RDAPNetwork SWISSNET (217.60.195.0 - 217.60.195.255), NL; Admin, GOLD-MNT, lir-ae-goldip-1-MNT.
- Org
- Admin, GOLD-MNT, lir-ae-goldip-1-MNT
- Range
- 217.60.195.0 - 217.60.195.255
- Country
- NL
- Network
- SWISSNET
Verdict
MALICIOUSHigh confidence
2Supporting signals
2Independent sources
2Recent observations
94 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- VT_MODERATE_DETECTION_RATIO 10-29% of VirusTotal vendors flag the indicator.
- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 217.60.195.50
- ASN
- AS209373
- Holder
- SWISSNET-AS SWISSNET LLC
- Country
- Netherlands (NL)
- Network
- SWISSNET
- Prefix
- 217.60.195.0/24
- Open ports
- 135
- Tor exit
- No
- First seen
- 2026-09-17 (10 days before · ThreatFox)
- Last seen
- 2026-09-27 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for PureRAT at 75% confidence, today. | 75% | 0 days recent | Strong |
 VirusTotal | 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority. | 15/91 | 1 day recent | Moderate |
| RDAP | Network SWISSNET (217.60.195.0 - 217.60.195.255), NL; Admin, GOLD-MNT, lir-ae-goldip-1-MNT. | — | — | Context |
 RIPEstat | Announced in 217.60.195.0/24 by AS209373 (SWISSNET-AS SWISSNET LLC). | — | — | Context |
 Shodan | Open ports 135. | — | — | Context |
 GreyNoise | Observed scanning; not classified malicious. | — | 9 days recent | Neutral |
Coverage · checked, no record: AlienVault OTX, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, DShield · failed: none
Analyst summary
Consistent with engineMalicious, high confidence. Listed as botnet_cc for PureRAT at 75% confidence, today. Independent sources corroborate it.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for PureRAT at 75% confidence, today.
- [VirusTotal] 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority.
Evidence reflects public intelligence at investigation time; it may change.
Attribution
Links the indicator to PureRAT activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
All evidence
13 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for PureRAT at 75% confidence, today. | 75% | 0 days recent | Strong |
| VirusTotal | 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority. | 15/91 | 1 day recent | Moderate |
| RDAP | Network SWISSNET (217.60.195.0 - 217.60.195.255), NL; Admin, GOLD-MNT, lir-ae-goldip-1-MNT. | — | — | Context |
| RIPEstat | Announced in 217.60.195.0/24 by AS209373 (SWISSNET-AS SWISSNET LLC). | — | — | Context |
| Shodan | Open ports 135. | — | — | Context |
| GreyNoise | Observed scanning; not classified malicious. | — | 9 days recent | Neutral |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- VT_MODERATE_DETECTION_RATIO10-29% of VirusTotal vendors flag the indicator.
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- MULTIPLE_CORROBORATING_SOURCESTwo or more independent source families agree.
Analyst summary
Consistent with engineMalicious, high confidence. Listed as botnet_cc for PureRAT at 75% confidence, today. Independent sources corroborate it.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for PureRAT at 75% confidence, today.
- [VirusTotal] 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority.
Evidence reflects public intelligence at investigation time; it may change.
Attribution
Links the indicator to PureRAT activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 217.60.195.50
- ASN
- AS209373
- Holder
- SWISSNET-AS SWISSNET LLC
- Country
- Netherlands (NL)
- Network
- SWISSNET
- Prefix
- 217.60.195.0/24
- Open ports
- 135
- Tor exit
- No
- First seen
- 2026-09-17 (10 days before · ThreatFox)
- Last seen
- 2026-09-27 (0 days before)
By source
RDAPRIPEstatAnnounced in 217.60.195.0/24 by AS209373 (SWISSNET-AS SWISSNET LLC).
- ASN
- 209373
- Holder
- SWISSNET-AS SWISSNET LLC
- Prefix
- 217.60.195.0/24
GreyNoiseRelationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
Links the indicator to PureRAT activity; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-18GreyNoise: Observed scanning
- 2026-09-26VirusTotal: 15/91 vendors (16.5%) flag it: moderate multi-vendor detection, well short of a majority
- 2026-09-27ThreatFox: Listed as botnet_cc for PureRAT at 75% confidence, today
- 2026-09-27Investigated
Run history
4 collections of this indicator- 2026-09-29MALICIOUS94Stored evidenceShown
- 2026-09-27MALICIOUS94Live lookupsOpen
- 2026-09-23MALICIOUS82Live lookupsOpen
- 2026-09-23MALICIOUS92Stored evidenceOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 217.60.195.50:56001 in the last 30 days.
- pivotPassive DNS: domains that resolved to 217.60.195.50.
- blockBlock 217.60.195.50 at the perimeter.
- enrichCheck other addresses in 217.60.195.0/24 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).