213.141.138.174

Classification: Suspicious

213.141.138.174 is a suspicious IP address. Linked to Tor malware. Reported by 4 threat sources, last seen 2021-12-12. Network: AS12714 Meridian net Network.

MITRE ATT&CK associations

Malware families: TOR (S0183)

Blacklist sightings

Description	Source	First seen	Last seen	Labels	MITRE ATT&CK
Malware	Hybrid-Analysis	2021-07-16 00:17:55	2021-12-12 15:01:21
ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic	Emerging Threats	2017-10-15 14:32:14	2021-11-28 05:06:41	anonymization
NetTool.TorTool	Hybrid-Analysis	2021-10-20 12:45:07	2021-10-20 12:45:07
Wacapew.C	Hybrid-Analysis	2021-04-04 17:30:33	2021-04-04 17:30:33
AIT:Trojan.Nymeria	Hybrid-Analysis	2021-04-01 08:01:59	2021-04-03 13:00:18
Anonymizer	Maltiverse Research Team	2020-11-22 11:33:30	2021-03-28 14:22:06	anonymizer
Trojan.Cridex	Hybrid-Analysis	2020-09-17 18:31:05	2020-09-17 18:31:05
Trojan.Generic	Hybrid-Analysis	2019-03-28 03:30:05	2020-04-09 10:00:18
Malware site	Hybrid-Analysis	2020-03-13 12:00:25	2020-03-13 12:00:25
Tor	Hybrid-Analysis	2019-02-04 01:15:05	2019-02-04 01:15:05		S0183 Tor
AGEN.1020711	Hybrid-Analysis	2018-11-11 20:45:12	2018-11-11 20:45:12
ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic	Emerging Threats	2017-10-17 12:48:42	2018-08-29 07:38:23
gozi ,isfb ,papras ,ursnif	Maltiverse	2017-12-19 14:31:30	2018-02-28 10:01:02
papras	Maltiverse	2018-02-02 13:27:57	2018-02-02 13:27:57
Anonymizer	Maltiverse	2017-12-10 03:03:12	2017-12-10 03:03:12
gozi,isfb,papras,ursnif	Maltiverse	2017-10-25 16:16:36	2017-10-25 16:16:36

Tags

tor anonymizer papras gozi isfb ursnif

Whois information

AS name: AS12714 Meridian net Network
AS registry: ripencc
AS date: 2003-11-18 00:00:00
AS CIDR: 213.141.128.0/19
Registrant: Meridian net Network
City: Moscow
Postal code: 103073
Country: RU — Russian Federation 🇷🇺
First indexed: 2017-10-15 14:32:14
Last updated: 2026-04-19 01:21:50