72.21.206.80 Threat Intelligence and Host Information

Jan 20, 2026 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 72.21.206.80 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 65/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1005 - Data from Local System, T1012 - Query Registry, T1027.005 - Indicator Removal from Tools, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036.004 - Masquerade Task or Service, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1059.002 - AppleScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1069.002 - Domain Groups, T1069 - Permission Groups Discovery, T1070.004 - File Deletion, T1071.002 - File Transfer Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1081 - Credentials in Files, T1082 - System Information Discovery, T1086 - PowerShell, T1100 - Web Shell, T1102 - Web Service, T1105 - Ingress Tool Transfer, T1106 - Native API, T1112 - Modify Registry, T1113 - Screen Capture, T1119 - Automated Collection, T1129 - Shared Modules, T1132.002 - Non-Standard Encoding, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1147 - Hidden Users, T1155 - AppleScript, T1158 - Hidden Files and Directories, T1176 - Browser Extensions, T1189 - Drive-by Compromise, T1190 - Exploit Public-Facing Application, T1195.001 - Compromise Software Dependencies and Development Tools, T1199 - Trusted Relationship, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1211 - Exploitation for Defense Evasion, T1418 - Application Discovery, T1429 - Capture Audio, T1444 - Masquerade as Legitimate Application, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1456 - Drive-by Compromise, T1480 - Execution Guardrails, T1518 - Software Discovery, T1553 - Subvert Trust Controls, T1557 - Man-in-the-Middle, T1560 - Archive Collected Data, T1561 - Disk Wipe, T1562 - Impair Defenses, T1566 - Phishing, T1568.002 - Domain Generation Algorithms, T1568 - Dynamic Resolution, T1573 - Encrypted Channel, T1577 - Compromise Application Executable, T1583.005 - Botnet, T1583 - Acquire Infrastructure, T1584 - Compromise Infrastructure, T1589 - Gather Victim Identity Information, T1590 - Gather Victim Network Information, T1592 - Gather Victim Host Information, T1598 - Phishing for Information, TA0003 - Persistence, TA0011 - Command and Control

  • Tags: aaaa, accept, acceptranges, access att, acint, acls, active, active related, adaptivebee, added active, address, address domain, address first, address range, admin name, a domains, adversaries, adware, africa, africa flag, agent, ag organization, akamai, alerts, alexa, alexa top, algorithm, all hostname, all ipv4, allocation type, allocationtype, all octoseek, all scoreblue, all se, all y, alphacrypt cnc, america, america asn, america flag, analysis, analysis date, anonymizer, a nxdomain, appdata, apple, apple id, arc file, are you hiring, arial, arkei stealer, array, artemis, as14618, as15169, as16509, as35819, as44273 host, as62597 nsone, ascii, ascii text, ashburn, asn as13335, asn as14618, asn as16276, asn as16509, asn as16637, asn asnone, asnone dns, asnone united, asyncrat, autofill pulse, autorun, av detections, backdoor, bandzoogle, bank, beacon, beginstring, behav, bernie, bid site, binary file, blacklist, blacklist http, blacklist https, blocked, body, body h1, body html, botnet, brian sabey, builder, built, cabinet archive, cache control, canada, canada asn, canada showing, canada unknown, cancer, capture, ccbase, center, certificate, checks, checks system, china education, china telecom, china unicom, china unknown, christopher ahmann, chrome, cidr, cisco umbrella, city bonn, ck id, ck matrix, ck techniques, class, classinfobase, cleaner, click, cloudflare, cloudfront x, cname, cnc beacon, cndigicert sha2, cni safe, cnus, cobalt strike, cobaltstrike, code, codeoverlap, colorado, colorado state, com laude, command, command decode, comments, commitsize, community, company limited, component, computer, conduit, conector, connector, contacted, contacted hosts, contacted urls, content, content length, contentlength, content scraper, content type, control, controls learn, cookie, copy, copy md5, copy sha1, copy sha256, corporation, council, country, country de, covid19, cowboy server, crack, crash, create c, creation date, critical, crlf line, cryp, csc corporate, cti98, cura adma, cus odigicert, CVE-2005-1790, CVE-2009-3672, CVE-2010-3962, CVE-2012-3993, CVE-2014-3153, CVE-2014-6332, CVE-2016-0189, CVE-2017-0147, CVE-2017-0199, CVE-2017-11882, CVE-2017-8570, CVE-2018-4893, CVE-2020-0601, CVE-2020-0674, CVE-2021-27065, CVE-2021-40444, cyber attack, cybercrime, cyber threat, cyberwarfare, dap domain, darpapox, data, datab, database, data upload, date, date checked, date fri, date hash, date thu, dead host, default, defender, defense evasion, delete, delete c, deletes_executed_files, delphi, delphi generic, denver, denver colorado, destination, detection list, deva psaa, development att, dga domain, directui, disable, displayname, div div, dns domain, dnspionage, dns requests, dns resolutions, dnssec, dock, domain, domain add, domain address, domain database, domain hostname, domain name, domain related, domain robot, domains, domains show, domain status, domains top, downer, downldr, download, drop, dropper, drweb, dynadot inc, dynamicloader, ebeee, edge, eeee, eeeee e, eeeeee, eeeeeee, eeefee e, ee eme, ee fc, eefe, eeheee, e ep, element, emails, ember cli, ember view, encrypt, engineering, english, enter sc, entity, entity bns34, entries, envoy error, error, error id, error oct, espaol, etag w, etpro trojan, evasion att, evasion ta0005, example, exclude, exclude sugges, execution, exif standard, expiration date, exploit, extend, extra, extraction, extri data, extr include, extr referen, f0 ff, failed, fast, fastly error, february, ff bb, ff d5, file, filehandle, filehash, files, files amsi, file score, files domain, files ip, files location, files related, filetour, file type, financial, find suggested, fireeye, first, flag, flag united, form, format, for privacy, found, found cache, foundry, found title, france asn, france unknown, free dns, full name, fusioncore, gamers, gandi sas, gapd5d, gecko, gecko http, general, generator, generic malware, generic pong, genkryptik, get http, get na, global, global g2, gmt cache, gmt connection, gmt content, gmt contenttype, gmt expires, gmt p3p, gmt server, google safe, gootloader, graph community, group, grum, hacker, hackers, hacktool, handle, handles modules, harassment, hash apr, hashes, head body, head title, heart internet, heur, high, high st, historical otx, historical ssl, home page, hostile, hosting, hostname, hostname add, href, html, html document, http, http host, http requests, https:/www.usaopps.com/government_contractors/contractor-5388777, http version, hungary, hwndhost, hybrid, icmp traffic, ids detections, ieedge chrome1, iframe, inc cndigicert, include review, indicator facts, indicator role, indonesia, info header, informative, initial access, injections, inno5311, inno setup, input, installcore, installer, installpack, intel, internal server, internet, invalid url, invalid variant, iobit, iocs, ios, ip address, ip addresses, ip check, iphone, ip summary, ip traffic, ipv4, ipv4 add, ip whois, ireland flag, ireland unknown, jakuz, javascript, josht.ca, jpeg image, jquery, json, june, kangen, kawaii unicorn, kb file, key0, keybase, key identifier, kgs0, khtml, kls0, langchinese, language, launcher, learn, legalcopyright, lehash, level, lg2en, lidfileupd, linda listen, link, linker, listen, listeners @ dantesdragon, listen linda, litespeed x, live, loaderid, local, localappdata, localcfg, location canada, location france, location south, location united, lockbit, log4, look, lowfi, low risk, lseattle, ltda me, ltd dba, ’m, mail spammer, malicious, malicious host, malicious link, malicious site, malicious url, maltiverse, malware, malware fighter, malware generic, malware hosting, malware site, ma ma, markmonitor, mb opera, mcafee, md5 add, media, media center, mediamagnet, medium, medium risk, memcommit, mesh digital, meta, meta http, meta name, metro, metro pcs, microsoft, microsoft learn, million, mimikatz, mint, mirai, mirai att, mirai botnet, mitre att, modify tools, module, module load, montreal, moved, mphomafmulweli, msie, msil, msms93992282, ms windows, mtb nov, mtb sep, mulweli, music, name, name domain, name legal, name md5, name servers, name tactics, netacea, network, network name, never, never say anything, next, next associated, next http, next related, nhs trusts, nircmd, nivdort, noi nid, none google, none related, null, number, nxdomain, observed dns, obz4usfn0 http, odigicert inc, ogoogle trust, okrndate, onload, opencandy, openurl c, opinion, ordenar por, org deutsche, org principal, otx telemetry, outbreak, overlay, overview domain, ovhcloud meta, packer, packing t1045, page, paid parking, palantir, panda, parking crews, passive dns, path, path filehandle, pattern match, pe32, pe32 installer, pecompact, pegasus, penetration, pe resource, persistence, pe section, phishing, phishing site, please, png image, por ejemplo, porkbun llc, port, porthandle, possible, power query, powershell, pragma, praio, prefetch2, presenoker, present apr, present aug, present dec, present feb, present jan, present jul, present jun, present mar, present may, present nov, present oct, present sep, prink, privacy, prla, problems, process32nextw, process details, processhandle, program, programfiles, project, protect, prsc, psda our, psiusa, pulse pulses, pulses none, pulse submit, pur com, purplewave, push, python, quasi, query, query type, quickstart, ransom, ransomware, rdap, read, read c, reads, record type, record value, redline stealer, redlinestealer, red team, reference, referen data, referral url, referrer, refloadapihash, refresh, regdword, regionsize, registrar, registrar abuse, regsetvalueexa, related, related nids, related pulses, related tags, reporting arch, requires, resolutions, resolverror, resource, restart, results apr, results aug, results dec, results feb, results jan, results jun, results mar, results may, retailexperts, reverse dns, review exclude, review iocs, rgba, riskware, rndchar, rndhex, robots content, runtime, russia, safe browsing, safe site, sality, sama bus, sample, samples, saudi arabia, scan endpoints, scans show, script script, script urls, search, search host, secure server, see all, seen asn, seen last, seiko epson, sensitive, se referen, serial number, server, server nginx, server response, servers, service, services, setcookie, sha1, sha1 add, sha256, sha256 code, shell, show, showing, show process, show technique, signing ca, signing defense, simda, singapore, singapore asn, sinkhole cookie, site, size, slcc2, softcnapp, song culture, south africa, south korea, spaceship, span, spawns, spotify artist, ssl cert, ssl certificate, stack, stamping, starfield, startpage, status, status hostname, stcalifornia, story, stream, strings, strong, stus, stwashington, subdomains, submitters, subvert trust, sugges, summary, summary iocs, suricata ipv4, suspicious, swrort, symantec time, systemdrive, systemroot, systweak, t1003, t1129, t1189, t1204 user, t1480 execution, t1553 technique, t1562 technique, t1566 phishing, ta0002 defense, ta0009, tag count, tags none, targeting, team, telekom ag, temp, tencent, tethering, the bazar, threat report, thumbprint, tiff image, tiggre, time stamping, title, title head, tls rsa, tlsv1, tlsv1 apr, t-mobile, tmobileas21928, tofsee, tools, top destination, top source, tor analysis, total, touch, trojan, trojandropper, trojanspy, trojanx, tsara brashears, ttl value, tucows, twitter, type, type indicator, typo, ub euj, ub uj, ubuntu date, ue codeoverlap, uk government, unicode, unicode text, uninstall iobit, union, unique tld, united, united states, unknown, unknown a, unknown aaaa, unknown ns, unknown soa, unruy, unsafe, update, updated date, updater, url add, url analysis, url hostname, url http, url https, url pulse, urls, urls show, url summary, utc submissions, utf8, utf8 unicode, v3 serial, valid, valid usage, value address, variant, vary, verdict, verify, viewsize, vipre, virtool, virustotal, vmprotect, vmware, wacatac, wannacry attack, warehouse mgmt, wa status, webshell, welcome, whitelisted, whois, whois field, whois record, whois server, whois show, whois whois, widgitoolbar, win32, win32cutwail, win32cve sep, win32dh, win32 dll, win32 exe, win32heim feb, win32mydoom dec, win32spigot may, win64, windir, windows, windows nt, winver, work website, worm, wow64, write, write c, x22scriptx22, x509v3 subject, xrat, x request, xserver, xtrat, x ua, yara detections, yara rule, zbot, zerobits, zipcode, zombie device

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_ats, hphosts_fsa

Malware Detected on Host

Count: 6 e9584b8e3515852625d7c03b3ea6e79fda609d013eb5c9f91d1df02623309366 517b73c87f739d8c0213766a1dcb75ca4f30af31edf6cf7ba634e054bd788b0e 2faac0582c9e78de56a267c732da6874c5fd567e8bf2d2bdd746670dd185fbe4 caa31e87e31a7354519b8d1c060cd87dbe163b7070b0fc2f1722bfbc63285261 5f8b91b938bb59dc2161eee06b7eda6ae24f14573c7fb1519d2eab4c69ee591c e752fb29419fe86fd0379672c5985b5b2f280ec9ce893175ecad6586c9c054cd

Open Ports Detected

80

Map

Whois Information

Share on: