208.91.198.106 Threat Intelligence and Host Information

Apr 22, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 208.91.198.106 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 75/100

Host and Network Information

  • Mitre ATT&CK IDs: T1021.001 - Remote Desktop Protocol, T1110 - Brute Force, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1566 - Phishing, T1583.001 - Domains, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships

  • Tags: anydesk, as15169 as16509, as19871 as22612, as9002, business email compromise, c2, caas, cyber security, fraud, hosting, identifying, ioc, malicious, Nextray, parked domains, phishing, scams, ssh hijacking, typosquatting

  • JARM: 29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158dd

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_net_ua, hphosts_emd, hphosts_fsa, hphosts_psh

Malware Detected on Host

Count: 76 77241fd91e48e51e517923885ba0b263b83b622a4304e6c9ccc6aec24ebff59b c3b2f4b2b6e23610923038798c9842f32b5d20a8dc9e2aa7283c918873f1c5d5 1e0c9d17d0d67d2bf6a2e97c52b267112f455ced612c6b8adde854905e9e9991 92894a7ae51b0554b666fed9634f3a34f490c27b9ad1ec9b85e9ef91fe0a0bc2 af77d58150c9ad5a9b19c138cea5d6fb7055fd4355acbbf2a5d41f41ae75bd08 13a2f0793a6918a099a75e27d31209379890a1c41e493aa4051ec45521340ec7 0a4fd9a26a96d1a16fd1df17139e9acfbd4e8f82cd0b905e29a7662250e29812 8a725f058dd90e254980a471bdc8d0761dfac52274a1d6190b6e247e1d57889f 944fa37bf496956dd8fb2c86604aae093f1522aae4c451c1cab9c63b7fe76b99 0541cd5a25294225cd167cba3398a8f8b8b6580f9afd0c4ab5fcb4d996067ba7

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: