162.215.252.26 Threat Intelligence and Host Information
ipinfopage
General
This page contains threat intelligence information for the IPv4 address 162.215.252.26 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.
🔴 High Risk — 75/100
Geographic Location
Host and Network Information
- View other sources: Spamhaus VirusTotal Shodan AbuseIPDB
- Country: United States
- Noticed: 30 times
- Protocols Attacked: SSH
- Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
- Tor Node: No
- Associated Malware Samples: 15
Tags
- anydesk
- as15169 as16509
- as19871 as22612
- as9002
- business email compromise
- c2
- caas
- cyber security
- fraud
- hosting
- identifying
- ioc
- malicious
- Nextray
- parked domains
- phishing
- scams
- ssh hijacking
- typosquatting
MITRE ATT&CK TTPs
- T1021.001 - Remote Desktop Protocol
- T1110 - Brute Force
- T1184 - SSH Hijacking
- T1192 - Spearphishing Link
- T1194 - Spearphishing via Service
- T1442 - Fake Developer Accounts
- T1454 - Malicious SMS Message
- T1566 - Phishing
- T1583.001 - Domains
- T1583.006 - Web Services
- T1585.001 - Social Media Accounts
- T1586 - Compromise Accounts
- T1591.002 - Business Relationships
Attack Log References
Whois Information
NetRange: 162.214.0.0 - 162.215.255.255
CIDR: 162.214.0.0/15
NetName: UNIFIEDLAYER-NETWORK-15
NetHandle: NET-162-214-0-0-1
Parent: NET162 (NET-162-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS46606
Organization: Unified Layer (BLUEH-2)
RegDate: 2013-05-22
Updated: 2013-12-19
Comment: This space is statically assigned.
Comment:
Comment: -----BEGIN CERTIFICATE-----MIIDjjCCAnYCCQDwxS01pbJjyDANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAlVUMQ4wDAYDVQQHDAVQcm92bzEMMAoGA1UECgwDRUlHMQ8wDQYDVQQLDAZOZXRvcHMxEjAQBgNVBAMMCWF3c19ieW9pcDEpMCcGCSqGSIb3DQEJARYaZWlnLW5ldC10ZWFtQGVuZHVyYW5jZS5jb20wHhcNMTgxMTEyMTg1ODAwWhcNMjgxMTA5MTg1ODAwWjCBiDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAlVUMQ4wDAYDVQQHDAVQcm92bzEMMAoGA1UECgwDRUlHMQ8wDQYDVQQLDAZOZXRvcHMxEjAQBgNVBAMMCWF3c19ieW9pcDEpMCcGCSqGSIb3DQEJARYaZWlnLW5ldC10ZWFtQGVuZHVyYW5jZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhYkPGFYv/471uwfSNRUiGwx1WiF7iM0GYbmwHBY7KAOruObkhZrgVUwFXVVlZZED1BPxigOsgGdUVQ01BYBTxcBCaxim9hnJW3dVROdZg4HS0zuHnntveWfhkalBeGJGPhsdyE7zULg8jf+18I9fRtG32Qmm6E35CuDp9HwKrHlhgqIYIQ9JQiUykkdwfgWr4ho1JSP4pl/79WFgrv+0Hw7Ml0E2ZoTLIkgacr+9kLxmg82q+xWegYmcfPRC/Eh+g5Ln4mYkyzyLlTSyuHNnGI0wi3QYUX3ITBoPeex1ly5rPxYA3KM+4boKcxFR1DGS0RU+jzZnhKbxVw6YP5VpPAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAMGzeUx283P9ophMPjguepuCn+vWl+ZLh0qjCneT6vS29/COAaR97obMfpnI4XPIbdj8Jch3M10q1yvjptzkeRcSN2MXCiC6QiNG7D4yeUu+dlQz3o9vBAp8asfG/jfU7qx2wxRLkf8vi1q+v52Z5jPpnUAZ1au6urhbSTpE/VLDGcBPxVIQQeohbzJvT/0WRbUVPojZ9ixKX7lI93V79na74AOD1d5/4PzW5myxQjNZpThR/mBG7C0c9sdI04/fxDAY7XTlwHxwaTxslZYhUtEIyqztIo80P7LGdhuKNBVbPP2rvrf2z7K78gsCMnLfAtUtM4Cv62k5H/4uE7WBwKI=-----END CERTIFICATE-----
Ref: https://rdap.arin.net/registry/ip/162.214.0.0
OrgName: Unified Layer
OrgId: BLUEH-2
Address: 1958 South 950 East
City: Provo
StateProv: UT
PostalCode: 84606
Country: US
RegDate: 2006-08-08
Updated: 2025-02-20
Ref: https://rdap.arin.net/registry/entity/BLUEH-2
OrgNOCHandle: ENO74-ARIN
OrgNOCName: EIG Network Operations
OrgNOCPhone: +1-877-659-6181
OrgNOCEmail: eig-noc@endurance.com
OrgNOCRef: https://rdap.arin.net/registry/entity/ENO74-ARIN
OrgTechHandle: ENO74-ARIN
OrgTechName: EIG Network Operations
OrgTechPhone: +1-877-659-6181
OrgTechEmail: eig-noc@endurance.com
OrgTechRef: https://rdap.arin.net/registry/entity/ENO74-ARIN
OrgAbuseHandle: NOC2320-ARIN
OrgAbuseName: Network Operations Center
OrgAbusePhone: +1-801-765-9400
OrgAbuseEmail: abuse@bluehost.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/NOC2320-ARIN
NetRange: 162.215.252.0 - 162.215.253.255
CIDR: 162.215.252.0/23
NetName: PDR-SOLUTIONS
NetHandle: NET-162-215-252-0-1
Parent: UNIFIEDLAYER-NETWORK-15 (NET-162-214-0-0-1)
NetType: Reassigned
OriginAS:
Organization: PDR (PSUL-1)
RegDate: 2016-11-24
Updated: 2016-11-24
Ref: https://rdap.arin.net/registry/ip/162.215.252.0
OrgName: PDR
OrgId: PSUL-1
Address: P.D.R Solutions LLC, 10, Corporate Drive, Suite 300
City: Burlington
StateProv: MA
PostalCode: 01803
Country: US
RegDate: 2015-08-04
Updated: 2019-11-07
Ref: https://rdap.arin.net/registry/entity/PSUL-1
OrgNOCHandle: EIGAR-ARIN
OrgNOCName: eig-arin
OrgNOCPhone: +1-781-852-3200
OrgNOCEmail: eig-net-team@endurance.com
OrgNOCRef: https://rdap.arin.net/registry/entity/EIGAR-ARIN
OrgTechHandle: TECH953-ARIN
OrgTechName: Tech
OrgTechPhone: +1-415-230-0680
OrgTechEmail: ipadmin@publicdomainregistry.com
OrgTechRef: https://rdap.arin.net/registry/entity/TECH953-ARIN
OrgDNSHandle: EIGAR-ARIN
OrgDNSName: eig-arin
OrgDNSPhone: +1-781-852-3200
OrgDNSEmail: eig-net-team@endurance.com
OrgDNSRef: https://rdap.arin.net/registry/entity/EIGAR-ARIN
OrgRoutingHandle: EIGAR-ARIN
OrgRoutingName: eig-arin
OrgRoutingPhone: +1-781-852-3200
OrgRoutingEmail: eig-net-team@endurance.com
OrgRoutingRef: https://rdap.arin.net/registry/entity/EIGAR-ARIN
OrgTechHandle: EIGAR-ARIN
OrgTechName: eig-arin
OrgTechPhone: +1-781-852-3200
OrgTechEmail: eig-net-team@endurance.com
OrgTechRef: https://rdap.arin.net/registry/entity/EIGAR-ARIN
OrgAbuseHandle: ABUSE5185-ARIN
OrgAbuseName: Abuse Admin
OrgAbusePhone: +1-415-230-0648
OrgAbuseEmail: abuse@publicdomainregistry.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE5185-ARIN
OrgNOCHandle: NOC32406-ARIN
OrgNOCName: NOC
OrgNOCPhone: +1-415-230-0680
OrgNOCEmail: noc@publicdomainregistry.com
OrgNOCRef: https://rdap.arin.net/registry/entity/NOC32406-ARIN
network:Class-Name:network
network:ID: NETBLK-UL.162.214.0.0/15
network:Auth-Area: 162.214.0.0/15
network:Network-Name: UL-162.214.0.0/15
network:IP-Network: 162.214.0.0/15
network:Organization: Unified Layer
network:Tech-Contact: netops@unifiedlayer.com
network:Admin-Contact: netops@unifiedlayer.com
network:Abuse-Contact: abuse@unifiedlayer.com
network:Created: 20121119
network:Updated: 20121119
network:Updated-By: netops@unifiedlayer.com