RDAPNetwork SWISSNET (217.60.195.0 - 217.60.195.255), NL; Admin, GOLD-MNT, lir-ae-goldip-1-MNT.
- Org
- Admin, GOLD-MNT, lir-ae-goldip-1-MNT
- Range
- 217.60.195.0 - 217.60.195.255
- Country
- NL
- Network
- SWISSNET
Verdict
MALICIOUSMedium confidence
2Supporting signals
2Independent sources
2Recent observations
82 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 217.60.195.50
- ASN
- AS209373
- Holder
- SWISSNET-AS SWISSNET LLC
- Country
- Netherlands (NL)
- Network
- SWISSNET
- Prefix
- 217.60.195.0/24
- Open ports
- 135
- Tor exit
- No
- First seen
- 2026-09-17 (6 days before · ThreatFox)
- Last seen
- 2026-09-23 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for PureRAT at 75% confidence, today. | 75% | 0 days recent | Strong |
 VirusTotal | 5/89 vendors (5.6%) flag it: a low detection ratio. | 5/89 | 5 days recent | Suspicious |
| RDAP | Network SWISSNET (217.60.195.0 - 217.60.195.255), NL; Admin, GOLD-MNT, lir-ae-goldip-1-MNT. | — | — | Context |
 RIPEstat | Announced in 217.60.195.0/24 by AS209373 (SWISSNET-AS SWISSNET LLC). | — | — | Context |
 Shodan | Open ports 135. | — | — | Context |
Coverage · checked, no record: AlienVault OTX, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list · failed: GreyNoise
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for PureRAT at 75% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for PureRAT at 75% confidence, today.
- [VirusTotal] 5/89 vendors (5.6%) flag it: a low detection ratio.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
Links the indicator to PureRAT activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
All evidence
12 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for PureRAT at 75% confidence, today. | 75% | 0 days recent | Strong |
| VirusTotal | 5/89 vendors (5.6%) flag it: a low detection ratio. | 5/89 | 5 days recent | Suspicious |
| RDAP | Network SWISSNET (217.60.195.0 - 217.60.195.255), NL; Admin, GOLD-MNT, lir-ae-goldip-1-MNT. | — | — | Context |
| RIPEstat | Announced in 217.60.195.0/24 by AS209373 (SWISSNET-AS SWISSNET LLC). | — | — | Context |
| Shodan | Open ports 135. | — | — | Context |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for PureRAT at 75% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for PureRAT at 75% confidence, today.
- [VirusTotal] 5/89 vendors (5.6%) flag it: a low detection ratio.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
Links the indicator to PureRAT activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 217.60.195.50
- ASN
- AS209373
- Holder
- SWISSNET-AS SWISSNET LLC
- Country
- Netherlands (NL)
- Network
- SWISSNET
- Prefix
- 217.60.195.0/24
- Open ports
- 135
- Tor exit
- No
- First seen
- 2026-09-17 (6 days before · ThreatFox)
- Last seen
- 2026-09-23 (0 days before)
By source
RDAPRIPEstatAnnounced in 217.60.195.0/24 by AS209373 (SWISSNET-AS SWISSNET LLC).
- ASN
- 209373
- Holder
- SWISSNET-AS SWISSNET LLC
- Prefix
- 217.60.195.0/24
ShodanOpen ports 135.
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
Links the indicator to PureRAT activity; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNot collected for this investigation. Re-run to add it.
Evidence timeline
- 2026-09-18VirusTotal: 5/89 vendors (5.6%) flag it: a low detection ratio
- 2026-09-23ThreatFox: Listed as botnet_cc for PureRAT at 75% confidence, today
- 2026-09-23Investigated
Run history
4 collections of this indicator- 2026-09-29MALICIOUS94Stored evidenceOpen · newest
- 2026-09-27MALICIOUS94Live lookupsOpen
- 2026-09-23MALICIOUS82Live lookupsShown
- 2026-09-23MALICIOUS92Stored evidenceOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 217.60.195.50:56001 in the last 30 days.
- pivotPassive DNS: domains that resolved to 217.60.195.50.
- blockBlock 217.60.195.50 at the perimeter.
- enrichCheck other addresses in 217.60.195.0/24 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).