208.91.198.220 Threat Intelligence and Host Information

Apr 22, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 208.91.198.220 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 90/100

Host and Network Information

  • Mitre ATT&CK IDs: T1021.001 - Remote Desktop Protocol, T1110 - Brute Force, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1566 - Phishing, T1583.001 - Domains, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships

  • Tags: anydesk, as15169 as16509, as19871 as22612, as9002, business email compromise, c2, caas, cyber security, fraud, hosting, identifying, ioc, malicious, Nextray, parked domains, phishing, scams, ssh hijacking, typosquatting

  • JARM: 29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158dd

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: cleanmx_phishing, cta_cryptowall, hphosts_emd, hphosts_fsa, hphosts_psh

Malware Detected on Host

Count: 53 24e692f7dd89053151053815d0a91ef3396bf033b019118b1c5d32465a9f4b6a 327983463905ade4c1f2c82e909f2c5584b00bdb0d271bd2c53f5427a4c4a17a 9ff6b97828eeb9b8f47fd20936ed9908dfbfecbcc5fb44a29df931d7d13a4547 5d77248b11a4f30e52b35d64294f3597c0977ed093b409abee0e2a2f32dfa18a 1be02d4b22f61e396a79c738764f4216e9a12823b7e71f624610fbfbcd30c632 711a4a49619acc23694903aed113e36af766ea3a14255dde90352f394546ec7e c85f00b3001d0cccb31d656a4a373fed6ee2764a84b2a639210a824aeedc9042 c13bd8561c3c0d3f3ee3cffd9a7687225725b81651fd3d58e044f05df454c259 4c344b8cb24a2c586d72626c4faab0147349fa8d2bbefc184b4acf81636cc5e4 5adadeaaa1059838cc3e87dbe95d95cc37a4699a94fa1ebb2f4e85e67aae6d3f

Open Ports Detected

110 143 2077 2082 2083 2086 2087 2095 2096 21 22 2222 26 3306 443 465 53 587 80 993 995

CVEs Detected

CVE-2007-2768 CVE-2008-3844 CVE-2016-20012 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 CVE-2018-20685 CVE-2019-11358 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2020-11022 CVE-2020-11023 CVE-2020-14145 CVE-2020-15778 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408 CVE-2023-48795 CVE-2023-51385 CVE-2023-51767 CVE-2025-26465

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: