76.76.21.61 Threat Intelligence and Host Information

Dec 14, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 76.76.21.61 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 40/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1056 - Input Capture, T1176 - Browser Extensions

  • Tags: agent tesla, babuk, cyber security, formbook, gamaredon, home wifi, ioc, lokibot, malicious, malwarebytes, netwire, Nextray, phishing, scam, smokeloader, tsec

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: coinbl_hosts

Malware Detected on Host

Count: 19 7f41841a593bf9adca0001b2348930f4d79665e42726ccdd444b4a3ecbd8d112 e7723e8c808f3f72d18667544c2c7ac532a34bc80a29c2523227d77f7bb227f0 fb2bba50f7a124a06c33e46fdca67877193ec166c6297b3d03fe24df0070e667 3f9508a957239f821f00e944c1c789851ae80c42552e9b3edb9c780475829623 155c6961973d16d685ee864dfd6d28d0aa9b6de4a5497b67194d22d12b5f97b4 916c935bd3a52cb91156eb2785eefb2d7ce596d5f8083ab4555c40034d7d8670 210738e608028cc9a1dc90467ee18061a40c49f6f90a2e1c2984a6252a6ec486 1fa646087c13b40ee0f3a78b11188dafde96c4cf595f91ba2a5c55df935a7384 283d5e0c6dcc30d908a8e044d184f82281dc5b0c52209c541a552352eb4e9402 8b3633077b8f32c4104b20ae4019fd84acee20091e0948083d2834a918cc61a4

Open Ports Detected

443 80

Map

Whois Information

  • NetRange: 76.76.21.0 - 76.76.21.255
  • CIDR: 76.76.21.0/24
  • NetName: VERCEL-01
  • NetHandle: NET-76-76-21-0-1
  • Parent: NET76 (NET-76-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS:
  • Organization: Vercel, Inc (ZEITI)
  • RegDate: 2020-05-08
  • Updated: 2020-06-05
  • Comment: —–BEGIN CERTIFICATE—–MIIDmzCCAoOgAwIBAgIUYqxVc6t5udbMz0Ys6xC4VTX4NDgwDQYJKoZIhvcNAQELBQAwXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ8wDQYDVQQHDAZXYWxudXQxEzARBgNVBAoMClZlcmNlbCBJbmMxGzAZBgkqhkiG9w0BCQEWDG1AdmVyY2VsLmNvbTAeFw0yMDA1MTExMzIxMDJaFw0yMjA1MTExMzIxMDJaMF0xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEPMA0GA1UEBwwGV2FsbnV0MRMwEQYDVQQKDApWZXJjZWwgSW5jMRswGQYJKoZIhvcNAQkBFgxtQHZlcmNlbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGZNRvQYOIYbBJHiZAs3VUPlT9OxU3S+zg5gFgEogAM5sCuQC+jOAfTY/RLgy9RFyfqeqrAtggW7AcSxVbywKaoPUrSeO0leksfVIWnUUpvuZvZJeoArlzrw7CjZ2AZirHkbgZpkpoPDOyR6D9nt5pY1uWiP2CF1vV2XIX7lJEwrzgu1Ki0O4a9UXRCHx818OHEJzF9OJfg5iwGuHmSwAQ0tVfOtvHCKMuFRb6wQzzdcI+4GmKIkfYKSQsTEAndDXcI8nDVEJ3lEt1mFA0x/vrFm5u4fzos9nogPGLaoQ1cUqnwFcoTckM0ic2GAuEUUnhLLr3kC+remuVMGN1HuZ/AgMBAAGjUzBRMB0GA1UdDgQWBBS8RvrS4Dyk7FAMmz+ldKyIPsITGzAfBgNVHSMEGDAWgBS8RvrS4Dyk7FAMmz+ldKyIPsITGzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC5JPZscR5+q3YMgwLsjCAFY/AbUDJvavT3oy8fyO597Xa9fzBJFXY6qG7b+KYQ8TfEgNGY/AUNU3+h8YG5VyRgaIzC0FANQc2EpxnmBBW+grvLIn+BlKAaFH2LvpG+hc8fUUgGicCKUvKxCyuRZMYxzpnTn4A6PzojbALdVAG1CuicfYvD91yvsBzDimniUehSG7dyWJklwsssT6sHFjqOv/1PLej2NWcE92M1Il27IZwZfOV8urG6yd6FZlGBG+8KZP8IEsMf6OropTRKlikHSvKzsOhAnmE/1J45HDjVFNeco+bZW5iOZiHu2Ov1FMTENrMe0xgjPjI7Ri2rdcU8—–END CERTIFICATE—–
  • Ref: https://rdap.arin.net/registry/ip/76.76.21.0
  • OrgName: Vercel, Inc
  • OrgId: ZEITI
  • City: Walnut
  • StateProv: CA
  • PostalCode: 91789
  • Country: US
  • RegDate: 2020-03-26
  • Updated: 2020-06-05
  • Comment: https://vercel.com
  • Ref: https://rdap.arin.net/registry/entity/ZEITI
  • OrgTechHandle: MFV2-ARIN
  • OrgTechName: Vieira, Matheus Fernandez
  • OrgTechPhone: +1-415-980-8007
  • OrgTechEmail: m@vercel.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/MFV2-ARIN
  • OrgAbuseHandle: ABUSE7926-ARIN
  • OrgAbuseName: Abuse
  • OrgAbusePhone: +1-415-980-8007
  • OrgAbuseEmail: abuse@vercel.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE7926-ARIN

Links to attack logs

****** ****** ******

Share on: