209.99.64.53 Threat Intelligence and Host Information

Apr 26, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 209.99.64.53 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 80/100

Host and Network Information

  • Mitre ATT&CK IDs: T1021.001 - Remote Desktop Protocol, T1036 - Masquerading, T1038 - DLL Search Order Hijacking, T1041 - Exfiltration Over C2 Channel, T1052.001 - Exfiltration over USB, T1110 - Brute Force, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1415 - URL Scheme Hijacking, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1566 - Phishing, T1583.001 - Domains, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships

  • Tags: aaaa, address, algorithm, all search, ansi, anydesk, as13335, as15169 as16509, as19871 as22612, as9002, august, body, body length, business email compromise, c2, caas, cmd, code, contacted, contact phone, cookie, creation date, cus cngts, data, date, december, dga malvertizing, dga parking, dns replication, dnssec, domains, domain status, download, dtrack, execution, facebook, file size, file type, final url, first, format, fraud, full name, general full, ghost rat, gmbh version, google, hash, hashes, headers, hijacker, historical ssl, hosting, http response, identifier, identifying, info, installer, ipv4, jannah, kb body, kb script, key algorithm, key identifier, key info, legal, llc validity, localappdata, magic iso8859, magic pdf, malware, malware hosting, march, masquerading, monitoring, msie, namecheap, namecheap inc, nginx, number, october, ogoogle trust, open ports, openurl c, otx octoseek, parked domain, parked domains, parking crew, passive dns, pcap, pcap processing, pdf document, pulse pulses, raspberry robin, record type, referrer, registrar abuse, registrar url, resource, reverse dns, runtime data, san francisco, scams, scan endpoints, search, server, service, service privacy, serving ip, sha256, showing, software, ssdeep, ssh hijacking, ssl certificate, status code, status page, subject key, subject public, text, text text, threat roundup, trid adobe, trid file, ttl value, type name, typosquatting, unicode, united, unknown, url http, usage, v3 serial, vhash, whois, whois record, whois whois, windir, windows nt, worm, x509v3 key

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_ats, hphosts_emd, hphosts_fsa, hphosts_pha, hphosts_psh

Malware Detected on Host

Count: 152 dd71b9e8405da5fce0c5c911b8d242e7e41b7e1c3c866e09b254092ec7966a40 381795bf5e32e778d07bf28d15fddf5d616dac75e5b91481c2b1cdf978e60231 67d12c3740619c41ed545d7249f8aab1c23143fd9c42a25a95f6c6e016df781e ff53c5c56ef687bc4f328e439159e71c4a3ce6c572b555c90836d60532768352 aa7f7bc6bfe3f576fb305964ff0c834852e503f28962de250e73ab25f764f718 49df757e7e407f4d307f310de9682f0bd5791828d0d7946cac69c571a8e51433 3847eff626ee736b6e66baaa1fd45bd2db4bd194960b2d4b46102641d53aa823 33ec703345713bee04114955c346a3f122d8f37d5d33bcac5468c40efbf6b36f ee172ce6b6895010cc7156c446633bbd03f3b28bfb3e1855471530360095699a ff47b141b188c2368cd67ce0809aa7058a88391050f0c98977c498680806c8c4

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: