46.246.14.9 Threat Intelligence and Host Information

Share on:
Aug 31, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 46.246.14.9 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 50/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1104 - Multi-Stage Channels, T1106 - Native API, T1547 - Boot or Logon Autostart Execution, T1559 - Inter-Process Communication

  • Tags: aggah, aptc36, asyncrat, c-36, class, december, download, explorer, february, first, fsociety, hagga, hollowing, limerat, next, njrat, ole object, rats, regasm process, tools

  • View other sources: Spamhaus VirusTotal

  • Country: Sweden
  • Network: AS42708 glesys ab
  • Noticed: 1 times
  • Protcols Attacked: Anonymous Proxy
  • Passive DNS Results: fortuna777.duckdns.org tiagoodiaz.duckdns.org diciembre24.duckdns.org newcracker.duckdns.org mansengco778.ddns.net mayo21.duckdns.org spamworzon.duckdns.org matarife.duckdns.org asy1543.duckdns.org mr1963.duckdns.org septiembre2022.duckdns.org diosamor27.duckdns.org bendito2714.duckdns.org reald27.duckdns.org update.mcafee-endpoint.com personnels.bdm-sa.fr news.banquealtantique.net yurenvi.duckdns.org sos2021jr.duckdns.org androidmedallo.duckdns.org proxy21.duckdns.org ecuadordos.duckdns.org ecuado2021.duckdns.org ant-ec.duckdns.org

Malware Detected on Host

Count:

Open Ports Detected

111 137 1801 22 3391 5001 53 5357 548 554 62078 8000 8443

CVEs Detected

CVE-2022-0194 CVE-2022-23121 CVE-2022-23122 CVE-2022-23123 CVE-2022-23124 CVE-2022-23125 CVE-2022-45188

Map

Whois Information

  • inetnum: 46.246.14.0 - 46.246.15.255
  • netname: FROOTYNET-5
  • descr: Frootynet Sweden
  • country: SE
  • admin-c: FN2785-RIPE
  • tech-c: FN2785-RIPE
  • org: ORG-FA755-RIPE
  • status: ASSIGNED P