37.44.238.213 Threat Intelligence and Host Information

Jul 25, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 37.44.238.213 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

Mitre ATT&CK IDs: T1021 - Remote Services, T1037.001 - Logon Script (Windows), T1059.007 - JavaScript, T1185 - Man in the Browser, T1210 - Exploitation of Remote Services, T1546.013 - PowerShell Profile, T1557 - Man-in-the-Middle
Tags: 32, 32-bit, 64, 97497d721ee629998ec1d4216eb2d6c2, AgentTesla, Amadey, android, apk, APT, Arechclient2, ArkeiStealer, arm, ascii, AsyncRAT, AVrecon, badrequest, bashlite, botnet, bruteforce, c2, Civil, CoiClipper, combinations, compromise ipv4, cyber security, DarkGate, dat, dcrat, ddos, discord, dll, doc, dropped-by-amadey, dropped-by-PrivateLoader, dropped-by-SmokeLoader, dropper, elf, Encoded, encrypted, Espionage, exe, Formbook, gafgyt, grabushka, gs003, GuLoader, hajime, hta, IcedID, IcedID_Loader, infostealer, intel, ioc, iocs, ipv4 port, IR, IRATA, IRN, iso, linux, lnk, LummaStealer, malicious, Malware, meterpreter, mips, mirai, mirai botnet, motorola, Mozi, msi, NetSupport, Nextray, njRAT, opendir, Pegasus, phishing, PowerPC, PrivateLoader, probing, pwd:AKQW-3NKS-4KCN, rat, remcos, RemcosRAT, renesas, Rhadamanthys, script, sha1, sha256, shellscript, SIDECOPY, SocGholish, sparc, Stealc, url, vbs, webscan, webscanner, wshrat, x86-32, xlsx, zip
View other sources: Spamhaus VirusTotal

Country: France
Network:
Noticed: 50 times
Protocols Attacked: ntp snmp
Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Malaysia, Norway, Poland, Romania, Spain, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America

Malware Detected on Host

Count: 41 e7b6019f4f11def3edc12a1c4d57005c5e2e10828d2bf93f03b3259d3452a31b e8e80af036ef79951fc17ee011894e93cbf22fa2b124b55f9fab9376b444e6a1 6698aed23b494e7a8aff28e1e7e96551d61b89d1827aa98800f5a6a56601066b 7f92821363f1916ee8bab110f47f6fd25ba6932a364455ed3a6bbadb67564b8b 05860904d3f361d5e84d7ecc838b834b4c0f34d2b0269af8ef619a779bd0b665 fbc998ec0881b38f9f75a33f61704bc84dbab8077c6a06ee7c385eb1497c44a9 d127f5757f0519811e25c9b67a5219b18c6a04392b93296d1615f5b837ac922d 252632ba2d26fd43cf15d5bfed8586cdfd344a7b92cba84238568a7078218fd2 789e43e1718b8569514dc5455b88fae0a6f4d6ba67fe160864d63c158a232f36 80c3d6d49d3b42d21181c7dfe4a6f1d9ef43bdd0a004bcdd975e3fa802557fa9

Map

Links to attack logs

Share on: