208.91.199.152 Threat Intelligence and Host Information

Apr 22, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 208.91.199.152 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 69/100

Host and Network Information

  • Mitre ATT&CK IDs: T1021.001 - Remote Desktop Protocol, T1027 - Obfuscated Files or Information, T1056 - Input Capture, T1110 - Brute Force, T1114 - Email Collection, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1564 - Hide Artifacts, T1566 - Phishing, T1569 - System Services, T1583.001 - Domains, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships

  • Tags: agent tesla, anydesk, any.run, appdata, as15169 as16509, as19871 as22612, as9002, ave maria, business email compromise, c2, caas, carter, c server, danabot, dridex, first, formbook, fraud, hosting, identifying, keylogger, loki bot, lokibot, lokibot malware, lokibot spyware, lokibot stealer, machineguid, next, parked domains, remote access, scams, ssh hijacking, trojan, typosquatting, warzone

  • JARM: 29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158dd

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_fsa, hphosts_psh

Malware Detected on Host

Count: 17 c03620c530ad350b6392243c52b116e15ec5402c83e43254f5856ac08ae0540c ada60faecf8bec8e6264744c86d88f35d1dfba2650833e42c7667d18aa59ace9 77bd25346223a545453731426c73602bfdde844be5bfc28d077605b68fe45e62 10cda9d11f412cf5b4e6bc3ffc25c73783233da948bd281c18e2609b0dd057f8 75c76e951db2a3fcdad13273c5f3ea490d05ffb1d06f31ed7208836718c768c5 6f97690988b616d6c1432144fcf65cf7e682e04ddf0b004908afd2a06e41d42f cd8619a706e776cfc1db66f99bbe1784600d129ba55f1e39a1d9657a42f22162 6410834c131f59985258a3e762b9e482fdeb626f8df81db2bb29e6985808457e 1614eddc5c890a45c30d081ba50ce8c9860c0c866c6129aa1526ee874fc35e53 a29a6fcda477d82dd29d55ce5398e45bd23ca780b3b32668c0d0568753adb1ab

Open Ports Detected

110 143 2082 2083 2086 2087 2095 21 22 2222 26 3306 443 53 587 80 993 995

CVEs Detected

CVE-2007-2768 CVE-2008-3844 CVE-2016-20012 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2020-14145 CVE-2020-15778 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408 CVE-2023-48795 CVE-2023-51385 CVE-2023-51767 CVE-2025-26465

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: