199.34.228.66 Threat Intelligence and Host Information

Oct 19, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 199.34.228.66 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1029 - Scheduled Transfer, T1055 - Process Injection, T1057 - Process Discovery, T1059.007 - JavaScript, T1060 - Registry Run Keys / Startup Folder, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1105 - Ingress Tool Transfer, T1140 - Deobfuscate/Decode Files or Information, T1449 - Exploit SS7 to Redirect Phone Calls/SMS

  • Tags: 2nd corintnthians 4:8-9, 707713, acceptencoding, activity dns, a domains, aes256gcm, agent tesla, akamaias, akamaiasn1, algorithm, all octoseek, all scoreblue, all txt, amadey, amazon02, america asn, analyze, anchor hrefs, anomalous_deletefile, anomalous file, antidebug_guardpages, antivm_generic_disk, a nxdomain, anyone else, apple, apple ios, april, arizona, as133618, as134175 unit, as13768 aptum, as15169, as16509, as20940, as29066 host, as30148 sucuri, as3359, as38365 beijing, as393601 state, as397241, as47846, as4837 china, as63949 linode, as6461 zayo, as8075, as852, asnone, asyncrat, attack, august, authority, auto-generated security, awful, azorult, back, backdoor, banker, bazar, beta version, blacklist, body, body length, brian sabey, brontok, builder, bypass_firewall, ca1 odigicert, ca issuers, callback phishing, catherine daisy coleman, cellbrite, certificate, certsentry, chaos, check in, china unknown, click, cmstp, cname, cnc, cobalt strike, code, communicating, components, contacted, contact phone, control, cookie, copy, core, count blacklist, creation date, critical, crlf line, crypto, cryptowall, csc corporate, cuba, cus cndigicert, daisy coleman, dalles, dark, data, date, dcom, default, delete, delete c, delphi, detection list, disables_windowsupdate, dns, dns lookup, dns replication, domain, domain privacy, domains, download, dynamic, dynamic_function_loading, dynamicloader, emails, emotet, encrypt, entries, error, eternalblue, eva reimer, evilnum, execution, expiration date, exploit, facebook, false, february, fexp24007246, file execution, files, files ip, final url, floxif, full name, gecko, general full, geoip, germany unknown, get na, ghost, global g2, gmt content, gmtn, go daddy, google, guard, hacking, hacktool, hallrender, headers xcache, high, historical, historical ssl, hong kong, hostname, hostnames, house.mo.gov, html document, html info, html internet, http, http_request, http response, https://lawlink.com/documents/10935/blackbag-technologies-announ, ieudinit, indonesia, info, injection_create_remote_thread, injection_inter_process, installer, iocs, ip address, ipv4, january, june, kb body, kb document, kb font, keepaliveyes, keylogger, khtml, level3, linux mint, local, location united, lockbit, log id, low risk, low security, malicious, malware, malware found, malware infection, maze, media, media center, medium, meta tags, metro, mexico, mhkz, midia-4, mini, missouri, modify_proxy infostealer_cookies, moved, msie, mtb feb, mvi2, name servers, nat32, network, network_http, next, njrat, no data, november, nso, nsyt, number, nxdomain, observed dns, october, open ports, parallax rat, parent domain, passive dns, paste, pegasus, persistence_autorun, playgame, powershell, powershell_download, powershell_request, primary request, privateloader, probe ms17010, problems, procmem_yara, protect, proton, public url, pulse pulses, pulse submit, push, qakbot, qbot, quasar, query, ransom, ransomexx, ransomware, record type, record value, redir, referrer, registrar, registrar abuse, registrar iana, registrar url, registry domain, related pulses, remcos, remcos rat, resolutions, resource path, rgba, risk, roundup, safebae, sample, samples, sample summary, scan endpoints, scottsdale, script tags, search, security no, september, server, servers, service, seznam, sha256, show, showing, simda, site, size, slcc2, slider plugin, ssl certificate, staging, startpage, state, status, status code, sucuri firewall, tactics, tag count, tag tag, target, taskscheduler, team, telecom, threat, threat network, threat roundup, title safebae, tls rsa, tls web, tracking, trojan, trojandropper, tsara brashears, ttl value, twitter, type mimetype, type name, typosquatting, ukraine, unicode text, united, unknown, url analysis, url http, urls, urls http, urls https, ursnif, utf8, utf8 text, v3 serial, veryhigh, virgin islands, wannacry, wc3 rpg, website malware, whois record, win32, win32 exe, win64, windows nt, wininit, win.trojan, wordpress, wow64, wpbakery page, wp engine, write, xpcegvo2adsnq, yara detections, yara rule

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_emd

Malware Detected on Host

Count: 52 4a6ffa02ff7280e00cf722c4f2235f0e318e6cc8a2b9968639ba715f1a38c834 8d08e1fffae5a7d482608b83d54acf9230505ea86c4e337bca59184374a291d8 6747d59538a3d64f515587dbaaba23c0a90f58273e4dfae4134a23c573462b63 8e3371c1687886c8cff23a5dbfe2147c5277b9dd43421ef1bd0e4fc6dd7a2d5b f090a6ad975981b8d8986c3de88a3307690f5701c57c8c658a6b1c59b6a25b0b 6350ba22b1764afc7c5e1935dad23ba86fa3ca0faece25f44c15023fb296b1ba 98c32086be0f56d2aee0a10d4c683db8eafe6994c8772f1492557c9dd1b1d9e9 1e53dccc5de2031ce7291a95c9f7f313409c7cb18a6c4a2b090697f1578d5994 de805c1592b3b83e8187fd6fad1d1c92622d38a299fa7e1be8b6718e55b5527a baca6c93cd3d52ce8020c5f85238492bf0f0bd3170d871b060f49c288ba956f5

Open Ports Detected

2052 2053 2082 2083 2086 2087 443 80 8080 8443 8880

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: