112.213.89.186 Threat Intelligence and Host Information

Feb 17, 2026 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 112.213.89.186 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 52/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1053 - Scheduled Task/Job, T1218 - Signed Binary Proxy Execution, T1220 - XSL Script Processing, T1564 - Hide Artifacts

  • Tags: adwind, adwind rat, agent tesla, agenttesla, aggah, alienspy, all at, amadey, ammyy, ammyy admin, andromut, angler, apart, april, asyncrat, august, aurora, ave maria, axpergle, azorult, belarus, bitcoin, bladabindi, bokbot, browserpassview, chacha, chanitor, chatgpt, chthonic, click, cloudeye, cobalt strike, cobaltstrike, copy, cridex, crimson, crimson rat, cryptbot, crysis, cve201711882, danabot, darkcomet, darkside, desktop, dharma, discord, dofoil, dridex, dunihi, dyre, egregor, emotet, eternalblue, execution, fallout, fareit, february, first, flawedammy, flawedammyy, formbook, friendly, gandcrab, glupteba, gootkit, gozi, guloader, hancitor, hawkeye, hermes, houdini, hunter, hworm, icedid, jenxcus, june, kill, killswitch, loader, lockbit, loki bot, lokibot, macos, mailpassview, mailto, maldoc, malspam, malware, march, mars, maze, mega, mexico, mimikatz, nanocore, nanocore rat, napoleon, nemty, netwalker, netwire, neutrino, next, njrat, nuclear, open, orcus, orcus rat, panda banker, path, phobos, pinkslipbot, poisonivy, polish, pony, powershell, predator, predator pain, psexec, qakbot, qbot, quasar, quasar rat, raccoon, racealer, ransom, ransomware, rats, recent blog, redline, redline stealer, remcos, revenge, revenge rat, revil, ryuk, ryuk ransomware, scarimson, screen, seen, servhelper, service, shadow, siplog, smokeldr, smoke loader, smokeloader, snake, sockrat, sodinokibi, spelevo, squirrelwaffle, sticky, systembc, teamspy, teamviewer, terdot, thief, track them, trickbot, trojan, troldesh, ukraine, ursnif, vawtrak, vidar, virustotal, wannacry, wcry ransomware, windigo, winrar, xtremerat, zbot, zloader

  • View other sources: Spamhaus VirusTotal

  • Country: Vietnam
  • Network:
  • Noticed: 1 times
  • Protocols Attacked: SSH

Malware Detected on Host

Count: 9 4c8ab541bcd80eda7fa76a924dccce263d3c1cd5cf6eab26b260206bde430ed6 c219ba259d75df800dea894b571abecb03875556ea43c9a75bf31c2919030659 cb82b30253c1cf05f2352074bac5f62afd3598d6b5054829d94a464f96e87e72 a0fbb191e41cd10ac4d3dc740ed6afaf33425446a494456d3fc06e24db19df7a 47cb9f3ee5d0d62b15196ff1f9b6ba4cb36c62bcc61c538a74e713c0d4877d68 97af861a537d69db9eadb5579188c7795ebf29c6a0e8a221a0fe891a1326c820 8c49d967642f2b11da2e592f741d6b3d168c02eb3231c1bb1b024b6aeec316e2 3ab4f7d2372dc7485ae62b92fcae3e114f5fc2078e4ab3d1366fa06dc2665826 3081ca99005f23aea1f0e44612ea7dc2d7b0497fe250522b7540ba18b9a127b1

Map

Whois Information

  • inetnum: 112.213.80.0 - 112.213.95.255
  • netname: SUPERDATA-VN
  • descr: SUPER ONLINE DATA JOINT STOCK COMPANY
  • descr: 196 Nguyen Dinh Chieu, Vo Thi Sau Ward, District 3, Ho Chi Minh City
  • country: VN
  • admin-c: PTTL3-AP
  • tech-c: PTTL3-AP
  • status: ALLOCATED PORTABLE
  • mnt-by: MAINT-VN-VNNIC
  • mnt-lower: MAINT-VN-VNNIC
  • mnt-routes: MAINT-VN-VNNIC
  • mnt-irt: IRT-VNNIC-AP
  • last-modified: 2024-12-21T09:09:52Z
  • irt: IRT-VNNIC-AP
  • address: Ha Noi, VietNam
  • phone: +84-24-35564944
  • fax-no: +84-24-37821462
  • e-mail: hm-changed@vnnic.vn
  • abuse-mailbox: hm-changed@vnnic.vn
  • admin-c: NTTT1-AP
  • tech-c: NTTT1-AP
  • mnt-by: MAINT-VN-VNNIC
  • last-modified: 2025-11-17T23:08:34Z
  • person: Pham Thi Thuy Linh
  • address: SUPERDATA-VN
  • country: VN
  • phone: +84-28-73035777
  • e-mail: info@superdata.vn
  • nic-hdl: PTTL3-AP
  • mnt-by: MAINT-VN-VNNIC
  • last-modified: 2018-04-11T01:50:18Z
  • route: 112.213.89.0/24
  • origin: AS45544
  • descr: Vietnam Internet Network Information Center (VNNIC)
  • mnt-by: MAINT-VN-VNNIC
  • last-modified: 2022-03-01T12:19:52Z

Links to attack logs

****** ****** ******

Share on: