# ipv4_iocs

ip: 1.117.63.97
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-08T23:21:54.215937
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.947783
stix_id: indicator--c41910df-88b4-5b33-b102-045d4d4dbea5
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1}


ip: 1.171.24.92
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T07:28:18.654726
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.948159
stix_id: indicator--7b7f298e-514a-51ba-8045-d955501a214b
validation_sources:
  {"shodan": 1, "otx": 1, "firehol": 1, "stevenblack": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "virustotal": 1}


ip: 101.37.79.189
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T09:00:29.397422
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.950553
stix_id: indicator--d5c402a8-0fee-5f87-b675-e2b96395eefa
validation_sources:
  {"shodan": 1, "otx": 1, "firehol": 1, "stevenblack": 1, "dshield": 1, "threatfox": 1, "abuseipdb": 1, "virustotal": 1}


ip: 104.193.255.7
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T03:46:14.376761
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.994621
stix_id: indicator--22e5a3ad-330a-59e2-b3d5-ffc845902793
validation_sources:
  {"shodan": 1, "otx": 1, "firehol": 1, "stevenblack": 1, "dshield": 1, "threatfox": 1, "abuseipdb": 1}


ip: 104.250.169.66
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-08T23:47:49.010918
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.956565
stix_id: indicator--8d410395-c816-567d-b75d-a77ec6e81ee6
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "firehol": 1, "stevenblack": 1, "virustotal": 1, "dshield": 1, "threatfox": 1}


ip: 112.29.119.178
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T06:31:41.872406
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:49.004733
stix_id: indicator--6b048977-e566-521e-b361-b42a924dd7ce
validation_sources:
  {"shodan": 1, "firehol": 1, "stevenblack": 1, "otx": 1, "dshield": 1, "threatfox": 1, "abuseipdb": 1}


ip: 118.208.221.49
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T02:33:20.479780
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:49.007469
stix_id: indicator--1807e768-a398-5adc-8822-9ce8ac5ceeb8
validation_sources:
  {"shodan": 1, "firehol": 1, "stevenblack": 1, "abuseipdb": 1, "otx": 1, "dshield": 1, "threatfox": 1}


ip: 123.57.209.214
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T21:21:30.836613
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:49.009748
stix_id: indicator--2c46a99a-2273-5dec-866f-b7f243f69c7d
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1}


ip: 157.20.182.12
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T00:30:20.312017
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.960642
stix_id: indicator--19945bc8-593c-5839-ac57-cc2d414b63c3
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "firehol": 1, "stevenblack": 1, "dshield": 1, "threatfox": 1, "virustotal": 1}


ip: 176.57.184.97
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T21:46:21.909994
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
actor_attribution_actor: Secret Blizzard
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.961004
stix_id: indicator--8c2aeae4-a5d6-5906-9650-762defe944ea
validation_sources:
  {"firehol": 1, "stevenblack": 1, "shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1}


ip: 176.65.134.39
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-08T23:46:07.386238
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.961286
stix_id: indicator--58fed370-d443-57f2-ab0e-dd3dc80d07d1
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "firehol": 1, "stevenblack": 1, "dshield": 1, "threatfox": 1}


ip: 176.97.71.35
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T21:46:31.953145
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:49.010215
stix_id: indicator--b10d8602-e728-5475-b35e-22d5e38972c2
validation_sources:
  {"firehol": 1, "stevenblack": 1, "shodan": 1, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1}


ip: 185.220.101.64
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-08T23:21:53.119378
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.945701
stix_id: indicator--953a6a02-ec0c-52ff-9c3d-83735cd81162
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1}


ip: 185.220.101.76
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-09T00:07:29.983148
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.946213
stix_id: indicator--94a84c41-f6ae-5f22-8c61-01fbac72b007
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "censys": 1}


ip: 23.95.193.207
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-10T00:12:02.595019
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.946943
stix_id: indicator--c4eae239-f19b-589b-b6ee-40e1b6df216a
validation_sources:
  {"firehol": 1, "stevenblack": 1, "shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1}


ip: 24.99.42.200
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-10T00:12:11.627463
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.974478
stix_id: indicator--99e6e4bf-cec2-53c0-b7fb-413e80d79988
validation_sources:
  {"firehol": 1, "stevenblack": 1, "shodan": 1, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1}


ip: 49.113.78.205
source_file: ipv4.txt
first_seen: 2026-03-04T04:12:17.266147
last_seen: 2026-03-04T04:12:17.266147
infra_type: unknown
last_validated: 2026-03-10T03:42:09.940633
validation_status: validated
created_at: 2026-03-04 04:12:17
updated_at: 2026-03-04 04:12:17
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:49.070516
stix_id: indicator--f2641590-a980-5687-998b-5c572ed72158
validation_sources:
  {"firehol": 1, "stevenblack": 1, "shodan": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1}


ip: 91.231.182.187
source_file: microsoft-threat-analytics-2025
first_seen: 2026-03-04T23:52:13.730592
threat_types: device-code-phishing
source_pulses: microsoft-threat-analytics-2025
infra_type: compromised
last_validated: 2026-03-09T01:01:53.447370
validation_status: validated
created_at: 2026-03-04T23:52:13.730592
updated_at: 2026-03-04T23:52:13.730592
actor_attribution_actor: Storm-2372
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.568747
stix_id: indicator--fe461c44-5ee5-52cc-b399-995a81a8163d
validation_sources:
  {"shodan": 9, "otx": 7, "abuseipdb": 7, "virustotal": 7, "censys": 4, "firehol": 1, "stevenblack": 1, "dshield": 1, "threatfox": 1}


ip: 176.65.134.253
source_file: Infrastructure_Scan-0
first_seen: 2026-03-08T18:31:56.945011
last_seen: 2026-03-08T18:31:56.945011
threat_types: vulnerability_scan
infra_type: unknown
last_validated: 2026-03-08T23:03:07.176891
validation_status: validated
created_at: 2026-03-08 22:31:56
updated_at: 2026-03-08 22:31:56
actor_attribution_actor: Scan-Promoted C2 Candidates (2026-05-23)
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.639228
stix_id: indicator--ae32e124-9afc-51a0-9bdc-d44ee00f73b3
validation_sources:
  {"shodan": 3, "otx": 3, "abuseipdb": 3, "virustotal": 3, "censys": 3, "dshield": 2, "threatfox": 2, "firehol": 2, "stevenblack": 2}


ip: 194.85.249.24
source_file: Infrastructure_Scan-1
first_seen: 2026-03-11T08:42:17.666227
last_seen: 2026-03-11T08:42:17.666227
last_validated: 2026-03-11T09:03:28.642338
validation_sources: {"firehol": 1, "stevenblack": 1}
validation_status: validated
created_at: 2026-03-11T08:42:17.666227
updated_at: 2026-03-13 16:08:32
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:49.234286
stix_id: indicator--d28d3056-eac7-5925-8e64-f725a6de0a17
infra_type:
  scan_candidate|score=90|c2_port_cluster,clone_of_194.85.251.81|d24s5f:c2_port_cluster|6000-6767_range


ip: 80.89.224.13
source_file: ipv4.txt
first_seen: 2026-03-20T00:57:31.599819
last_seen: 2026-03-20T00:57:31.599819
infra_type: unknown
last_validated: 2026-03-30T22:26:53.726180
validation_status: validated
created_at: 2026-03-20 00:57:31
updated_at: 2026-03-20 00:57:31
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: expired
lifecycle_assessed_at: 2026-06-24T06:33:48.920182
stix_id: indicator--6c1abc14-3ba6-5b7f-bef7-9541a699b0af
validation_sources:
  {"shodan": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


ip: 178.19.63.70
source_file: ipv4.txt
first_seen: 2026-03-31T13:21:38.348735
last_seen: 2026-03-31T13:21:38.348735
infra_type: unknown
last_validated: 2026-03-31T13:28:20.712904
validation_status: validated
created_at: 2026-03-31 13:21:38
updated_at: 2026-03-31 13:21:38
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.792228
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


ip: 195.3.220.48
source_file: ipv4.txt
first_seen: 2026-04-01T00:31:18.328902
last_seen: 2026-04-01T00:31:18.328902
infra_type: unknown
last_validated: 2026-04-01T12:02:56.047864
validation_status: validated
created_at: 2026-04-01 00:31:18
updated_at: 2026-04-01 00:31:18
actor_attribution_actor: Earth Koshchei
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.644419
validation_sources:
  {"shodan": 1, "abuseipdb": 1, "otx": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


ip: 45.133.216.15
source_file: ipv4.txt
first_seen: 2026-04-01T00:31:18.328902
last_seen: 2026-04-01T00:31:18.328902
infra_type: unknown
last_validated: 2026-04-01T12:02:56.104413
validation_status: validated
created_at: 2026-04-01 00:31:18
updated_at: 2026-04-01 00:31:18
actor_attribution_actor: Callisto
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.791951
validation_sources:
  {"shodan": 1, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


ip: 2.2.2.6
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.659084
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Callisto
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.630046
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "censys": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 2.2.3.6
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.687158
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Callisto
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.634574
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 1.0.1.1
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.775053
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.612198
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 104.238.189.186
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.802813
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.625827
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 109.234.38.232
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.899698
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.607923
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 138.68.161.53
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.981317
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.641993
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 139.59.85.26
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:11.007084
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606422
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 143.198.216.105
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:11.168693
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.634707
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 157.230.94.134
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:11.497414
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.639961
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 161.35.169.180
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:11.797774
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.631802
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 161.35.185.146
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:11.832697
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.641335
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 165.227.208.207
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:11.953342
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.634600
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 1}


ip: 176.118.164.187
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:12.192847
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606053
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 185.163.45.5
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.579141
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.627953
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 1}


ip: 185.163.47.177
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.606917
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.642617
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 188.93.210.54
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:13.429462
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.608241
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 193.164.150.111
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:13.487782
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.625846
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.58.108.140
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:13.704251
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.634043
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.58.111.215
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:13.739861
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.608746
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.58.120.207
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:13.904821
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606139
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.58.122.110
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.008047
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.629979
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.108.168
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.294727
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.626907
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.109.90
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.459077
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.632566
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.110.89
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.490326
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.613401
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.111.121
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.529915
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606544
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.113.186
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.597670
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.613427
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.113.99
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.666558
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.628285
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.116.51
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.758663
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.627626
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 1}


ip: 194.67.116.67
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.814763
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606585
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.71.4
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.884159
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.627656
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.71.55
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.915010
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.632598
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.86.167
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:14.954599
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.628311
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.90.215
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.109636
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.628471
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 194.67.90.78
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.139753
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606646
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 195.140.146.128
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.238556
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.599653
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 206.81.0.182
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.352396
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.640014
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 209.38.97.36
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.374587
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.630347
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 216.238.69.137
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.481644
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606695
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 2, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 217.69.0.35
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:15.557666
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.613596
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 5.181.156.109
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:16.162893
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.644709
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 5.63.154.19
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:16.316000
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.632655
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 2}


ip: 5.63.158.233
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:16.378628
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.628511
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 70.34.208.32
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:16.850064
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.613770
validation_sources:
  {"shodan": 2, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.241.88
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:16.951022
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.613860
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.244.199
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.007106
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606887
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.245.223
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.042755
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.599784
validation_sources:
  {"shodan": 2, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.245.254
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.071762
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.611829
validation_sources:
  {"shodan": 2, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.248.167
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.141974
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.611856
validation_sources:
  {"shodan": 2, "otx": 2, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.251.191
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.232105
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606971
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.251.231
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.269648
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.599827
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 1, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.253.196
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.336756
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.627683
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 80.78.254.238
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.425222
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.599883
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 83.166.247.110
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.539848
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.628977
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.115.206
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:17.753128
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.614090
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.78.82
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.348036
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.607549
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.79.13
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.369311
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.614361
validation_sources:
  {"shodan": 2, "otx": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.79.91
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.395674
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.607523
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.81.106
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.424501
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.614429
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.83.23
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.593613
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.629014
validation_sources:
  {"shodan": 2, "otx": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.88.15
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.657807
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.612028
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.88.67
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.743368
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.599911
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 89.108.98.101
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.769598
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.607629
validation_sources:
  {"shodan": 2, "otx": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 89.185.84.204
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.919609
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.640254
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 1}


ip: 89.223.123.121
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:18.979385
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.629630
validation_sources:
  {"shodan": 2, "otx": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 1}


ip: 91.188.222.50
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.042763
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.640435
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 91.200.148.232
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.074879
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.642693
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 92.242.62.132
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.135310
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.585375
validation_sources:
  {"shodan": 2, "otx": 1, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 94.250.251.39
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.374714
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Gamaredon
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.615300
validation_sources:
  {"shodan": 2, "otx": 1, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 121.127.232.250
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.569273
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.607707
validation_sources:
  {"shodan": 1, "otx": 2, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 130.61.233.105
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.595842
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.718352
validation_sources:
  {"shodan": 1, "otx": 1, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 157.20.182.49
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:10.634819
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.569063
validation_sources:
  {"shodan": 1, "otx": 2, "abuseipdb": 1, "virustotal": 1, "censys": 1, "dshield": 2, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 1}


ip: 185.76.79.125
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.758587
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.640654
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 209.74.87.100
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:19.866517
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.607798
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 3.22.57.57
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:20.001136
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.644227
validation_sources:
  {"shodan": 2, "abuseipdb": 2, "dshield": 1, "threatfox": 1, "firehol": 2, "stevenblack": 1, "c2tracker": 2, "tweetfeed": 2, "ipsum": 2, "emerging_threats": 2}


ip: 86.104.73.52
source_file: ipv4.txt
first_seen: 2026-04-02T18:21:09.996925
last_seen: 2026-04-02T18:21:09.996925
infra_type: unknown
last_validated: 2026-04-02T20:16:20.221841
validation_status: validated
created_at: 2026-04-02 18:21:10
updated_at: 2026-04-02 18:21:10
actor_attribution_actor: Pawn Storm
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.642554
validation_sources:
  {"shodan": 2, "otx": 2, "dshield": 2, "threatfox": 1, "firehol": 2, "stevenblack": 2, "c2tracker": 2, "tweetfeed": 1, "ipsum": 2, "emerging_threats": 2}


ip: 176.65.144.98
source_file: manual_investigation
first_seen: 2026-04-05
last_seen: 2026-04-05
infra_type: phishing
validation_sources: {}
validation_status: validated
created_at: 2026-04-05 23:34:47
updated_at: 2026-04-05 23:37:50
actor_attribution_actor: HOSTKEY Phishing Farm (194.85.251)
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:49.236467
threat_types:
  url_shortener,telegram_bot,phishing_infra,docker,prometheus_exposed,grafana_default_creds,dedik_services,sms_gateway,sms-inboxgateway.com


ip: 194.85.250.98
source_file: scan_cx2mjg
first_seen: 2026-04-05
last_seen: 2026-04-05
threat_types: c9things_farm,nginx,mariadb,web_farm,hostkey
infra_type: hosting
last_validated: 2026-04-06T00:17:47.935815
validation_status: validated
created_at: 2026-04-05 23:37:50
updated_at: 2026-04-05 23:37:50
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.784342
validation_sources:
  {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


ip: 194.85.250.28
source_file: scan_cx2mjg
first_seen: 2026-04-05
last_seen: 2026-04-05
threat_types: plesk,mail_server,hostkey
infra_type: hosting
last_validated: 2026-04-06T00:17:48.102820
validation_status: validated
created_at: 2026-04-05 23:37:50
updated_at: 2026-04-05 23:37:50
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.785136
validation_sources:
  {"shodan": 1, "abuseipdb": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


ip: 176.123.8.7
source_file: scan_crossref_2026-05-25
first_seen: 2026-05-25
last_seen: 2026-05-25
infra_type: bulletproof_hosting
last_validated: 2026-05-30T18:28:48.188443
validation_sources: {"shodan": 1, "otx": 1, "abuseipdb": 1, "virustotal": 1}
validation_status: validated
created_at: 2026-05-25 01:31:31
updated_at: 2026-05-25 01:31:31
actor_attribution_actor: ALEXHOST 176.123 ecrime customer cluster (gh0st_rat seen on .8/24)
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.606481
threat_types:
  gh0st_rat,bulletproof_hosting,empire_c2,redis_exposed,no_auth,victim,cron_injection_target,dedik_kworker


ip: 62.60.150.20
source_file: scan_SCAN_k19oow_2026_05_29
first_seen: 2026-05-29
last_seen: 2026-05-29
threat_types: spoofed_cert,wildcard_obfuscation
infra_type: unknown
last_validated: 2026-05-31T12:32:24.526480
validation_status: validated
created_at: 2026-05-29 15:43:10
updated_at: 2026-05-29 15:43:10
actor_attribution_actor: russian_speaking_ecrime
score_timestamp: 2026-06-24T06:30:39.275442
provider_risk_level: unknown
lifecycle_state: stale
lifecycle_assessed_at: 2026-06-24T06:33:48.612225
validation_sources:
  {"shodan": 1, "abuseipdb": 1, "otx": 1, "virustotal": 1, "dshield": 1, "threatfox": 1, "firehol": 1, "stevenblack": 1, "c2tracker": 1, "tweetfeed": 1, "ipsum": 1, "emerging_threats": 1}


# emails

domain: northshorehealthgm.org
source_file: emails.txt
first_seen: 2026-03-04T04:16:00.790227
created_at: 2026-03-04 04:16:00
email:
  dosonedrivenotifications-svct-mailboxe36625aaa85747214aa50342836a2315aaa36928202aa46271691a8255aaa15382822aa25821925a0245@northshorehealthgm.org


# subnets

cidr: 176.65.134.0/24
asn_org: Netiface LLC
country: SI
tier: TIER_B
scan_status: SCANNED
created_at: 2026-03-04 04:16:01
updated_at: 2026-03-04 04:16:01
notes:
   | 2026-04-05 cert analysis: WIN-TVJFV24LUKT VM clone (.45), FASTPANEL (.23), SI14/SI20/SI21/SI23 naming convention, WIN-TVJFV24LUKT links to 17-host deployment batch.


cidr: 176.65.144.0/24
asn_org: DEDIK SERVICES LIMITED
country: UK
tier: TIER_B
scan_status: SCANNED
created_at: 2026-03-04 04:16:01
updated_at: 2026-03-04 04:16:01
notes:
   | 2026-04-05 cert analysis: dedik.io (3 hosts: .26/.29/.106/.108), FASTPANEL (.106/.108), ch.snowfalls.top (4 hosts), virt.fusion hypervisor (.250-252), BT-PANEL (3 hosts). dedik.io provisioned infrastructure.


cidr: 185.220.101.0/24
asn_org: Stiftung Erneuerbare Freiheit
country: DE
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-04 04:16:01
updated_at: 2026-03-04 04:16:01
notes:
  Tor exit node infrastructure — anonymization layer | 2026-04-05 cert analysis: 46+ DGA certs (cnazibns.net, wg5z73oremex.net), 48 "default" self-signed. Orchestrated Tor relay deployment.


cidr: 194.85.251.0/24
asn_org: HOSTKEY B.V.
country: NL
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-04 04:16:01
updated_at: 2026-04-05 23:37:55
notes:
   | 2026-04-05 cert analysis: MASSIVE PHISHING — spoofed github.com(9), microsoft.com(8), VK(8), apple.com(4+2), yahoo(3), steam(2), amd(2). hypervisor.hv(10), *.max.ru(6), FASTPANEL(2), u22.isp(2). Gh0st RAT + Empire C2 active.


cidr: 37.221.64.0/24
asn_org: ALEXHOST SRL
country: NL
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-04 04:16:01
updated_at: 2026-03-04 04:16:01
notes:
  AlexHost — bulletproof hosting | 2026-04-05 cert analysis: 16 srv.mailconstant.com + srv.icrmls.com (HM MARKETING spam infra), FASTPANEL, Cloudbase-Init WinRM (6 hosts), XUI.one C2 panel.


cidr: 87.121.84.0/24
asn_org: VPSVAULT.HOST LTD
country: US
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-04 04:16:01
updated_at: 2026-03-04 04:16:01
notes:
   | 2026-04-05 cert analysis: virt.fusion hypervisor (.129/.5). Netiface LLC (SI). Linked to 176.65.134.0/24 via adjacent ASN.


cidr: 157.250.202.0/24
asn_org: Interserver, Inc
country: US
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-11 13:37:03
updated_at: 2026-03-11 13:37:03
notes:
  BlackSanta campaign - Aryaka/Validin | 2026-04-05 cert analysis: cloudpanel.clp (4 hosts), VMware Installer localhost (1 host), foxomy.com cluster (.130-134).


cidr: 67.217.48.0/24
asn_org: Interserver, Inc
country: US
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-11 13:37:03
updated_at: 2026-03-11 13:37:03
notes:
  BlackSanta campaign - Aryaka/Validin | 2026-04-05 cert analysis: coffeshopnetau cluster (.250-254), BlackSanta C2 (.59). Plesk panel.


cidr: 88.119.165.0/24
asn_org: Informacines sistemos ir technologijos UAB
country: LT
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-11 13:37:03
updated_at: 2026-03-11 13:37:03
notes:
  BlackSanta campaign - Aryaka/Validin | 2026-04-05 cert analysis: FASTPANEL, WIN-0MMR7H9FU9H VM clone, WindowsAdminCenter (3 hosts). BlackSanta campaign infrastructure.


cidr: 94.130.237.0/24
country: DE
tier: TIER_A
scan_status: SCANNED
created_at: 2026-03-11 13:37:03
updated_at: 2026-03-11 13:37:03
notes:
  BlackSanta campaign - Aryaka/Validin | 2026-04-05 cert analysis: hypervisor.hv, XUI.one C2 panel, Plesk, BlackSanta relay (94.130.237.28). Hetzner — GRU/SVR convergence point.


cidr: 34.70.205.0/24
asn_org: Google LLC (GCP)
country: US
tier: TIER_B
scan_status: pending_scan
first_ioc_date: 2026-05-25
created_at: 2026-05-25 14:29:03
updated_at: 2026-05-25 14:29:03
notes:
  DEDIK / kworker Cryptominer Cron-Injection (2026-05) PRIMARY staging C2. 34.70.205.211 abused as Google Cloud compute instance serving the kworker binary via fake SPIP plugin path /plugins-dist/safehtml/lang/font/kworker. Legitimate ASN abused (TIER_B not TIER_A): GCP is not the operator home -- they spin up VMs and burn them. Report abuse: cloud.security@google.com / cloud.google.com/support/docs/report-abuse. /24 may rotate; track the IP.


cidr: 38.150.0.0/24
tier: TIER_B
scan_status: pending_scan
first_ioc_date: 2026-05-25
created_at: 2026-05-25 14:29:03
updated_at: 2026-05-25 14:29:03
notes:
  DEDIK / kworker Cryptominer Cron-Injection (2026-05) SECONDARY (backup) staging C2. Observed via cron-injection payload URL http://38.150.0.118/dewfhuewr4r89/98hy67//kworker (backup3 key, cadence */4). ASN + owner pending ip-api enrichment. Adjacent /24s 38.150.{1..255} not yet scanned. Likely BPH (38.x has known dirty sub-blocks).


# asn_info

org_name: RouterHosting LLC
country: US
risk_level: medium
created_at: 2026-03-04 20:23:54
updated_at: 2026-05-27 18:42:31
provider_type: datacenter_c2p
notes:
   | 2026-05-27: confirmed multi-actor C2P cluster on /24 144.172.112 (Quasar RAT C2 + Apple phishing pair + SumUp/FR-deposit phishing + compromised hosts). | 2026-05-27 cleanup: country corrected SG->US (ARIN RouterHosting LLC handle RL-896, Sheridan WY); provider_type promoted datacenter->datacenter_c2p; total_ips_announced backfilled (~222 /24 equivalents = 56832 IPs).


org_name: Global-Data System IT Corporation
country: CH
created_at: 2026-03-04 20:25:21
updated_at: 2026-04-04T18:15:53
provider_type: bulletproof_hosting
notes:
  Global-Data System IT Corporation — Seychelles-registered shell company. 11.19% IOC density (315 confirmed malicious IPs / 2,816 total announced), approximately 100,000x higher than legitimate cloud providers. 7 of 11 IPv4 prefixes show 14-20% infection rates. Follows the same Seychelles shell company pattern documented by Team Cymru and Spamhaus for the confirmed Russian BPH operator ELITETEAM (AS51381). Country listed as CH (Switzerland) in RIR data but operational entity is Seychelles-registered. Europol report: Tier 2 takedown target (P6), 228 IOCs.


org_name: HOSTKEY B.V.
country: DE
created_at: 2026-03-04 20:06:57
updated_at: 2026-05-28 18:20:24
provider_type: datacenter
notes:
  2026-05-28 SCAN_bxcgps HOSTKEY 194.85.250/24 vicinity recon (adjacent to confirmed Phishing Farm on .251, campaign id=35): NEGATIVE RESULT. 120 IPs probed, 12 live (10%), 0 High/Critical findings, 0 cert spoof, 0 phishing landing. Pattern from .251 does NOT replicate on .250. /24 stays out of scope; mark HOSTKEY 194.85.250 vicinity recon follow-up CLOSED.


org_name: NetCraftersOUe
country: SE
created_at: 2026-03-04 20:03:39
updated_at: 2026-05-28 18:20:24
provider_type: datacenter-mixed-customer-base
notes:
  2026-05-28 SCAN_bxcgps NetCrafters footprint recon: 285 IPs probed across 37 /24s (62.60.x, 83.147.x, 178.253.55, 185.173.14x, 194.85.250, 213.176.x), 183 live (64.2%), C+H ratio 0.12 per host (baseline normal datacenter, NOT BPH-concentrated). Signal: 1 cert template hit (WIN-4NFSE1QOBMS on 62.60.235.5 -- fifth ASN footprint of this shared Windows image), 1 FASTPANEL+aeza.network pair (83.147.255.1/.2 customer-on-NetCrafters with AEZA-themed DNS), 1 free-DDNS phishing pair (vacancyscanner.ooguy.com + wetmysteries.gleeze.com on 83.147.252.3), 1 operator-themed cert (reapernode.link on 213.176.119.3). All promoted to watchlist tier -- no /24 promoted, no campaign created. Pattern: NetCrafters hosts a diverse customer base including occasional malicious customers, NOT a BPH-dedicated provider.


org_name: AS211486 — Alferov Aleksey Aleksandrovich (per VT); AbuseIPDB: SOFCOMPANY Ltd / skknet.net
country: BG
created_at: 2026-06-19 00:00:00
updated_at: 2026-06-19 00:00:00
provider_type: datacenter-mixed-customer-base
notes:
  Hosts FortiBleed operational host 85.11.187.8 (85.11.187.0/24). AbuseIPDB confidence 30 / 32 reports; PwnDefend: multi-year cybercrime reporting history. Shodan 85.11.187.8: ports 22/111/5900, OpenSSH 10.0p2, Debian. ASN/geo DISAGREE across providers: VT=AS211486 BG, AbuseIPDB=PL, DShield=AS25369 BANDWIDTH-AS GB. Multi-tenant — do NOT blocklist the /24 (only .8 is an IOC). [FORTIBLEED_2026_06_19]


org_name: Hyonix LLC
country: US
risk_level: medium
created_at: 2026-05-27 18:38:28
updated_at: 2026-05-27 18:38:28
provider_type: datacenter_c2p
notes:
  Hyonix LLC AS213122 -- sibling ASN of AS14956 RouterHosting. ~12k IPs across 47 IPv4 /24 prefixes (RIPEstat 2026-05-27). Customer fronting overlap with RouterHosting documented in ARIN entity RL-896. | 2026-05-27: marked as sibling of AS14956 RouterHosting (Cloudzy brand family) per Halcyon 2023 + 2026-05-27 cluster on AS14956 144.172.112/24.


org_name: BL Networks
country: GB
created_at: 2026-03-04 20:24:07
updated_at: 2026-04-04T18:15:53
provider_type: abuse_tolerant
notes:
  BL Networks / BitLaunch — Wyoming USA registration (Sheridan, WY). Parent company: Liber Systems Limited (UK-registered). Linked to 10+ ransomware campaigns: Yanluowang, Rhysida, LockBit, CL0P, BlackBasta, Warlock (Water Manaul). Registered at 30 N Gould St, Sheridan WY — an address linked to 200,000+ shell companies, documented by ICIJ in connection with fraud and sanctions evasion. Warlock C2 endpoint 198.13.158.193 confirmed hosted on this infrastructure.


# scan_results

ip: 196.251.72.116
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
vulnerabilities: {"count": 120}
c2_indicators: ["empire", "custom_c2", "gh0st_rat", "databases", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "53", "80", "110", "135", "139", "143", "443", "445", "3306", "3389", "5000", "5985", "8443", "8880"]

services:
  {"c2_frameworks": ["empire", "custom_c2", "gh0st_rat", "databases", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}

raw_data:
  ### 196.251.72.116 (Risk Score: 870)

  **C2 Frameworks:** empire, custom_c2, gh0st_rat, databases, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 53, 80, 110, 135, 139, 143, 443, 445, 3306, 3389, 5000, 5985, 8443, 8880  
  **Vulnerabilities:** 120  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.71.64
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
vulnerabilities: {"count": 129}
c2_indicators: ["gh0st_rat", "databases", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "443", "445", "3306", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669"]

services:
  {"c2_frameworks": ["gh0st_rat", "databases", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}

raw_data:
  ### 196.251.71.64 (Risk Score: 815)

  **C2 Frameworks:** gh0st_rat, databases, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 443, 445, 3306, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669  
  **Vulnerabilities:** 129  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.70.92
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 127}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "443", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670"]

raw_data:
  ### 196.251.70.92 (Risk Score: 785)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 443, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670  
  **Vulnerabilities:** 127  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.71.223
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 127}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "443", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49676"]

raw_data:
  ### 196.251.71.223 (Risk Score: 785)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 443, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49676  
  **Vulnerabilities:** 127  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.69.83
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
open_ports: ["0", "80", "443", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 125}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.83 (Risk Score: 735)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389  
  **Vulnerabilities:** 125  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.72.119
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
open_ports: ["0", "80", "443", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 125}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.119 (Risk Score: 735)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389  
  **Vulnerabilities:** 125  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.69.79
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
vulnerabilities: {"count": 76}
c2_indicators: ["empire", "gh0st_rat", "rdp", "smb", "squid"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "445", "3389", "5985", "8080", "49664", "49665", "49666", "49667", "49668", "49669", "49670"]

services:
  {"c2_frameworks": ["empire", "gh0st_rat", "rdp", "smb", "squid"], "lateral_movement": ["RDP", "SMB"]}

raw_data:
  ### 196.251.69.79 (Risk Score: 585)

  **C2 Frameworks:** empire, gh0st_rat, rdp, smb, squid  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 445, 3389, 5985, 8080, 49664, 49665, 49666, 49667, 49668, 49669, 49670  
  **Vulnerabilities:** 76  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: squid

  ---


ip: 196.251.69.100
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
open_ports: ["0", "22", "80", "5000", "8080", "8081"]
vulnerabilities: {"count": 55}
c2_indicators: ["empire", "custom_c2", "gh0st_rat", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["empire", "custom_c2", "gh0st_rat", "ssh", "squid"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.69.100 (Risk Score: 560)

  **C2 Frameworks:** empire, custom_c2, gh0st_rat, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 5000, 8080, 8081  
  **Vulnerabilities:** 55  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.72.19
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
vulnerabilities: {"count": 84}
c2_indicators: ["gh0st_rat", "databases", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "443", "445", "3306", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157"]

services:
  {"c2_frameworks": ["gh0st_rat", "databases", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}

raw_data:
  ### 196.251.72.19 (Risk Score: 535)

  **C2 Frameworks:** gh0st_rat, databases, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 443, 445, 3306, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157  
  **Vulnerabilities:** 84  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.69.251
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: CRITICAL
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 79}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "443", "445", "3389", "5985", "7070", "49664", "49665", "49666", "49667", "49668", "49670"]

raw_data:
  ### 196.251.69.251 (Risk Score: 505)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 443, 445, 3389, 5985, 7070, 49664, 49665, 49666, 49667, 49668, 49670  
  **Vulnerabilities:** 79  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.69.183
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "443", "1966", "6080"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 71}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.183 (Risk Score: 415)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 1966, 6080  
  **Vulnerabilities:** 71  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.67
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
vulnerabilities: {"count": 112}
c2_indicators: ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "21", "22", "53", "80", "110", "111", "143", "443", "465", "587", "993", "995", "2030", "2082"]

services:
  {"c2_frameworks": ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.69.67 (Risk Score: 370)

  **C2 Frameworks:** gh0st_rat, databases, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 110, 111, 143, 443, 465, 587, 993, 995, 2030, 2082  
  **Vulnerabilities:** 112  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 176.65.134.16
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
vulnerabilities: {"count": 1}
c2_indicators: ["metasploit", "empire", "custom_c2", "gh0st_rat", "databases", "rdp", "ssh", "squid"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "22", "80", "1286", "1289", "1292", "1294", "1297", "1298", "1301", "1307", "1314", "1317", "1322", "1323"]

services:
  {"c2_frameworks": ["metasploit", "empire", "custom_c2", "gh0st_rat", "databases", "rdp", "ssh", "squid"], "lateral_movement": ["RDP", "SSH"]}

raw_data:
  ### 176.65.134.16 (Risk Score: 270)

  **C2 Frameworks:** metasploit, empire, custom_c2, gh0st_rat, databases, rdp, ssh, squid  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 80, 1286, 1289, 1292, 1294, 1297, 1298, 1301, 1307, 1314, 1317, 1322, 1323  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: metasploit
  - Port signature: empire
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: rdp
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.71.238
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 28}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.238 (Risk Score: 270)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 28  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.89
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "1080", "3128"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "socks", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 17}
c2_indicators: ["gh0st_rat", "ssh", "socks", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.89 (Risk Score: 250)

  **C2 Frameworks:** gh0st_rat, ssh, socks, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 1080, 3128  
  **Vulnerabilities:** 17  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: socks
  - Port signature: squid

  ---


ip: 196.251.69.110
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "2222", "3306", "8080"]
vulnerabilities: {"count": 17}
c2_indicators: ["empire", "gh0st_rat", "databases", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["empire", "gh0st_rat", "databases", "ssh", "squid"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.69.110 (Risk Score: 240)

  **C2 Frameworks:** empire, gh0st_rat, databases, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 2222, 3306, 8080  
  **Vulnerabilities:** 17  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.69.108
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.108 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.111
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 30}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.111 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 30  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.119
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.119 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.125
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.125 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.128
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 31}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.128 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 31  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.130
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.130 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.131
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 31}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.131 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 31  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.133
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.133 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.178
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: HIGH
open_ports: ["0", "22", "80", "443", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.178 (Risk Score: 210)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.94
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
vulnerabilities: {"count": 11}
c2_indicators: ["gh0st_rat", "ftp_exfil", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "21", "80", "135", "139", "443", "445", "593", "3389", "5504", "5985", "49152", "49153", "49154", "49155"]

services:
  {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}

raw_data:
  ### 196.251.69.94 (Risk Score: 195)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 21, 80, 135, 139, 443, 445, 593, 3389, 5504, 5985, 49152, 49153, 49154, 49155  
  **Vulnerabilities:** 11  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.72.10
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "443", "465", "587", "993", "995", "3306", "7777", "8888"]
vulnerabilities: {"count": 22}
c2_indicators: ["custom_c2", "gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["custom_c2", "gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.72.10 (Risk Score: 190)

  **C2 Frameworks:** custom_c2, gh0st_rat, databases, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 443, 465, 587, 993, 995, 3306, 7777, 8888  
  **Vulnerabilities:** 22  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.29
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 21}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "443", "445", "593", "3389", "5504", "7070", "49152", "49153", "49154", "49155", "49156", "49158"]

raw_data:
  ### 196.251.70.29 (Risk Score: 180)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 443, 445, 593, 3389, 5504, 7070, 49152, 49153, 49154, 49155, 49156, 49158  
  **Vulnerabilities:** 21  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.70.30
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 19}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "443", "445", "593", "3389", "5504", "7070", "49152", "49153", "49154", "49155", "49156", "49157"]

raw_data:
  ### 196.251.70.30 (Risk Score: 180)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 443, 445, 593, 3389, 5504, 7070, 49152, 49153, 49154, 49155, 49156, 49157  
  **Vulnerabilities:** 19  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.71.225
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 21}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "443", "445", "593", "3389", "5504", "7070", "49152", "49153", "49154", "49155", "49156", "49157"]

raw_data:
  ### 196.251.71.225 (Risk Score: 180)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 443, 445, 593, 3389, 5504, 7070, 49152, 49153, 49154, 49155, 49156, 49157  
  **Vulnerabilities:** 21  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.71.249
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 21}
c2_indicators: ["gh0st_rat", "rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "443", "445", "593", "3389", "5504", "7070", "49152", "49153", "49154", "49155", "49156", "49157"]

raw_data:
  ### 196.251.71.249 (Risk Score: 180)

  **C2 Frameworks:** gh0st_rat, rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 443, 445, 593, 3389, 5504, 7070, 49152, 49153, 49154, 49155, 49156, 49157  
  **Vulnerabilities:** 21  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 194.85.251.160
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "123", "143", "443", "993", "995", "7777", "8888"]
vulnerabilities: {"count": 17}
c2_indicators: ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 194.85.251.160 (Risk Score: 165)

  **C2 Frameworks:** custom_c2, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 123, 143, 443, 993, 995, 7777, 8888  
  **Vulnerabilities:** 17  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 176.65.134.253
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.253 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 194.85.251.32
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2096", "5555", "8443"]
services: {"c2_frameworks": ["metasploit", "empire", "gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["metasploit", "empire", "gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.32 (Risk Score: 160)

  **C2 Frameworks:** metasploit, empire, gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2096, 5555, 8443  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: metasploit
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.99
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "443", "993", "995", "7777", "8888"]
vulnerabilities: {"count": 12}
c2_indicators: ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 194.85.251.99 (Risk Score: 160)

  **C2 Frameworks:** custom_c2, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 443, 993, 995, 7777, 8888  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.113
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "443", "993", "995", "2222", "7777", "8888"]
vulnerabilities: {"count": 15}
c2_indicators: ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 194.85.251.113 (Risk Score: 160)

  **C2 Frameworks:** custom_c2, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 443, 993, 995, 2222, 7777, 8888  
  **Vulnerabilities:** 15  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.74
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 12}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.74 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.106
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 12}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.106 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.154
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "443", "465", "587", "993", "995", "7001", "7777", "8888"]
vulnerabilities: {"count": 19}
c2_indicators: ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
[cell repeats an earlier one in this file: 101 characters]

raw_data:
  ### 196.251.69.154 (Risk Score: 160)

  **C2 Frameworks:** custom_c2, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 443, 465, 587, 993, 995, 7001, 7777, 8888  
  **Vulnerabilities:** 19  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.180
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.180 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.185
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "443", "888", "3306"]
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.69.185 (Risk Score: 160)

  **C2 Frameworks:** gh0st_rat, databases, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 443, 888, 3306  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.95
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 12}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.95 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.170
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "443", "465", "587", "993", "995", "7777", "8888"]
vulnerabilities: {"count": 19}
c2_indicators: ["custom_c2", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
[cell repeats an earlier one in this file: 101 characters]

raw_data:
  ### 196.251.70.170 (Risk Score: 160)

  **C2 Frameworks:** custom_c2, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 443, 465, 587, 993, 995, 7777, 8888  
  **Vulnerabilities:** 19  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.211
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.211 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.70.212
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.212 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.70.213
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.213 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.70.232
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "1194", "4444", "8000", "8080"]
services: {"c2_frameworks": ["metasploit", "empire", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["metasploit", "empire", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.232 (Risk Score: 160)

  **C2 Frameworks:** metasploit, empire, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 1194, 4444, 8000, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: metasploit
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.70.242
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 12}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.242 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.6
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.6 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.71.57
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "443", "888", "3306", "7080", "8188"]
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.71.57 (Risk Score: 160)

  **C2 Frameworks:** gh0st_rat, databases, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 443, 888, 3306, 7080, 8188  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.138
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "443", "888", "3306"]
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "databases", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
[cell repeats an earlier one in this file: 101 characters]

raw_data:
  ### 196.251.71.138 (Risk Score: 160)

  **C2 Frameworks:** gh0st_rat, databases, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 443, 888, 3306  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.25
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 10}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.25 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.134
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "123", "3306", "8080", "8888"]
vulnerabilities: {"count": 2}
c2_indicators: ["empire", "custom_c2", "databases", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
services:
  {"c2_frameworks": ["empire", "custom_c2", "databases", "ssh", "squid"], "lateral_movement": ["SSH"]}

raw_data:
  ### 196.251.72.134 (Risk Score: 160)

  **C2 Frameworks:** empire, custom_c2, databases, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 123, 3306, 8080, 8888  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: custom_c2
  - Port signature: databases
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.72.185
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 10}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.185 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.230
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 12}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.230 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.248
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "106", "110", "143", "443", "465", "993", "995", "8443", "8880"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["empire", "gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.248 (Risk Score: 160)

  **C2 Frameworks:** empire, gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 106, 110, 143, 443, 465, 993, 995, 8443, 8880  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.150
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "1701", "3128", "3389"]
services: {"c2_frameworks": ["rdp", "ssh", "squid", "vpn"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["rdp", "ssh", "squid", "vpn"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.150 (Risk Score: 150)

  **C2 Frameworks:** rdp, ssh, squid, vpn  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 443, 1701, 3128, 3389  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.72.153
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "3309", "9090"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 16}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.153 (Risk Score: 150)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 3309, 9090  
  **Vulnerabilities:** 16  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.159
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb", "ssh"], "lateral_movement": ["RDP", "SMB", "SSH"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb", "ssh"]
lateral_movement: ["RDP", "SMB", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "22", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49159"]

raw_data:
  ### 196.251.71.159 (Risk Score: 145)

  **C2 Frameworks:** rdp, smb, ssh  
  **Lateral Movement:** RDP, SMB, SSH  
  **Open Ports:** 0, 22, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49159  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb
  - Port signature: ssh

  ---


ip: 87.121.84.166
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "3000", "3050", "3187", "3256", "8080"]
services: {"c2_frameworks": ["empire", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 9}
c2_indicators: ["empire", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.166 (Risk Score: 140)

  **C2 Frameworks:** empire, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 3000, 3050, 3187, 3256, 8080  
  **Vulnerabilities:** 9  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.71.111
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "110", "143", "443", "587", "993", "3306", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 19}
c2_indicators: ["gh0st_rat", "databases", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.111 (Risk Score: 140)

  **C2 Frameworks:** gh0st_rat, databases, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 110, 143, 443, 587, 993, 3306, 3389  
  **Vulnerabilities:** 19  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.72.189
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "110", "143", "443", "465", "587", "993", "995", "8083"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 22}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.189 (Risk Score: 140)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 110, 143, 443, 465, 587, 993, 995, 8083  
  **Vulnerabilities:** 22  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.240
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "53", "80", "110", "143", "443", "465", "587", "993", "995", "8083"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 18}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.240 (Risk Score: 140)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 110, 143, 443, 465, 587, 993, 995, 8083  
  **Vulnerabilities:** 18  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.206
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8080"]
services: {"c2_frameworks": ["empire", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["empire", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.206 (Risk Score: 135)

  **C2 Frameworks:** empire, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8080  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.70.102
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["gh0st_rat", "rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "137", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49669", "49670", "49671"]

raw_data:
  ### 196.251.70.102 (Risk Score: 135)

  **C2 Frameworks:** gh0st_rat, rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 137, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49669, 49670, 49671  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.28
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["metasploit", "rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["metasploit", "rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5555", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49692"]

raw_data:
  ### 196.251.71.28 (Risk Score: 135)

  **C2 Frameworks:** metasploit, rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5555, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49692  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: metasploit
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.55
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["custom_c2", "rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["custom_c2", "rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "7777", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49932"]

raw_data:
  ### 196.251.71.55 (Risk Score: 135)

  **C2 Frameworks:** custom_c2, rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 7777, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49932  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.149
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "443", "445", "3389", "49664", "49665", "49666", "49667", "49668", "49669", "49672"]
services: {"c2_frameworks": ["rdp", "smb", "vpn"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb", "vpn"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.149 (Risk Score: 135)

  **C2 Frameworks:** rdp, smb, vpn  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 443, 445, 3389, 49664, 49665, 49666, 49667, 49668, 49669, 49672  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb
  - Port signature: vpn

  ---


ip: 196.251.72.94
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["gh0st_rat", "rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "445", "3000", "3389", "5985", "30001", "30002", "49664", "49665", "49666", "49667", "49669"]

raw_data:
  ### 196.251.72.94 (Risk Score: 135)

  **C2 Frameworks:** gh0st_rat, rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 445, 3000, 3389, 5985, 30001, 30002, 49664, 49665, 49666, 49667, 49669  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 87.121.84.100
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.100 (Risk Score: 130)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 87.121.84.108
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8443"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["empire", "gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.108 (Risk Score: 130)

  **C2 Frameworks:** empire, gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.21
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "53", "443", "8080"]
services: {"c2_frameworks": ["empire", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["empire", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.21 (Risk Score: 130)

  **C2 Frameworks:** empire, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 443, 8080  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 194.85.251.104
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "1488", "8443"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["empire", "gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.104 (Risk Score: 130)

  **C2 Frameworks:** empire, gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 1488, 8443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.93
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "3000", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.93 (Risk Score: 130)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 3000, 8080  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.69.109
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "5000"]
services: {"c2_frameworks": ["custom_c2", "gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["custom_c2", "gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.109 (Risk Score: 130)

  **C2 Frameworks:** custom_c2, gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 5000  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.164
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "1920", "2310", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ftp_exfil", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 7}
c2_indicators: ["gh0st_rat", "databases", "ftp_exfil", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.164 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, databases, ftp_exfil, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 1920, 2310, 3306  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: ssh

  ---


ip: 196.251.70.5
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.5 (Risk Score: 130)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.70.22
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["gh0st_rat", "rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49668", "49669", "49670", "49673"]

raw_data:
  ### 196.251.70.22 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49668, 49669, 49670, 49673  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.70.85
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "443", "465", "587", "993", "995", "2222", "20000"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 8}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.85 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 443, 465, 587, 993, 995, 2222, 20000  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.86
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "5001"]
services: {"c2_frameworks": ["custom_c2", "gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["custom_c2", "gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.86 (Risk Score: 130)

  **C2 Frameworks:** custom_c2, gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 5001  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.161
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "443", "888"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.161 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 443, 888  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.176
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 29}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "21", "22", "53", "80", "110", "143", "443", "465", "587", "993", "995", "2222", "10000", "20000"]

raw_data:
  ### 196.251.70.176 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 110, 143, 443, 465, 587, 993, 995, 2222, 10000, 20000  
  **Vulnerabilities:** 29  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.177
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 11}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "21", "22", "53", "80", "110", "143", "443", "465", "587", "993", "995", "2222", "10000", "20000"]

raw_data:
  ### 196.251.70.177 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 110, 143, 443, 465, 587, 993, 995, 2222, 10000, 20000  
  **Vulnerabilities:** 11  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.254
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "22", "53", "80", "110", "111", "143", "443", "465", "587", "993", "995", "2077", "2078", "2079"]

raw_data:
  ### 196.251.70.254 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 110, 111, 143, 443, 465, 587, 993, 995, 2077, 2078, 2079  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.12
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "22", "53", "80", "110", "111", "143", "443", "465", "587", "993", "995", "2077", "2078", "2079"]

raw_data:
  ### 196.251.71.12 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 110, 111, 143, 443, 465, 587, 993, 995, 2077, 2078, 2079  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.21
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["gh0st_rat", "rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "80", "135", "445", "3389", "5985", "49664", "49665", "49666", "49668", "49669", "49670", "49673"]

raw_data:
  ### 196.251.71.21 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 80, 135, 445, 3389, 5985, 49664, 49665, 49666, 49668, 49669, 49670, 49673  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.161
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "3306", "9000"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.161 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3306, 9000  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.184
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 32}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "21", "22", "53", "80", "110", "143", "443", "465", "587", "993", "995", "2222", "10000", "20000"]

raw_data:
  ### 196.251.71.184 (Risk Score: 130)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 53, 80, 110, 143, 443, 465, 587, 993, 995, 2222, 10000, 20000  
  **Vulnerabilities:** 32  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.242
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "8080"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.242 (Risk Score: 130)

  **C2 Frameworks:** empire, gh0st_rat, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.72.232
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "1194", "8080", "8443"]
services: {"c2_frameworks": ["empire", "ssh", "squid", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "ssh", "squid", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.232 (Risk Score: 130)

  **C2 Frameworks:** empire, ssh, squid, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 1194, 8080, 8443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.72.27
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "7080", "9999"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 9}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.27 (Risk Score: 125)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 7080, 9999  
  **Vulnerabilities:** 9  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.158
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "7080"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 9}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.158 (Risk Score: 125)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 7080  
  **Vulnerabilities:** 9  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.169
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "7080"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 9}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.169 (Risk Score: 125)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 7080  
  **Vulnerabilities:** 9  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.182
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "444", "1996", "2096", "8090", "8401", "8443"]
services: {"c2_frameworks": ["empire", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 13}
c2_indicators: ["empire", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.182 (Risk Score: 120)

  **C2 Frameworks:** empire, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 444, 1996, 2096, 8090, 8401, 8443  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.84
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "databases", "ftp_exfil", "vpn"], "lateral_movement": []}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "databases", "ftp_exfil", "vpn"]
lateral_movement: []
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "21", "53", "80", "110", "111", "143", "443", "465", "587", "993", "995", "2077", "2078", "2079"]

raw_data:
  ### 196.251.69.84 (Risk Score: 120)

  **C2 Frameworks:** gh0st_rat, databases, ftp_exfil, vpn  
  **Open Ports:** 0, 21, 53, 80, 110, 111, 143, 443, 465, 587, 993, 995, 2077, 2078, 2079  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ftp_exfil
  - Port signature: vpn

  ---


ip: 196.251.69.10
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "443", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.10 (Risk Score: 115)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.70.191
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "443", "3389", "5985"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.191 (Risk Score: 115)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.71.9
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "443", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.9 (Risk Score: 115)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.71.154
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "3389", "5000", "5985"]
services: {"c2_frameworks": ["custom_c2", "gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["custom_c2", "gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.154 (Risk Score: 115)

  **C2 Frameworks:** custom_c2, gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389, 5000, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.72.81
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "443", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.81 (Risk Score: 115)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.72.214
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "3389", "8080", "8081"]
services: {"c2_frameworks": ["empire", "rdp", "squid"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["empire", "rdp", "squid"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.214 (Risk Score: 115)

  **C2 Frameworks:** empire, rdp, squid  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 3389, 8080, 8081  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: rdp
  - Port signature: squid

  ---


ip: 176.65.134.11
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "2012", "2013", "2525"]
services: {"c2_frameworks": ["gh0st_rat"], "lateral_movement": []}
vulnerabilities: {"count": 28}
c2_indicators: ["gh0st_rat"]
lateral_movement: []
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.11 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat  
  **Open Ports:** 0, 80, 2012, 2013, 2525  
  **Vulnerabilities:** 28  

  **APT Indicators:**
  - Port signature: gh0st_rat

  ---


ip: 194.85.251.49
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 9}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.49 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 9  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 194.85.251.65
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8443"]
services: {"c2_frameworks": ["empire", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 7}
c2_indicators: ["empire", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.65 (Risk Score: 110)

  **C2 Frameworks:** empire, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8443  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.113
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 9}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.113 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 9  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.209
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.209 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.240
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 10}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.240 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.47
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 12}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "2022", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49671"]

raw_data:
  ### 196.251.71.47 (Risk Score: 110)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 2022, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49671  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.98
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.98 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.142
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 11}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "8889", "9998", "49664", "49665", "49666", "49667", "49668", "49669", "49672"]

raw_data:
  ### 196.251.71.142 (Risk Score: 110)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 8889, 9998, 49664, 49665, 49666, 49667, 49668, 49669, 49672  
  **Vulnerabilities:** 11  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.6
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "80", "443", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.6 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 443, 3389  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.72.69
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 12}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "1917", "3389", "5985", "49664", "49665", "49666", "49670", "49671", "49672", "49676", "49725"]

raw_data:
  ### 196.251.72.69 (Risk Score: 110)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 1917, 3389, 5985, 49664, 49665, 49666, 49670, 49671, 49672, 49676, 49725  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.225
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 13}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.225 (Risk Score: 110)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.62
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "49664", "49665", "49666", "49667", "49668", "49669", "49671", "49672"]

raw_data:
  ### 87.121.84.62 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 49664, 49665, 49666, 49667, 49668, 49669, 49671, 49672  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 194.85.251.19
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8888"]
services: {"c2_frameworks": ["custom_c2", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["custom_c2", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.19 (Risk Score: 105)

  **C2 Frameworks:** custom_c2, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8888  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.74
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8443"]
services: {"c2_frameworks": ["empire", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["empire", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.74 (Risk Score: 105)

  **C2 Frameworks:** empire, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.128
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8888"]
services: {"c2_frameworks": ["custom_c2", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["custom_c2", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.128 (Risk Score: 105)

  **C2 Frameworks:** custom_c2, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8888  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.226
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8443"]
services: {"c2_frameworks": ["empire", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["empire", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.226 (Risk Score: 105)

  **C2 Frameworks:** empire, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.17
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49671"]

raw_data:
  ### 196.251.69.17 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49671  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.60
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "445", "3389", "49664", "49665", "49666", "49667", "49669", "49670", "49678"]
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.60 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3389, 49664, 49665, 49666, 49667, 49669, 49670, 49678  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.69
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49673"]

raw_data:
  ### 196.251.69.69 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49673  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.71
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "7000", "49664", "49665", "49666", "49667", "49668", "49669", "65081", "65254"]

raw_data:
  ### 196.251.69.71 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 7000, 49664, 49665, 49666, 49667, 49668, 49669, 65081, 65254  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.86
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 14}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.86 (Risk Score: 105)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 14  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.91
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "445", "3389", "49152", "49153", "49154", "49155", "49156", "49157", "49158"]
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.91 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3389, 49152, 49153, 49154, 49155, 49156, 49157, 49158  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.103
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "8000", "49664", "49665", "49666", "49667", "49668", "49670", "49675", "49680"]

raw_data:
  ### 196.251.69.103 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 8000, 49664, 49665, 49666, 49667, 49668, 49670, 49675, 49680  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.121
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "445", "3389", "5985", "8000", "49664", "49665", "49666", "49667", "49668", "49670", "49675", "49680"]

raw_data:
  ### 196.251.69.121 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3389, 5985, 8000, 49664, 49665, 49666, 49667, 49668, 49670, 49675, 49680  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.126
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "53", "80", "110", "143", "443", "9999"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 10}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.126 (Risk Score: 105)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 110, 143, 443, 9999  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.166
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49157", "49159", "49168"]

raw_data:
  ### 196.251.69.166 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49157, 49159, 49168  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.216
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49161"]

raw_data:
  ### 196.251.69.216 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49161  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.220
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49869"]

raw_data:
  ### 196.251.69.220 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49869  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.233
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "94", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49157", "49158", "49159"]

raw_data:
  ### 196.251.69.233 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 94, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49157, 49158, 49159  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.70.35
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49671"]

raw_data:
  ### 196.251.70.35 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49671  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.70.112
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49859"]

raw_data:
  ### 196.251.70.112 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49859  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.70.217
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49672", "50636"]

raw_data:
  ### 196.251.70.217 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49672, 50636  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.5
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49687"]
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 6}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.5 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49687  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.44
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "445", "3387", "3389", "49664", "49665", "49666", "49667", "49668", "49673", "49674"]
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 6}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.44 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3387, 3389, 49664, 49665, 49666, 49667, 49668, 49673, 49674  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.53
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 11}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "7070", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49671"]

raw_data:
  ### 196.251.71.53 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 7070, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49671  
  **Vulnerabilities:** 11  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.80
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49897"]

raw_data:
  ### 196.251.71.80 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49897  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.91
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "445", "3389", "5985", "8000", "49664", "49665", "49666", "49667", "49668", "49670", "49675", "49680"]

raw_data:
  ### 196.251.71.91 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3389, 5985, 8000, 49664, 49665, 49666, 49667, 49668, 49670, 49675, 49680  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.158
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49158"]

raw_data:
  ### 196.251.71.158 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49158  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.171
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "445", "3389", "5421", "49664", "49665", "49666", "49667", "49668", "49669", "49670"]
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.171 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 445, 3389, 5421, 49664, 49665, 49666, 49667, 49668, 49669, 49670  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.181
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49158"]

raw_data:
  ### 196.251.71.181 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49158  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.192
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49159"]

raw_data:
  ### 196.251.71.192 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49159  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.194
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49159"]

raw_data:
  ### 196.251.71.194 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49159  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.198
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49679"]

raw_data:
  ### 196.251.71.198 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49679  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.243
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49669", "49670", "49684", "49795"]

raw_data:
  ### 196.251.71.243 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49669, 49670, 49684, 49795  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.35
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "135", "139", "445", "3389", "49152", "49153", "49154", "49155", "49156", "49157"]
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 12}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.35 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 49152, 49153, 49154, 49155, 49156, 49157  
  **Vulnerabilities:** 12  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.56
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49686"]

raw_data:
  ### 196.251.72.56 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49686  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.83
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 13}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49152", "49153", "49154", "49155", "49156", "49157", "49158"]

raw_data:
  ### 196.251.72.83 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49152, 49153, 49154, 49155, 49156, 49157, 49158  
  **Vulnerabilities:** 13  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.93
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 10}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "2404", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49672", "50481"]

raw_data:
  ### 196.251.72.93 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 2404, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49672, 50481  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.115
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "52273"]

raw_data:
  ### 196.251.72.115 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 52273  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.121
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 10}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "2404", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49672", "51435"]

raw_data:
  ### 196.251.72.121 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 2404, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49672, 51435  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.122
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49671", "49676"]

raw_data:
  ### 196.251.72.122 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49671, 49676  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.125
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49669", "49670", "49671", "49690"]

raw_data:
  ### 196.251.72.125 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49669, 49670, 49671, 49690  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.146
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "1988", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49673"]

raw_data:
  ### 196.251.72.146 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 1988, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49673  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.179
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49672", "49757"]

raw_data:
  ### 196.251.72.179 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49672, 49757  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.190
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49669", "49670", "49673", "50068"]

raw_data:
  ### 196.251.72.190 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49669, 49670, 49673, 50068  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.219
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "6000", "49664", "49665", "49666", "49667", "49668", "49669", "56783", "57172"]

raw_data:
  ### 196.251.72.219 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 6000, 49664, 49665, 49666, 49667, 49668, 49669, 56783, 57172  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.221
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49671"]

raw_data:
  ### 196.251.72.221 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49671  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.72.223
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 8}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49669", "49670", "49678"]

raw_data:
  ### 196.251.72.223 (Risk Score: 105)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49669, 49670, 49678  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 87.121.84.29
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8888"]
services: {"c2_frameworks": ["custom_c2", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["custom_c2", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.29 (Risk Score: 100)

  **C2 Frameworks:** custom_c2, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8888  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.84
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.84 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.127
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8000", "8001", "9000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.127 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8000, 8001, 9000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.253
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.253 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 176.65.134.3
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.3 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 176.65.134.254
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.254 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.42
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "5678"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.42 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 5678  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.44
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "8443"]
services: {"c2_frameworks": ["empire", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["empire", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.44 (Risk Score: 100)

  **C2 Frameworks:** empire, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.47
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "123", "143", "993", "995", "1500"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 15}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.47 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 123, 143, 993, 995, 1500  
  **Vulnerabilities:** 15  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh

  ---


ip: 194.85.251.48
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.48 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.51
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.51 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.61
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.61 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.102
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "27017"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.102 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 27017  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 194.85.251.107
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.107 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.163
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.163 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.167
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.167 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.178
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "8080"]
services: {"c2_frameworks": ["empire", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.178 (Risk Score: 100)

  **C2 Frameworks:** empire, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 194.85.251.184
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.184 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.185
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "5001"]
services: {"c2_frameworks": ["custom_c2", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["custom_c2", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.185 (Risk Score: 100)

  **C2 Frameworks:** custom_c2, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 5001  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.195
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.195 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.234
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.234 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.9
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "81", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.9 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 81, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.13
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.13 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.18
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2022"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.18 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2022  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.34
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.34 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.42
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.42 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.44
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.44 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.49
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "3000", "5432"]
services: {"c2_frameworks": ["databases", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["databases", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.49 (Risk Score: 100)

  **C2 Frameworks:** databases, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 3000, 5432  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: databases
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.57
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.57 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.59
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.59 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.75
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "8443"]
services: {"c2_frameworks": ["empire", "gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.75 (Risk Score: 100)

  **C2 Frameworks:** empire, gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 8443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.97
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2022"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.97 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2022  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.107
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2022"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.107 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2022  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.115
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49670", "49671"]

raw_data:
  ### 196.251.69.115 (Risk Score: 100)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49670, 49671  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.69.122
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "110", "143", "465", "587", "993", "995", "7080"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 14}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.122 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 110, 143, 465, 587, 993, 995, 7080  
  **Vulnerabilities:** 14  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh

  ---


ip: 196.251.69.144
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.144 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.146
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "10000", "20000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.146 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 10000, 20000  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.155
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "53", "80", "443", "8081", "8880"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.155 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 443, 8081, 8880  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.157
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2022"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.157 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2022  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.197
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.197 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.205
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2022"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.205 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2022  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.207
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "6001", "6002", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.207 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 6001, 6002, 8000  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.208
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.208 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.230
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.230 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.231
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.231 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.232
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.232 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.239
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "8000", "8002"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.239 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 8000, 8002  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.246
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.246 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.28
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "53", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.28 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.49
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "443", "5000"]
services: {"c2_frameworks": ["custom_c2", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["custom_c2", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.49 (Risk Score: 100)

  **C2 Frameworks:** custom_c2, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 5000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.54
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.54 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.72
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "5555"]
services: {"c2_frameworks": ["metasploit", "gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["metasploit", "gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.72 (Risk Score: 100)

  **C2 Frameworks:** metasploit, gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 5555  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: metasploit
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.75
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "110", "143", "443", "9999"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.75 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 110, 143, 443, 9999  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.76
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 11}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "22", "53", "80", "443", "2077", "2078", "2079", "2080", "2082", "2083", "2086", "2087", "2091", "2095"]

raw_data:
  ### 196.251.70.76 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 443, 2077, 2078, 2079, 2080, 2082, 2083, 2086, 2087, 2091, 2095  
  **Vulnerabilities:** 11  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.77
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.77 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.89
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.89 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.101
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.101 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.124
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "6001", "6002", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.124 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 6001, 6002, 8000  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.133
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.133 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.153
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "6001", "6002", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.153 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 6001, 6002, 8000  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.163
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "89", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.163 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 89, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.168
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.168 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.181
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.181 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.188
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80", "9999", "19191"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.188 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80, 9999, 19191  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh

  ---


ip: 196.251.70.195
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "21", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ftp_exfil", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ftp_exfil", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.195 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ftp_exfil, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 21, 22, 80  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ftp_exfil
  - Port signature: ssh

  ---


ip: 196.251.70.203
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3001", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49670", "49672"]

raw_data:
  ### 196.251.70.203 (Risk Score: 100)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3001, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49670, 49672  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.70.230
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "27017"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.230 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 27017  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 196.251.70.234
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "6001", "6002", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.234 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 6001, 6002, 8000  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.238
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.238 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.3
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "5050", "5052", "5053", "5054", "5060", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.3 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 5050, 5052, 5053, 5054, 5060, 8000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.17
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.17 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.30
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "887", "888"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.30 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 887, 888  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.39
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "3001"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.39 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3001  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.70
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.70 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.71
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
services: {"c2_frameworks": ["rdp", "smb"], "lateral_movement": ["RDP", "SMB"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "smb"]
lateral_movement: ["RDP", "SMB"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "135", "139", "445", "3389", "5985", "49664", "49665", "49666", "49667", "49668", "49670", "49671"]

raw_data:
  ### 196.251.71.71 (Risk Score: 100)

  **C2 Frameworks:** rdp, smb  
  **Lateral Movement:** RDP, SMB  
  **Open Ports:** 0, 135, 139, 445, 3389, 5985, 49664, 49665, 49666, 49667, 49668, 49670, 49671  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: smb

  ---


ip: 196.251.71.79
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2022"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.79 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2022  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.85
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "8080"]
services: {"c2_frameworks": ["empire", "ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.85 (Risk Score: 100)

  **C2 Frameworks:** empire, ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 8080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 196.251.71.93
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.93 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.128
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "3000", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.128 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3000, 8000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.147
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.147 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.157
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "2344", "5004", "32768"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.157 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 2344, 5004, 32768  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.164
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.164 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.165
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.165 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.172
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.172 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.178
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.178 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.195
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.195 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.208
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.208 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.212
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.212 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.234
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "7777"]
services: {"c2_frameworks": ["custom_c2", "gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["custom_c2", "gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.234 (Risk Score: 100)

  **C2 Frameworks:** custom_c2, gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 7777  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.237
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.237 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.13
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "3000", "4000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.13 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3000, 4000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.82
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.82 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.85
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.85 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.96
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "3306"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.96 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 3306  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 196.251.72.102
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.102 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.114
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.114 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.127
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "3000", "3100"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.127 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3000, 3100  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.147
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "1083", "27017"]
services: {"c2_frameworks": ["gh0st_rat", "databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.147 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 1083, 27017  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 196.251.72.161
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.161 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.163
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.163 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.192
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "1234", "3000"]
services: {"c2_frameworks": ["back_orifice", "gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["back_orifice", "gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.192 (Risk Score: 100)

  **C2 Frameworks:** back_orifice, gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 1234, 3000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: back_orifice
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.72.205
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "3000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.205 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 3000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.242
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443", "444", "3478", "5223", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.242 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443, 444, 3478, 5223, 8000  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.243
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.243 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.72.246
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: MEDIUM
open_ports: ["0", "22", "53", "80", "443"]
services: {"c2_frameworks": ["gh0st_rat", "ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.246 (Risk Score: 100)

  **C2 Frameworks:** gh0st_rat, ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 80, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.36
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "443", "5555", "8443"]
services: {"c2_frameworks": ["metasploit", "empire", "vpn"], "lateral_movement": []}
vulnerabilities: {"count": 4}
c2_indicators: ["metasploit", "empire", "vpn"]
lateral_movement: []
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.36 (Risk Score: 95)

  **C2 Frameworks:** metasploit, empire, vpn  
  **Open Ports:** 0, 443, 5555, 8443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: metasploit
  - Port signature: empire
  - Port signature: vpn

  ---


ip: 196.251.69.80
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "443", "3389"]
services: {"c2_frameworks": ["rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 10}
c2_indicators: ["rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.80 (Risk Score: 95)

  **C2 Frameworks:** rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 443, 3389  
  **Vulnerabilities:** 10  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 196.251.70.53
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.53 (Risk Score: 95)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 3389  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 196.251.71.253
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.253 (Risk Score: 95)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 3389  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 196.251.72.39
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 7}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.39 (Risk Score: 95)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 3389  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 176.65.134.19
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.19 (Risk Score: 90)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 3389  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 194.85.251.194
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "443", "1443", "2053", "3000", "3443", "7012", "8080", "41080"]
services: {"c2_frameworks": ["empire", "squid", "vpn"], "lateral_movement": []}
vulnerabilities: {"count": 1}
c2_indicators: ["empire", "squid", "vpn"]
lateral_movement: []
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.194 (Risk Score: 90)

  **C2 Frameworks:** empire, squid, vpn  
  **Open Ports:** 0, 443, 1443, 2053, 3000, 3443, 7012, 8080, 41080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: squid
  - Port signature: vpn

