198.54.114.246 Threat Intelligence and Host Information

Sep 17, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 198.54.114.246 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 64/100

Host and Network Information

  • Mitre ATT&CK IDs: T1021.001 - Remote Desktop Protocol, T1110 - Brute Force, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1566 - Phishing, T1583.001 - Domains, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships

  • Tags: agenttesla, agentteslaexe, anydesk, arkeistealer, as15169 as16509, as19871 as22612, as9002, azorult, azorultexe, business email compromise, c2, caas, danabot, darkrat, dridex, dridexopendir, emotetheodo, formbook, fraud, gandcrab, gozi, hancitor, hawkeye, heodo, hosting, icedid, identifying, kpot, kpotstealer, loader, loki, luminositylink, nanocore, nemty, netwire, parked domains, phorpiex, pony, qakbot, qealler, quasarrat, raccoonstealer, remcos, remcosrat, scams, servhelper, ssh hijacking, stealer, systembc, trickbot, troldesh, typosquatting, zloader

  • JARM: 3fd3fd15d3fd3fd00042d42d000000038eaaf490bec8dc33757f165ce01762

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 8 a7a7508e8ba79d14fb0c92f6da9d61607129c65943de74958c5b3a6304fa2695 cb2c91bd7ba1c477ab33f0ca424749512ebd03473271210d4cdb0693bba00e23 9c1ebd6f1800194b29720f626d51bf8f67310c4c59e67cd12e398dde234872ca 2118c79dbb6767549cf9aa12367faa8f55281d4299d0a3f4c2f40c1686d8016a 03bdb719f884ffaeb79bcd9aeae51ff60aa2123be550b0415c3bbade6a3f6f31 a6f4a0400fc7eee60610c0e113802d5aa544d462d2141b93203a0f9f380f0a16 b599b0327c4593a06a2e05a3373ee84c37faa6e4fd6f7e5c24544aa9192e0b43 9bb681fe0ef431a07bb7cbf6d7cd910782c267ccb7b5d37ca18d109541616177

Open Ports Detected

143 2095 2096 21 443 587 80 993

CVEs Detected

CVE-2016-10735 CVE-2018-14040 CVE-2018-14042 CVE-2018-20676 CVE-2018-20677 CVE-2019-8331

Map

Whois Information

  • NetRange: 198.54.112.0 - 198.54.127.255
  • CIDR: 198.54.112.0/20
  • NetName: NAMEC-4
  • NetHandle: NET-198-54-112-0-1
  • Parent: NET198 (NET-198-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS:
  • Organization: Namecheap, Inc. (NAMEC-4)
  • RegDate: 2015-11-13
  • Updated: 2015-11-13
  • Ref: https://rdap.arin.net/registry/ip/198.54.112.0
  • OrgName: Namecheap, Inc.
  • OrgId: NAMEC-4
  • Address: 11400 W. Olympic Blvd. Suite 200
  • City: Los Angeles
  • StateProv: CA
  • PostalCode: 90064
  • Country: US
  • RegDate: 2011-01-28
  • Updated: 2024-11-25
  • Ref: https://rdap.arin.net/registry/entity/NAMEC-4
  • OrgTechHandle: EFIME-ARIN
  • OrgTechName: Efimenko, Igor
  • OrgTechPhone: +1-323-375-2822
  • OrgTechEmail: igor.e@namecheap.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/EFIME-ARIN
  • OrgAbuseHandle: ABUSE2885-ARIN
  • OrgAbuseName: Abuse team
  • OrgAbusePhone: +1-323-375-2822
  • OrgAbuseEmail: abuse@namecheaphosting.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2885-ARIN
  • OrgTechHandle: TECHT4-ARIN
  • OrgTechName: Tech team
  • OrgTechPhone: +1-323-375-2822
  • OrgTechEmail: tech@namecheaphosting.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/TECHT4-ARIN
  • network:Class-Name:network
  • network:Auth-Area:198.54.114.192/26
  • network:ID:NET-74564.198.54.114.246
  • network:IP-Network:198.54.114.246
  • network:IP-Network-Block:198.54.114.246
  • network:Org-Name:Web-hosting.com
  • network:Street-Address:3402 East University Drive
  • network:City:Phoenix
  • network:State:AZ
  • network:Postal-Code:85034
  • network:Country-Code:US
  • network:Tech-Contact:MAINT-74564.198.54.114.246
  • network:Created:20190321133647000
  • network:Updated:20190321133647000
  • network:Updated-By:net-admin@namecheap.com
  • contact:POC-Name:Network team
  • contact:POC-Email:net-admin@namecheap.com
  • contact:POC-Phone:
  • contact:Tech-Name:Network team
  • contact:Tech-Email:net-admin@namecheap.com
  • contact:Tech-Phone:
  • contact:Abuse-Name:Abuse team
  • contact:Abuse-Email:abuse@namecheaphosting.com

Links to attack logs

****** ****** ******

Share on: