This IP address has been reported a total of
19
times from
11 distinct
sources.
193.239.154.132 was first reported on
, and the most recent report was
.
Old Reports:
The most recent abuse report for this IP address is from
. It is possible that this IP is no longer involved in abusive activities.
Source of spoofed email forging From: @atsoho.com domain. Observed via aggregated DMARC RUA reports. ...
show moreSource of spoofed email forging From: @atsoho.com domain. Observed via aggregated DMARC RUA reports.
Between 2026-05-13 and 2026-05-17, this IP and 250+ neighbors in 193.239.154.0/24 (AS136038 HDTIDC LIMITED / AS136526 ALLCLOUD LIMITED) sent over 11,000 spoofed emails forging the From header as our domain "atsoho.com".
All messages fail SPF and DKIM authentication against atsoho.com (DMARC enforced: p=quarantine). Legitimate atsoho.com mail is sent exclusively from Google Workspace, SocketLabs, and XServer.
Reporting receivers (sample): Mail.Ru, Microsoft (Enterprise Outlook), seznam.cz, JCOM, au.com, Yahoo, GMO Pepabo, GMO Internet.
WHOIS abuse-mailbox ([email protected]) is non-functional (550 5.1.1 rejection). APNIC and RIPE NCC have been notified of the invalid abuse contact.
show less
Wazuh Alert Evidence: May 15 23:16:10 pico-gw1 postfix/smtpd[3519232]: NOQUEUE: reject: RCPT from un ...
show moreWazuh Alert Evidence: May 15 23:16:10 pico-gw1 postfix/smtpd[3519232]: NOQUEUE: reject: RCPT from unknown[193.239.154.132]: 554 5.7.1 Service unavailable; Client host [193.239.154.132] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?193.239.154.132; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<zaq17695-nagano405.nagano.dream.jp>
show less
Dec 3 16:55:19 server postfix/smtpd[1846143]: connect from unknown[193.239.154.132]
Dec 3 16:55:20 ...
show moreDec 3 16:55:19 server postfix/smtpd[1846143]: connect from unknown[193.239.154.132]
Dec 3 16:55:20 server postfix/smtpd[1846143]: NOQUEUE: reject: RCPT from unknown[193.239.154.132]: 554 5.7.1 Service unavailable; Client host [193.239.154.132] blocked using zen.spamhaus.org; Listed by DROP, see https://check.spamhaus.org/sbl/query/SBL520298 / Listed by CSS, see https://check.spamhaus.org/query/ip/193.239.154.132 / Listed by XBL, see https://check.spamhaus.org/query/ip/193.239.154.132 / Listed by SBL, see https://check.spamhaus.org/sbl/query/SBL520298; from=<> to=<[email protected]> proto=ESMTP helo=<C202511282184705.local>
...
show less
The IP Address(193.239.154.132) has been active since February 22, 2022.
It seems that the domain, ...
show moreThe IP Address(193.239.154.132) has been active since February 22, 2022.
It seems that the domain, or rather, the IP has been abused in setting up phishing sites.
The abused website(s) are looked like still running(active).
You can access the phishing site only from your smartphone.
Phishing URL:
http://cfrreptdhz.duckdns.org/ja/main
http://cnsdqmjciu.duckdns.org/ja/main
ใปVirus Total
https://www.virustotal.com/gui/ip-address/193.239.154.132/relations
https://www.virustotal.com/gui/domain/cnsdqmjciu.duckdns.org/relations
https://www.virustotal.com/gui/domain/cfrreptdhz.duckdns.org/relations
ใปUrlscan
https://urlscan.io/result/d789238e-561f-4bdc-b043-07c29156109b/
https://urlscan.io/result/49343378-5f51-47a0-85ce-0a93cf8f3e3c/
For your information, the fraudulent website appears to be a forgery of this legitimate
website:
https://appleid.apple.com/ja_JP
Site owner:
Apple inc.
show less
Phishing mail is distributed from SMS. From February 22nd, 2022,
phishing URLs linked to IP address ...
show morePhishing mail is distributed from SMS. From February 22nd, 2022,
phishing URLs linked to IP address: 193.239.154.132
can be accessed only by smartphones.
Phishing URL:
http://jwxsueoqov.duckdns.org/ja/main
http://jxdefguwkm.duckdns.org/ja/main
http://kjiwkmacde.duckdns.org/ja/main
http://kkdpkenxkh.duckdns.org/ja/main
ใปVirus Total
https://www.virustotal.com/gui/ip-address/193.239.154.132/relations
ใปUrlscan
https://urlscan.io/result/87b479ab-51c3-4121-afd4-c1f90018fc9b/
https://urlscan.io/result/2b9c4d74-79ab-420d-93aa-f36f28ddeb03/
https://urlscan.io/result/00563be2-c22b-48b3-b969-a361742dd4d7/
https://urlscan.io/result/3fe807e0-9c3d-4fb5-b18d-1d2438464036/
Below are images of legitimate sites used
by phishing crime groups when accessing with iOS(iPhone).
https://appleid.apple.com/ja_JP
Website owner:
Apple inc.
show less
Phishing
Email Spam
Showing 1 to
15
of 19 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown ๐ฉ