  ---


ip: 196.251.69.114
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.114 (Risk Score: 90)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 3389  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 196.251.70.150
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "1716", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.150 (Risk Score: 90)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 1716, 3389  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 196.251.71.62
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "443", "2572", "5000"]
services: {"c2_frameworks": ["custom_c2", "gh0st_rat", "vpn"], "lateral_movement": []}
vulnerabilities: {"count": 1}
c2_indicators: ["custom_c2", "gh0st_rat", "vpn"]
lateral_movement: []
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.62 (Risk Score: 90)

  **C2 Frameworks:** custom_c2, gh0st_rat, vpn  
  **Open Ports:** 0, 80, 443, 2572, 5000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: gh0st_rat
  - Port signature: vpn

  ---


ip: 196.251.72.139
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3389"]
services: {"c2_frameworks": ["rdp", "ssh"], "lateral_movement": ["RDP", "SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["rdp", "ssh"]
lateral_movement: ["RDP", "SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.139 (Risk Score: 90)

  **C2 Frameworks:** rdp, ssh  
  **Lateral Movement:** RDP, SSH  
  **Open Ports:** 0, 22, 3389  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: ssh

  ---


ip: 196.251.69.22
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389", "5985"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.22 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.69.32
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389", "5985"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.32 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.69.188
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.188 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.71.214
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389", "5985"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.214 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.72.180
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.180 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.72.228
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389", "5985"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.228 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.72.237
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389", "5985"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.237 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389, 5985  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 196.251.72.245
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "3389"]
services: {"c2_frameworks": ["gh0st_rat", "rdp"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "rdp"]
lateral_movement: ["RDP"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.245 (Risk Score: 85)

  **C2 Frameworks:** gh0st_rat, rdp  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 80, 3389  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: rdp

  ---


ip: 194.85.251.85
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "7001", "7003", "7004", "7005"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 8}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.85 (Risk Score: 80)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 7001, 7003, 7004, 7005  
  **Vulnerabilities:** 8  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.134
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096", "27008"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 7}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.134 (Risk Score: 80)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096, 27008  
  **Vulnerabilities:** 7  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.22
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.22 (Risk Score: 80)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.71.25
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "6379"]
services: {"c2_frameworks": ["databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.25 (Risk Score: 80)

  **C2 Frameworks:** databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 6379  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 196.251.72.58
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "443", "3389"]
services: {"c2_frameworks": ["rdp", "vpn"], "lateral_movement": ["RDP"]}
vulnerabilities: {"count": 5}
c2_indicators: ["rdp", "vpn"]
lateral_movement: ["RDP"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.72.58 (Risk Score: 80)

  **C2 Frameworks:** rdp, vpn  
  **Lateral Movement:** RDP  
  **Open Ports:** 0, 443, 3389  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: rdp
  - Port signature: vpn

  ---


ip: 194.85.251.22
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.22 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.26
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.26 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.27
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.27 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.45
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.45 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.52
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.52 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.56
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.56 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.58
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.58 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.59
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.59 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.62
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.62 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.63
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2906"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 6}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.63 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2906  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.67
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2222"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 6}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.67 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2222  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.70
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.70 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.77
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "65000"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.77 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 65000  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.88
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.88 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.89
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.89 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.93
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.93 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.94
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.94 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.96
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.96 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.138
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.138 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.140
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "444"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.140 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 444  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.142
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.142 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.143
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.143 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.144
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.144 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.146
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.146 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.147
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.147 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.154
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.154 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.168
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.168 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.169
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.169 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.170
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "8443"]
services: {"c2_frameworks": ["empire", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["empire", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.170 (Risk Score: 75)

  **C2 Frameworks:** empire, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 8443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: empire
  - Port signature: ssh

  ---


ip: 194.85.251.175
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.175 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.176
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.176 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.180
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.180 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.181
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.181 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.190
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.190 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.191
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.191 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.197
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.197 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.205
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "65000"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.205 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 65000  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.208
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.208 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.214
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.214 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.228
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "500", "8181"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.228 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 500, 8181  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.229
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.229 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.230
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 5}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.230 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 5  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.231
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.231 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.250
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "65000"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.250 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 65000  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.251
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.251 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.253
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.253 (Risk Score: 75)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.8
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.8 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 87.121.84.18
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "1337"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.18 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 1337  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.23
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.23 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.26
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.26 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.47
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.47 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.53
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "3000", "3306", "27017"]
services: {"c2_frameworks": ["databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.53 (Risk Score: 70)

  **C2 Frameworks:** databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 3000, 3306, 27017  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 87.121.84.83
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.83 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.86
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "420", "501", "888"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.86 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 420, 501, 888  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 87.121.84.117
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 87.121.84.117 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 176.65.134.2
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "111", "3128", "4081", "5901", "5902", "5903", "8081"]
services: {"c2_frameworks": ["ssh", "squid"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "squid"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.2 (Risk Score: 70)

  **C2 Frameworks:** ssh, squid  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 111, 3128, 4081, 5901, 5902, 5903, 8081  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: squid

  ---


ip: 176.65.134.13
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 176.65.134.13 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.20
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.20 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.25
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.25 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.30
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.30 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.31
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.31 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.37
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2000", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.37 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2000, 2096  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.54
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.54 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.55
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.55 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.78
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.78 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.100
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.100 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 194.85.251.101
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.101 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 194.85.251.116
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.116 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.117
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.117 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.124
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.124 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.135
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "80", "443", "2022", "3000"]
services: {"c2_frameworks": ["gh0st_rat", "vpn"], "lateral_movement": []}
vulnerabilities: {"count": 6}
c2_indicators: ["gh0st_rat", "vpn"]
lateral_movement: []
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.135 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, vpn  
  **Open Ports:** 0, 80, 443, 2022, 3000  
  **Vulnerabilities:** 6  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: vpn

  ---


ip: 194.85.251.150
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.150 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.151
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.151 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.155
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.155 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.156
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.156 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.158
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.158 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.159
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.159 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.161
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.161 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.166
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096", "20001"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.166 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096, 20001  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.177
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "8081"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.177 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 8081  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.200
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.200 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.203
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.203 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.218
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "1995"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 2}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.218 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 1995  
  **Vulnerabilities:** 2  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.222
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2000"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.222 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.224
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.224 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.238
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "1080"]
services: {"c2_frameworks": ["ssh", "socks"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "socks"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.238 (Risk Score: 70)

  **C2 Frameworks:** ssh, socks  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 1080  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: socks

  ---


ip: 194.85.251.240
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.240 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 194.85.251.241
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443", "2096"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 194.85.251.241 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443, 2096  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.6
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.6 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.14
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.14 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.25
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.25 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.35
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.35 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.66
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
open_ports:
  ["0", "22", "80", "159", "160", "162", "163", "164", "165", "166", "167", "168", "169", "170", "171"]

raw_data:
  ### 196.251.69.66 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 159, 160, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.72
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.72 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.172
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "8000", "27017"]
services: {"c2_frameworks": ["databases", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["databases", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.172 (Risk Score: 70)

  **C2 Frameworks:** databases, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 8000, 27017  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: databases
  - Port signature: ssh

  ---


ip: 196.251.69.190
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.190 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.192
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "443"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.192 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 443  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.69.201
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.201 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.211
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "5050", "5052", "8000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.211 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 5050, 5052, 8000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.234
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.234 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.241
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.241 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.244
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.244 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.69.253
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "5000"]
services: {"c2_frameworks": ["custom_c2", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["custom_c2", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.69.253 (Risk Score: 70)

  **C2 Frameworks:** custom_c2, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 5000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh

  ---


ip: 196.251.70.12
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "9000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.12 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 9000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.25
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "1337"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.25 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 1337  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.39
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.39 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.73
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "5000"]
services: {"c2_frameworks": ["custom_c2", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["custom_c2", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.73 (Risk Score: 70)

  **C2 Frameworks:** custom_c2, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 5000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: custom_c2
  - Port signature: ssh

  ---


ip: 196.251.70.98
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "3000"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.98 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 3000  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.121
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "5060"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.121 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 5060  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.145
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.145 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.70.184
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "53", "443", "3000"]
services: {"c2_frameworks": ["ssh", "vpn"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 3}
c2_indicators: ["ssh", "vpn"]
lateral_movement: ["SSH"]
c2_confidence: scan_heuristic
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.184 (Risk Score: 70)

  **C2 Frameworks:** ssh, vpn  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 53, 443, 3000  
  **Vulnerabilities:** 3  

  **APT Indicators:**
  - Port signature: ssh
  - Port signature: vpn

  ---


ip: 196.251.70.221
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "3006"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.70.221 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 3006  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.11
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.11 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.15
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "487"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 4}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.15 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 487  
  **Vulnerabilities:** 4  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.35
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 1}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.35 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80  
  **Vulnerabilities:** 1  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


ip: 196.251.71.58
scan_id: Advanced Vulnerability Scan_bntfsz-20251023-093238
scan_date: 2025-10-23 09:32:38
source_file: APT-TARGETS-Infrastructure_Scan-A-20251023.md
classification: LOW
open_ports: ["0", "22", "80", "888"]
services: {"c2_frameworks": ["gh0st_rat", "ssh"], "lateral_movement": ["SSH"]}
vulnerabilities: {"count": 0}
c2_indicators: ["gh0st_rat", "ssh"]
lateral_movement: ["SSH"]
c2_confidence: multi_source
created_at: 2026-03-04 04:16:02
raw_data:
  ### 196.251.71.58 (Risk Score: 70)

  **C2 Frameworks:** gh0st_rat, ssh  
  **Lateral Movement:** SSH  
  **Open Ports:** 0, 22, 80, 888  
  **Vulnerabilities:** 0  

  **APT Indicators:**
  - Port signature: gh0st_rat
  - Port signature: ssh

  ---


