199.249.230.89 Threat Intelligence and Host Information

Apr 04, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 199.249.230.89 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 70/100

Host and Network Information

  • Tags: cve202229266, cyber security, description, description ip, indicator, indicator type, ioc, malicious, Nextray, phishing, tor, TOR, VPN

  • Known tor exit node

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, dm_tor, et_tor, maxmind_proxy_fraud, sblam, snort_ipfilter, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, stopforumspam, tor_exits

  • Known TOR node
  • Country: United States
  • Network:
  • Noticed: 50 times
  • Protocols Attacked: SSH
  • Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: tor40.quintex.com block2.mmms.eu

Malware Detected on Host

Count: 40 e1608614192acb0d66ec367ec7a98c128a88cd0a2bbaddaf1508042da1a0fe71 1657eb20e1734f1723974c41caf235c4f4069757d8e75e352c7edea49c1c77f0 09de01f0f88f237e633b4b7e4aa8cf27691cc1f4107eee8ab4ae7b04e1919250 736f61430dc7b3fd797fd13d33b66ad89fc1b1fe12f8a95ee8ec7d37469ccb05 97eb5c019b7d4ed60b9ff0d363050d977015b9442bf97d83d75b59b9ddc1bec3 b11e614cdd02aecb8d6ae65bf67bfac8cbefd68830065217e2cb48922743bb12 c91dee71a84066140eeee96ab690795fac4cbb9827f2d46476e31f00da89c681 ddba9f407bf9cfc850033d72bf54eb93ffe5836389049687dc923d6b29d494b6 e34293a710d13999dd019e3f19a84eb67a8a4adf14a1e3ddbf7f5cb8877a7d7d 2fd353ffcace535b5c0cdd3b70784bcbf1d4e35879a3109ed8825c2f970d22d3

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: