-17 00:20:39