RDAPNetwork ORG-mA21-AFRINIC (102.112.0.0 - 102.119.255.255), MU; Norman Ghanty, Iqbal Janmahomed, Dheeraj Ramkhelawon.
- Org
- Norman Ghanty, Iqbal Janmahomed, Dheeraj Ramkhelawon
- Range
- 102.112.0.0 - 102.119.255.255
- Country
- MU
- Network
- ORG-mA21-AFRINIC
Verdict
MALICIOUSMedium confidence
1Supporting signals
1Independent sources
1Recent observations
82 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 102.117.165.95
- ASN
- AS23889
- Holder
- Mauritius Telecom Ltd - Mauritius Telecom Ltd
- Country
- Mauritius (MU)
- Network
- ORG-mA21-AFRINIC
- Prefix
- 102.117.160.0/20
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-09-25 (1 day before · ThreatFox)
- Last seen
- 2026-09-26 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for Unknown malware at 75% confidence, today. | 75% | 0 days recent | Strong |
 VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| RDAP | Network ORG-mA21-AFRINIC (102.112.0.0 - 102.119.255.255), MU; Norman Ghanty, Iqbal Janmahomed, Dheeraj Ramkhelawon. | — | — | Context |
 RIPEstat | Announced in 102.117.160.0/20 by AS23889 (Mauritius Telecom Ltd - Mauritius Telecom Ltd). | — | — | Context |
Coverage · checked, no record: Shodan, AlienVault OTX, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, DShield · failed: GreyNoise
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Unknown malware at 75% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Unknown malware at 75% confidence, today.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
Links the indicator to Unknown malware activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
13 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for Unknown malware at 75% confidence, today. | 75% | 0 days recent | Strong |
| VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| RDAP | Network ORG-mA21-AFRINIC (102.112.0.0 - 102.119.255.255), MU; Norman Ghanty, Iqbal Janmahomed, Dheeraj Ramkhelawon. | — | — | Context |
| RIPEstat | Announced in 102.117.160.0/20 by AS23889 (Mauritius Telecom Ltd - Mauritius Telecom Ltd). | — | — | Context |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 Shodan | No record. | — | — | No record |
 AlienVault OTX | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. Listed as botnet_cc for Unknown malware at 75% confidence, today. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [ThreatFox] Listed as botnet_cc for Unknown malware at 75% confidence, today.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
Links the indicator to Unknown malware activity; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 102.117.165.95
- ASN
- AS23889
- Holder
- Mauritius Telecom Ltd - Mauritius Telecom Ltd
- Country
- Mauritius (MU)
- Network
- ORG-mA21-AFRINIC
- Prefix
- 102.117.160.0/20
- Open ports
- None recorded
- Tor exit
- No
- First seen
- 2026-09-25 (1 day before · ThreatFox)
- Last seen
- 2026-09-26 (0 days before)
By source
RDAPRIPEstatAnnounced in 102.117.160.0/20 by AS23889 (Mauritius Telecom Ltd - Mauritius Telecom Ltd).
- ASN
- 23889
- Holder
- Mauritius Telecom Ltd - Mauritius Telecom Ltd
- Prefix
- 102.117.160.0/20
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
Links the indicator to Unknown malware activity; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-26VirusTotal: No vendor flags it (0 of 91)
- 2026-09-26ThreatFox: Listed as botnet_cc for Unknown malware at 75% confidence, today
- 2026-09-26Investigated
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 102.117.165.95:7443 in the last 30 days.
- pivotPassive DNS: domains that resolved to 102.117.165.95.
- blockBlock 102.117.165.95 at the perimeter.
- enrichCheck other addresses in 102.117.160.0/20 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).