103.21.59.27 Threat Intelligence and Host Information

May 04, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 103.21.59.27 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 75/100

Host and Network Information

  • Mitre ATT&CK IDs: T1021.001 - Remote Desktop Protocol, T1027 - Obfuscated Files or Information, T1059 - Command and Scripting Interpreter, T1104 - Multi-Stage Channels, T1110 - Brute Force, T1125 - Video Capture, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1566 - Phishing, T1583.001 - Domains, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships

  • Tags: anydesk, as15169 as16509, as19871 as22612, as9002, business email compromise, c2, caas, cyber security, fraud, hosting, identifying, ioc, malicious, Nextray, parked domains, phishing, powershell, Rhadamanthys, russia, sandworm, scams, ssh hijacking, typosquatting

  • JARM: 29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158dd

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: cleanmx_phishing, hphosts_emd, hphosts_fsa, hphosts_hfs

Malware Detected on Host

Count: 62 5050aa15ae2665809374245eea91ebb52f03a2639941bcf044d8f6cb6602f589 763b3ccea810c3ad19251ac76bccd804b3291696900bab7c0f5f3c7b352616cf 5af9fd80bfdbd2613fd3c8b5dd5a2c84445e22ee599bba0979dd54ce6295b564 a473cfaba8c17c32c78fab3c2b4d96c6bc4c85bf8e1625b0685d35219933901f 3d91f9a7e6b4035a5c69f403b529dd1a398e4f05316e7ad9ddeeaaf624c471f5 90f0395e41f479e98d9ab159b7920dfbd83e1111106b852c903494c0bcd9e9af e6c32ec6965b96c741a2e916faa8c1e296d8da47474fe7feda65427c9565a705 1dcb0ddba0e38cebbb1208ecd56fbd296c7ef0a05021f0bd4aa637563bea58ee c01bebd9c69e3e6e0956f64fbdc6b64144e3b79ab8e16435b7d1c9bddfd7afd9 41d4f75198964d434d03c66f7cad5ecc31134e74e882f5be05de0a8337b2f5aa

Map

Whois Information

  • inetnum: 103.21.59.0 - 103.21.59.255
  • netname: PDRSOLUTIONSFZC-AP
  • descr: P.D.R Solutions FZC
  • country: IN
  • geoloc: 19.1140343 72.8921789
  • admin-c: PSFA1-AP
  • tech-c: PSFA1-AP
  • abuse-c: AI346-AP
  • status: ALLOCATED NON-PORTABLE
  • mnt-by: MAINT-IN-AP
  • mnt-irt: IRT-IN-GPX
  • last-modified: 2021-01-06T13:12:21Z
  • irt: IRT-IN-GPX
  • address: GPX India. Unit A-001 Boomerang Chandivali Farm Road Andheri East, Mumbai 400072, India
  • e-mail: ipadmin@publicdomainregistry.com
  • abuse-mailbox: abuse@publicdomainregistry.com
  • admin-c: PSFA1-AP
  • tech-c: PSFA1-AP
  • mnt-by: MAINT-IN-AP
  • last-modified: 2025-04-30T13:05:47Z
  • role: ABUSE INGPX
  • country: ZZ
  • address: GPX India. Unit A-001 Boomerang Chandivali Farm Road Andheri East, Mumbai 400072, India
  • phone: +000000000
  • e-mail: ipadmin@publicdomainregistry.com
  • admin-c: PSFA1-AP
  • tech-c: PSFA1-AP
  • nic-hdl: AI346-AP
  • abuse-mailbox: abuse@publicdomainregistry.com
  • mnt-by: APNIC-ABUSE
  • last-modified: 2025-04-30T13:05:47Z
  • role: PDR Solutions FZC administrator
  • address: P.D.R Solutions FZC,, F-20, Business Center 1,, Business Park, RAK Free Trade Zone, Ras Al Khaimah
  • country: AE
  • phone: +14152300648
  • fax-no: +14152300648
  • e-mail: abuse@publicdomainregistry.com
  • admin-c: PSFA1-AP
  • tech-c: PSFA1-AP
  • nic-hdl: PSFA1-AP
  • mnt-by: MAINT-PDRSOLUTIONSFZC-AP
  • last-modified: 2017-03-08T17:17:21Z

Links to attack logs

****** ****** ******

Share on: