94.130.186.5

Classification: Suspicious

94.130.186.5 is a suspicious IP address. Linked to Tor malware. Reported by 4 threat sources, last seen 2021-11-16. Network: AS24940 Hetzner Online GmbH.

MITRE ATT&CK associations

Malware families: TOR (S0183)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Malware Hybrid-Analysis 2021-07-18 12:17:26 2021-11-16 14:46:24
Anonymizer Maltiverse Research Team 2020-11-21 19:07:26 2021-03-28 19:34:51 anonymizer
Gen:Variant.Bulz Hybrid-Analysis 2021-01-07 19:30:36 2021-01-07 19:30:36
ET TOR Known Tor Relay/Router (Not Exit) Node TCP Traffic Emerging Threats 2018-06-22 07:49:06 2020-01-06 08:19:36 anonymization
Tor Hybrid-Analysis 2019-02-04 01:15:05 2019-02-04 01:15:05 S0183 Tor
Trojan.Generic Hybrid-Analysis 2018-05-08 10:15:29 2018-09-07 07:30:28
ET TOR Known Tor Relay/Router (Not Exit) Node UDP Traffic Emerging Threats 2018-06-20 22:19:03 2018-08-29 07:40:07
Tinukebot.K Hybrid-Analysis 2018-07-26 07:31:10 2018-07-26 07:31:10
W32.eHeur Hybrid-Analysis 2018-06-06 16:01:26 2018-06-06 16:01:26
Packed.MUPX Hybrid-Analysis 2018-04-19 19:31:06 2018-04-19 19:31:06
Anonymizer Maltiverse 2018-02-09 19:14:28 2018-02-09 19:14:28
gozi,isfb,papras,ursnif Maltiverse 2018-01-31 12:17:25 2018-01-31 12:17:25

Tags

gozi isfb papras ursnif anonymizer tor

Whois information

AS name
AS24940 Hetzner Online GmbH
AS registry
ripencc
AS date
2008-06-23 00:00:00
AS CIDR
94.130.0.0/16
Registrant
Hetzner Online GmbH
City
Nuremberg
Postal code
90403
Country
DE — Germany 🇩🇪
First indexed
2018-01-31 12:17:25
Last updated
2026-04-03 17:46:55

Malicious IPs in the same CIDR

94.130.201.104 94.130.52.190 94.130.51.212 94.130.69.218 94.130.70.185 94.130.142.182 94.130.10.179 94.130.89.176 94.130.11.28 94.130.21.250 94.130.44.97 94.130.10.218 94.130.71.8 94.130.225.221 94.130.240.16 94.130.177.190 94.130.178.184