199.188.200.10 Threat Intelligence and Host Information

Apr 04, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 199.188.200.10 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 74/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1053 - Scheduled Task/Job, T1218 - Signed Binary Proxy Execution, T1220 - XSL Script Processing, T1564 - Hide Artifacts

  • Tags: adwind, adwind rat, agent tesla, agenttesla, aggah, alienspy, all at, amadey, ammyy, ammyy admin, andromut, angler, apart, april, asyncrat, august, aurora, ave maria, axpergle, azorult, belarus, bitcoin, bladabindi, bokbot, browserpassview, chacha, chanitor, chatgpt, chthonic, click, cloudeye, cobalt strike, cobaltstrike, copy, cridex, crimson, crimson rat, cryptbot, crysis, cve201711882, danabot, darkcomet, darkside, desktop, dharma, discord, dofoil, dridex, dunihi, dyre, egregor, emotet, eternalblue, execution, fallout, fareit, february, first, flawedammy, flawedammyy, formbook, friendly, gandcrab, glupteba, gootkit, gozi, guloader, hancitor, hawkeye, hermes, houdini, hunter, hworm, icedid, jenxcus, june, kill, killswitch, loader, lockbit, loki bot, lokibot, macos, mailpassview, mailto, maldoc, malspam, malware, march, mars, maze, mega, mexico, mimikatz, nanocore, nanocore rat, napoleon, nemty, netwalker, netwire, neutrino, next, njrat, nuclear, open, orcus, orcus rat, panda banker, path, phobos, pinkslipbot, poisonivy, polish, pony, powershell, predator, predator pain, psexec, qakbot, qbot, quasar, quasar rat, raccoon, racealer, ransom, ransomware, rats, recent blog, redline, redline stealer, remcos, revenge, revenge rat, revil, ryuk, ryuk ransomware, scarimson, screen, seen, servhelper, service, shadow, siplog, smokeldr, smoke loader, smokeloader, snake, sockrat, sodinokibi, spelevo, squirrelwaffle, sticky, systembc, teamspy, teamviewer, terdot, thief, track them, trickbot, trojan, troldesh, ukraine, ursnif, vawtrak, vidar, virustotal, wannacry, wcry ransomware, windigo, winrar, xtremerat, zbot, zloader

  • JARM: 3fd3fd15d3fd3fd00042d42d000000038eaaf490bec8dc33757f165ce01762

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_emd, hphosts_fsa, hphosts_psh

Malware Detected on Host

Count: 8 7320ef0b7dce1617700dde3656676fd40e87f5c1278b15323da322c42eb7cd17 41212525387db779c41f209912f8d0fa4c6e02ebcfa58bfeb150bb1354beb814 ea40be4bfd388d69705eae2f60a415b1a0789135e195fbc18039009b0feae81c 0fe3c4c8399b870683dd4720c997e108384ca84cc8de2d88b9bc9cc665835acd a011bb18bfc4dfd4398ff8fc7650ffa36c9ac02a9cd9e96217e96b1f5a24cbde d6cf684adf559283fe355354fc243cc80d4176170fd1941a35178e311acedf1b 27606b46ad4119b3973661c5077247c6c90dd29a585ef85ed48eaf7153e26922 d54b720511091c47a46b69ba5ef86d49dc3570f89206c8984beae53274d04145

Open Ports Detected

110 143 2083 2095 2096 21 443 465 53 587 80 993 995

CVEs Detected

CVE-2007-3205 CVE-2013-2220 CVE-2015-9251 CVE-2017-8923 CVE-2019-11358 CVE-2020-11022 CVE-2020-11023 CVE-2022-31628 CVE-2022-31629 CVE-2022-37454 CVE-2022-4900 CVE-2024-25117

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: