46.165.230.5

Classification: Suspicious

46.165.230.5 is a suspicious IP address. Linked to Tor malware. Reported by 23 threat sources, last seen 2025-11-26.

MITRE ATT&CK associations

Malware families: TOR (S0183)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Proxy IPWhois.io 2025-02-18 04:44:16 2025-11-26 00:38:51 anonymization
Proxy FireHOL 2022-12-31 20:39:30 2025-10-07 02:19:10 anonymization
Anonymizer FireHol 2022-12-29 09:14:37 2022-12-29 20:35:38 anonymization
ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic Emerging Threats 2018-07-02 07:29:23 2022-10-09 02:50:25 anonymization
Malware Hybrid-Analysis 2021-07-18 12:18:31 2022-01-02 09:15:22
HTTP Attacker CruzIT 2019-09-26 07:30:04 2021-12-07 05:40:12 malicious-activity
Gen:Heur.Conjar Hybrid-Analysis 2021-06-23 23:01:11 2021-06-30 00:17:24
Gen:Variant.Barys Hybrid-Analysis 2021-06-24 23:00:39 2021-06-24 23:00:39
HTTP Spammer StopForumSpam.com 2020-11-27 21:23:35 2021-05-27 04:50:35 malicious-activity
Anonymizer Maltiverse Research Team 2020-11-21 15:53:05 2021-05-22 22:08:44 anonymizer
Kryptik.QME Hybrid-Analysis 2021-04-03 12:45:59 2021-04-03 12:45:59
KeyLogger.BSFD Hybrid-Analysis 2021-04-03 12:32:27 2021-04-03 12:32:27
DDoS Attacker Blocklist.net.ua 2018-03-20 07:23:01 2021-04-01 11:25:35 malicious-activity
ET TOR Known Tor Exit Node TCP Traffic Emerging Threats 2018-06-27 07:44:40 2021-03-15 13:39:56 anonymization
TOR Exit Node TorProject.org 2019-11-03 13:26:59 2021-03-12 18:13:13 anonymizer
Malicious Host HoneyDB 2019-07-24 00:00:00 2021-03-08 00:00:00 malicious-activity
HTTP Spammer Cleantalk.org 2018-06-21 06:26:25 2021-01-20 10:56:37 malicious-activity
HTTP Attacker BadIPs 2018-07-14 06:54:19 2020-12-14 02:24:59 malicious-activity
HTTP Spammer Botscout 2020-12-06 17:15:42 2020-12-06 17:15:42 malicious-activity
AIT:Trojan.Nymeria Hybrid-Analysis 2020-11-08 13:45:17 2020-11-08 13:45:17
DDoS attack Blocklist.net.ua 2020-02-06 00:36:18 2020-11-06 08:26:34
JS.Heur.Backdoor.2 Hybrid-Analysis 2020-08-01 15:15:12 2020-08-01 15:15:12
Parasite traffic on site gammapharm.com. Blocklist.net.ua 2020-07-21 03:12:31 2020-07-21 09:14:03
SSH Attacker Blocklist.net.ua 2018-06-11 08:08:52 2020-06-10 00:30:03
ET COMPROMISED Known Compromised or Hostile Host Traffic UDP Emerging Threats 2019-07-05 01:51:27 2020-06-08 09:45:34
ET COMPROMISED Known Compromised or Hostile Host Traffic TCP Emerging Threats 2019-07-05 01:51:26 2020-06-08 09:45:33
SSH Attacker Telefonica CO SOC 2018-11-25 02:58:04 2020-04-28 09:58:14
HTTP Spammer Myip.ms 2018-02-09 21:15:09 2020-04-21 20:06:10
Generic.Malware Hybrid-Analysis 2019-01-29 05:00:04 2020-02-13 02:15:32
Malicious site Hybrid-Analysis 2020-01-20 12:30:07 2020-01-20 12:30:07
Malicious host Talos Intelligence 2019-08-01 02:53:33 2019-08-01 02:53:33
SSH Attacker Greynoise 2019-04-29 00:00:00 2019-07-11 00:00:00
SSH attacker Greynoise 2019-06-23 00:00:00 2019-07-08 00:00:00
Bluekeep Attacker Greynoise 2019-06-27 00:00:00 2019-06-27 00:00:00
Malicious Host Alienvault Ip Reputation Database 2019-03-06 06:54:55 2019-04-19 06:42:26
ET CINS Active Threat Intelligence Poor Reputation IP UDP Emerging Threats 2019-03-06 08:40:12 2019-04-12 08:06:26
ET CINS Active Threat Intelligence Poor Reputation IP TCP Emerging Threats 2019-03-06 08:40:11 2019-04-12 08:06:25
Malicious Host CIArmy 2019-03-05 07:29:00 2019-04-11 07:12:47
HTTP Spammer GPF DNS Blocklist 2019-03-27 08:12:56 2019-03-27 08:12:56
Tor Hybrid-Analysis 2019-02-04 01:15:05 2019-03-22 14:01:56 S0183 Tor
Parasite traffic on site test-drives.autopark.in.ua. Blocklist.net.ua 2018-09-08 07:00:16 2018-12-14 07:11:00
AGEN.1020711 Hybrid-Analysis 2018-11-11 20:45:12 2018-11-11 20:45:12
Trojan.Agent Hybrid-Analysis 2018-09-17 14:15:15 2018-09-17 14:15:16
ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic Emerging Threats 2018-06-20 22:15:59 2018-08-29 07:36:53
ET TOR Known Tor Exit Node UDP Traffic Emerging Threats 2018-06-20 22:15:29 2018-08-29 07:36:23
Empty reason Blocklist.net.ua 2018-07-11 06:42:12 2018-07-11 06:42:12
Malicious host Darklist 2018-06-20 08:17:22 2018-06-20 08:17:22
Proxy Maltiverse Research Team 2018-04-09 10:59:51 2018-04-09 10:59:51
gozi,isfb,papras,ursnif Maltiverse 2018-01-31 13:46:08 2018-01-31 13:46:08

Tags

anonymization tor anonymizer gozi isfb papras ursnif abuse bot apache attacker modsec noscript ssh bruteforce script kiddies bluekeep exploiter cve-2019-0708 rdp 404 compromised ddos

Whois information

AS name
AS28753 Leaseweb Deutschland GmbH
AS registry
ripencc
AS date
2010-12-13 00:00:00
AS CIDR
46.165.192.0/18
Registrant
Leaseweb Deutschland GmbH
City
Frankfurt
Postal code
60311
Country
DE — Germany 🇩🇪
First indexed
2018-01-31 13:46:08
Last updated
2025-11-26 00:38:53

Malicious IPs in the same CIDR

46.165.243.36 46.165.250.81 46.165.242.86 46.165.220.229 46.165.194.85 46.165.250.82 46.165.194.56