5.200.21.144
Classification: Suspicious
5.200.21.144 is a suspicious IP address. Linked to Tor malware. Reported by 5 threat sources, last seen 2023-12-19. Network: AS49544 i Dnet nlrtm1 K 0.
MITRE ATT&CK associations
Malware families: TOR (S0183)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic | Emerging Threats | 2017-10-15 14:34:41 | 2023-12-19 13:32:31 | anonymization | |
| Anonymizer | FireHol | 2022-01-18 08:13:03 | 2022-12-29 11:40:28 | anonymization | |
| Anonymizer | Maltiverse Research Team | 2020-11-21 13:33:46 | 2021-12-21 03:22:10 | anonymization anonymizer | |
| Malware | Hybrid-Analysis | 2021-07-18 12:17:02 | 2021-12-11 14:18:06 | ||
| Worm.Phorpiex | Hybrid-Analysis | 2021-07-04 15:15:20 | 2021-07-04 17:00:15 | ||
| AIT:Trojan.Nymeria | Hybrid-Analysis | 2021-04-01 08:01:59 | 2021-06-23 22:46:01 | ||
| Gen:Heur.Conjar | Hybrid-Analysis | 2021-06-23 22:45:28 | 2021-06-23 22:45:28 | ||
| BehavesLike.JS.Exploit | Hybrid-Analysis | 2021-06-01 16:00:57 | 2021-06-01 16:00:57 | ||
| Trojan.Generic | Hybrid-Analysis | 2021-04-04 17:30:48 | 2021-04-04 17:30:48 | ||
| Tor | Hybrid-Analysis | 2019-03-02 23:15:04 | 2019-03-02 23:15:04 | S0183 Tor | |
| Locky.AP | Hybrid-Analysis | 2018-12-12 09:00:09 | 2018-12-12 09:00:09 | ||
| Agent.SU | Hybrid-Analysis | 2018-11-12 02:30:08 | 2018-11-12 02:30:08 | ||
| Generic.Malware | Hybrid-Analysis | 2018-11-02 16:45:06 | 2018-11-02 16:45:06 | ||
| ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic | Emerging Threats | 2017-10-17 12:58:42 | 2018-08-29 07:38:57 | ||
| DangerousObject.Multi | Hybrid-Analysis | 2018-05-27 22:15:30 | 2018-05-27 22:15:30 | ||
| evasive ,financial ,zeus ,zeus1134 | Maltiverse | 2018-03-11 09:24:25 | 2018-03-11 09:24:25 | ||
| papras | Maltiverse | 2018-02-02 15:23:24 | 2018-02-02 15:23:24 | ||
| Anonymizer | Maltiverse | 2017-12-09 18:24:03 | 2017-12-09 18:24:03 | ||
| gozi,isfb,papras,ursnif | Maltiverse | 2017-11-09 03:31:35 | 2017-11-09 03:31:35 |
Tags
tor anonymization anonymizer papras evasive financial zeus zeus1134Whois information
- AS name
- AS49544 i Dnet nlrtm1 K 0
- AS registry
- ripencc
- AS date
- 2012-08-29 00:00:00
- AS CIDR
- 5.200.0.0/19
- Registrant
- i Dnet nlrtm1 K 0
- City
- Rotterdam
- Postal code
- 3032 AC
- Country
- NL — Netherlands 🇳🇱
- First indexed
- 2017-10-15 14:34:41
- Last updated
- 2025-10-08 16:38:02