61.54.91.228 Threat Intelligence and Host Information

Dec 26, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 61.54.91.228 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Possibly Malicious Host 🟢 30/100

Host and Network Information

  • Tags: anna paula, associated, CobaltStrike, currc3adculo, from email, headers, malspam email, msi file, tuesday, utf8, zip archive

  • View other sources: Spamhaus VirusTotal

  • Country: China
  • Network: AS4837 china unicom china169 backbone
  • Noticed: 1 times
  • Protcols Attacked: SSH

Malware Detected on Host

Count: 8 2db06397d719e17307297e87355a933e4ce4be0522fb21925d841c485cd3c2ee cd2c1abff5aabeeca2e63d7d22bac122af343578d50557fc82bde2532288c418 5e7d952b5db543ad588c4248cd6a78cf53cf309e125ababe066be93a3e058621 5c5e41d7eb8e0e77d186bda406640ab36ab7a5a278e3f2b16c4e23dd81893706 97927c5f17a83f89e006a97ef355312d89b06ccdb5ab25bcad5e117e67480c63 6a9a1d489ec5e25752dcc1a725d4abc69feb75942bdb55f42525d859c37441e2 ea30d83f5687954f07aa89fac0eda40935825bf0db021cb03975d822ce0b5dda 88bd92623b5cde259ec04ba7649abe7e43f21a84ef8c332e0dcd030b0b8c940a

Map

Whois Information

  • inetnum: 61.54.0.0 - 61.54.255.255
  • netname: UNICOM-HA
  • descr: China Unicom Henan province network
  • country: CN
  • admin-c: WW444-AP
  • tech-c: WW444-AP
  • abuse-c: AC1718-AP
  • status: ASSIGNED NON-PORTABLE
  • mnt-by: MAINT-CNCGROUP-HA
  • mnt-irt: IRT-CU-CN
  • last-modified: 2023-10-21T03:35:39Z
  • irt: IRT-CU-CN
  • address: No.21,Financial Street
  • address: Beijing,100033
  • address: P.R.China
  • e-mail: zhaoyz3@chinaunicom.cn
  • abuse-mailbox: zhaoyz3@chinaunicom.cn
  • admin-c: CH1302-AP
  • tech-c: CH1302-AP
  • mnt-by: MAINT-CNCGROUP
  • last-modified: 2023-11-22T07:54:46Z
  • role: ABUSE CUCN
  • address: No.21,Financial Street
  • address: Beijing,100033
  • address: P.R.China
  • country: ZZ
  • phone: +000000000
  • e-mail: zhaoyz3@chinaunicom.cn
  • admin-c: CH1302-AP
  • tech-c: CH1302-AP
  • nic-hdl: AC1718-AP
  • abuse-mailbox: zhaoyz3@chinaunicom.cn
  • mnt-by: APNIC-ABUSE
  • last-modified: 2023-11-22T07:55:43Z
  • person: Wei Wang
  • nic-hdl: WW444-AP
  • e-mail: abuse@public.zz.ha.cn
  • phone: +86-371-65952358
  • fax-no: +86-371-65968952
  • country: CN
  • mnt-by: MAINT-CNCGROUP-HA
  • last-modified: 2010-03-05T08:20:01Z
  • route: 61.54.0.0/16
  • descr: CNC Group CHINA169 Henan Province Network
  • country: CN
  • origin: AS4837
  • mnt-by: MAINT-CNCGROUP-RR
  • last-modified: 2008-09-04T07:54:44Z

Links to attack logs

****** ****** ******

Share on: