198.54.116.238 Threat Intelligence and Host Information

Apr 03, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 198.54.116.238 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 64/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1053 - Scheduled Task/Job, T1102 - Web Service, T1218 - Signed Binary Proxy Execution, T1220 - XSL Script Processing, T1564 - Hide Artifacts

  • Tags: adwind, adwind rat, agent tesla, agenttesla, aggah, alienspy, all at, amadey, ammyy, ammyy admin, andromut, angler, apart, april, asyncrat, august, aurora, ave maria, axpergle, azorult, belarus, bitcoin, blacklist host, bladabindi, bokbot, browserpassview, chacha, chanitor, chatgpt, chthonic, click, cloudeye, cobalt strike, cobaltstrike, copy, cridex, crimson, crimson rat, cryptbot, crysis, csrmirteam, cve201711882, danabot, darkcomet, darkside, date, desktop, dharma, discord, dofoil, dridex, dunihi, dyre, egregor, emotet, eternalblue, execution, fallout, fareit, february, finaldraft, first, flawedammy, flawedammyy, formbook, friendly, gandcrab, germany, glupteba, gootkit, gozi, greed mi, greed mirai, guloader, hancitor, hawkeye, hermes, houdini, hunter, hworm, icedid, indonesia, jaff, jenxcus, june, kill, killswitch, loader, lockbit, loki bot, lokibot, lumma, macos, mailpassview, mailto, maldoc, malspam, malware, march, mars, maze, mega, mexico, mimikatz, mirai, mozi, mozi lin, mylobot, nanocore, nanocore rat, napoleon, nemty, netwalker, netwire, neutrino, next, njrat, nuclear, open, orcus, orcus rat, panda banker, paraguay, path, phobos, pinkslipbot, poisonivy, police, polish, pony, powershell, predator, predator pain, psexec, qakbot, qbot, quasar, quasar rat, raccoon, racealer, ransom, ransomware, rats, ra world, recent blog, redline, redline stealer, remcos, revenge, revenge rat, revil, ryuk, ryuk ransomware, scarimson, screen, seen, servhelper, service, shadow, siplog, smokeldr, smoke loader, smokeloader, snake, sockrat, sodinokibi, south africa, spelevo, squirrelwaffle, steam, sticky, systembc, teamspy, teamviewer, tech mahindra, terdot, thief, threat report, track them, trickbot, trojan, troldesh, ukraine, ursnif, vawtrak, vidar, virustotal, wannacry, wcry ransomware, windigo, winrar, xtremerat, zbot, zloader

  • JARM: 3fd3fd15d3fd3fd00042d42d000000038eaaf490bec8dc33757f165ce01762

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_emd

Malware Detected on Host

Count: 7 575f7906eb5cb98b1af992f127a4f639855b79bd11e2320960b992e4cf13c1f7 5bfb87691070668037df7a6bc1eac92bdb683ada3159b83c136146632835cb7f 14e135d70c20eb799d06076341aee4f09453f2cd5d9f425a167f42c997973ab8 c3d7112cdcd2ad4e3e8e03e449f0878f63c3572e3c01cd537a88c71bfbd2a62c e52e85541dde8f238a897e4f9c7843c767ac62dff57791ba1551996b6d7e746f ebb00ece6886a0f1a3323d263634463182a5c8dea5728a533e3b60ab7a54b749 4a0586a7ec8f95a7fdc1b8e8a7818627693fedf47870406d07ef72b1c01a9364

Open Ports Detected

110 21 26 443 465 587 80 993 995

CVEs Detected

CVE-2016-10735 CVE-2018-14040 CVE-2018-14042 CVE-2018-20676 CVE-2018-20677 CVE-2019-8331 CVE-2024-6484

Map

Whois Information

  • NetRange: 198.54.112.0 - 198.54.127.255
  • CIDR: 198.54.112.0/20
  • NetName: NAMEC-4
  • NetHandle: NET-198-54-112-0-1
  • Parent: NET198 (NET-198-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS:
  • Organization: Namecheap, Inc. (NAMEC-4)
  • RegDate: 2015-11-13
  • Updated: 2015-11-13
  • Ref: https://rdap.arin.net/registry/ip/198.54.112.0
  • OrgName: Namecheap, Inc.
  • OrgId: NAMEC-4
  • Address: 11400 W. Olympic Blvd. Suite 200
  • City: Los Angeles
  • StateProv: CA
  • PostalCode: 90064
  • Country: US
  • RegDate: 2011-01-28
  • Updated: 2024-11-25
  • Ref: https://rdap.arin.net/registry/entity/NAMEC-4
  • OrgTechHandle: EFIME-ARIN
  • OrgTechName: Efimenko, Igor
  • OrgTechPhone: +1-323-375-2822
  • OrgTechEmail: igor.e@namecheap.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/EFIME-ARIN
  • OrgAbuseHandle: ABUSE2885-ARIN
  • OrgAbuseName: Abuse team
  • OrgAbusePhone: +1-323-375-2822
  • OrgAbuseEmail: abuse@namecheaphosting.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2885-ARIN
  • OrgTechHandle: TECHT4-ARIN
  • OrgTechName: Tech team
  • OrgTechPhone: +1-661-310-2107
  • OrgTechEmail: tech@namecheaphosting.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/TECHT4-ARIN
  • network:Class-Name:network
  • network:Auth-Area:198.54.116.192/26
  • network:ID:NET-33143.198.54.116.238
  • network:IP-Network:198.54.116.238
  • network:IP-Network-Block:198.54.116.238
  • network:Org-Name:Web-hosting.com
  • network:Street-Address:3402 East University Drive
  • network:City:Phoenix
  • network:State:AZ
  • network:Postal-Code:85034
  • network:Country-Code:US
  • network:Tech-Contact:MAINT-33143.198.54.116.238
  • network:Created:20160810160748000
  • network:Updated:20160815053349000
  • network:Updated-By:net-admin@namecheap.com
  • contact:POC-Name:Network team
  • contact:POC-Email:net-admin@namecheap.com
  • contact:POC-Phone:
  • contact:Tech-Name:Network team
  • contact:Tech-Email:net-admin@namecheap.com
  • contact:Tech-Phone:
  • contact:Abuse-Name:Abuse team
  • contact:Abuse-Email:abuse@namecheaphosting.com

Links to attack logs

****** ****** ******

Share on: