RDAPNetwork Triple-C_5_144_49_0 (5.144.49.0 - 5.144.49.255), IL; CCC DNS REG, triplec-mnt, Abuse-C Role.
- Org
- CCC DNS REG, triplec-mnt, Abuse-C Role
- Range
- 5.144.49.0 - 5.144.49.255
- Country
- IL
- Network
- Triple-C_5_144_49_0
Verdict
SUSPICIOUSMedium confidence
1Supporting signals
1Independent sources
1Recent observations
52 / 100Threat score
Why the engine decided this
Deterministic engine · activity moderate- ABUSEIPDB_MODERATE_CONFIDENCE AbuseIPDB abuse confidence score is 25-74%.
Key indicators
- IP address
- 5.144.49.105
- ASN
- AS50463
- Holder
- TRIPLEC-ASN Triple C Cloud Computing Ltd.
- Country
- Israel (IL)
- Network
- Triple-C_5_144_49_0
- Prefix
- 5.144.48.0/20
- ISP
- Triple C 5 144 49 0
- Usage
- Fixed Line ISP
- Open ports
- 1434, 3389, 5985
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-23 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 AbuseIPDB | 66% abuse confidence (20 reports, newest today): a moderate signal; brute-force, port scan, hacking. | 66% | 0 days recent | Suspicious |
| RDAP | Network Triple-C_5_144_49_0 (5.144.49.0 - 5.144.49.255), IL; CCC DNS REG, triplec-mnt, Abuse-C Role. | — | — | Context |
 RIPEstat | Announced in 5.144.48.0/20 by AS50463 (TRIPLEC-ASN Triple C Cloud Computing Ltd.). | — | — | Context |
 Shodan | Open ports 1434, 3389, 5985. | — | — | Context |
 AlienVault OTX | Referenced in 7 community pulses, which are unverified. | — | — | Neutral |
 VirusTotal | Only 1/89 vendors (1.1%) flag it: an isolated detection, not corroboration. | 1/89 | 1 day recent | Neutral |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list · failed: GreyNoise
Analyst summary
Consistent with engineThis IP is suspicious (medium confidence). 66% abuse confidence (20 reports, newest today): a moderate signal; brute-force, port scan, hacking.
Why the evidence points to suspicious
- [AbuseIPDB] 66% abuse confidence (20 reports, newest today): a moderate signal; brute-force, port scan, hacking.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNot collected for this investigation. Re-run to add it.
All evidence
12 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| AbuseIPDB | 66% abuse confidence (20 reports, newest today): a moderate signal; brute-force, port scan, hacking. | 66% | 0 days recent | Suspicious |
| RDAP | Network Triple-C_5_144_49_0 (5.144.49.0 - 5.144.49.255), IL; CCC DNS REG, triplec-mnt, Abuse-C Role. | — | — | Context |
| RIPEstat | Announced in 5.144.48.0/20 by AS50463 (TRIPLEC-ASN Triple C Cloud Computing Ltd.). | — | — | Context |
| Shodan | Open ports 1434, 3389, 5985. | — | — | Context |
| AlienVault OTX | Referenced in 7 community pulses, which are unverified. | — | — | Neutral |
| VirusTotal | Only 1/89 vendors (1.1%) flag it: an isolated detection, not corroboration. | 1/89 | 1 day recent | Neutral |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- ABUSEIPDB_MODERATE_CONFIDENCEAbuseIPDB abuse confidence score is 25-74%.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineThis IP is suspicious (medium confidence). 66% abuse confidence (20 reports, newest today): a moderate signal; brute-force, port scan, hacking.
Why the evidence points to suspicious
- [AbuseIPDB] 66% abuse confidence (20 reports, newest today): a moderate signal; brute-force, port scan, hacking.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 5.144.49.105
- ASN
- AS50463
- Holder
- TRIPLEC-ASN Triple C Cloud Computing Ltd.
- Country
- Israel (IL)
- Network
- Triple-C_5_144_49_0
- Prefix
- 5.144.48.0/20
- ISP
- Triple C 5 144 49 0
- Usage
- Fixed Line ISP
- Open ports
- 1434, 3389, 5985
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-23 (0 days before)
By source
RDAPRIPEstatAnnounced in 5.144.48.0/20 by AS50463 (TRIPLEC-ASN Triple C Cloud Computing Ltd.).
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNot collected for this investigation. Re-run to add it.
Evidence timeline
- 2026-09-22VirusTotal: Only 1/89 vendors (1.1%) flag it: an isolated detection, not corroboration
- 2026-09-23AbuseIPDB: 66% abuse confidence (20 reports, newest today): a moderate signal
- 2026-09-23Investigated
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 5.144.49.105 in the last 30 days.
- pivotPassive DNS: domains that resolved to 5.144.49.105.
Pivot to other tools
Opens the indicator in the source's own site (new tab).