77.91.68.63 Threat Intelligence and Host Information

Aug 14, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 77.91.68.63 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

  • Mitre ATT&CK IDs: T1496 - Resource Hijacking, T1498 - Network Denial of Service, T1553 - Subvert Trust Controls, T1564 - Hide Artifacts

  • Tags: 32, 32-bit, activity, AgentTesla, albania, allowing server, amadey, Amadey, arkei, arm, asus, AsyncRAT, attack, AveMariaRAT, azure ad, beware, blackcat, blacklist host, bumblebee, camaro dragon, CoinMiner, condi, critical flaws, cvss, cvss base, cybercrime, date, dcrat, ddos, december, dropped-by-amadey, dropped-by-PrivateLoader, elf, encrypted, energy, exe, exploit, fabookie, formbook, fortinet, gafgyt, gcleaner, glupteba, google releases, grafana, hajime, hashes domains, hashes url, hong kong, icedid, ip address, ip country, japan, javascript, june, latest spambot, linux kernel, malware, malware url, mastodon social, mips, mirai, moveit transfer, Mozi, multi, multi#storm, name submit, network patches, opendir, plugx, poland, PrivateLoader, qakbot, QuasarRAT, ransomware, rats, RecordBreaker, redenergy, redline, RedLine, RedLineStealer, remcos, RemcosRAT, scarcruft, server, service, sha1 file, shellscript, smokeloader, storm, tags, truebot, vidar, Vidar, vietnam, visit, week rank, windows, winscp, woocommerce, xmrig, youtube, zip

  • View other sources: Spamhaus VirusTotal

  • Country: Russia
  • Network:
  • Noticed: 8 times
  • Protocols Attacked: SSH
  • Countries Attacked: Brazil, Canada, India, Philippines, United States of America

Malware Detected on Host

Count: 234 f6cee9e5c672d02a0c9ac874106e30e7c044ccb4a8caff6dfabf689766078be0 7de90177d647f1b5ff288b42c371224a3d3fedd3f86f8c461ccc50556293d06f 4370409a220f947909153e9c2d8d23d047fb12353f97286e48bcded02c67587d 854c06f0937308ea1a739adef7630b11c7a334be5684e6a172497a60d82df473 66da6926e1b1daf3eafaa676b20e1b834a86c96c8e1fe1429424d2844e74d562 c42007d1c80e64db5a4a92796643371bfe0da6cb53f1539058945d33249920da 013157f99fed1022076949ab55269641e01756128c69c434a1ee2acb803a3c03 70c3ceb74a5b47a05a2dd24e160d615b73c2f34207429e4870b1658af9b48b3c ff4c1995ccfd08f70548fb82693ddec8d91c64d8d491319ae999ef60ac8f1200 1af708e528da16026d5cc057e1099451215d2654ca69bf8ce0fa3f61c5acad5b

Open Ports Detected

22

Map

Whois Information

  • inetnum: 77.91.68.0 - 77.91.68.255
  • netname: Partners_INC
  • geofeed: https://webhost1.ru/upload/geoip/geofeed.csv
  • country: AM
  • admin-c: CA11018-RIPE
  • tech-c: CA11018-RIPE
  • status: SUB-ALLOCATED PA
  • mnt-by: INC-PARTNERS-365-MNT
  • mnt-by: lir-us-365hosting-1-MNT
  • mnt-by: lir-ge-fast-1-MNT
  • created: 2024-07-11T19:05:04Z
  • last-modified: 2024-11-05T08:34:35Z
  • abuse-c: CA11018-RIPE
  • descr: 365.partners INC
  • role: CEO
  • address: 30 N GOULD ST, STE R, SHERIDAN WY 82801
  • abuse-mailbox: support@365.hosting
  • nic-hdl: CA11018-RIPE
  • mnt-by: CORP-365-PARTNERS-MNT
  • created: 2023-04-19T14:26:56Z
  • last-modified: 2023-04-19T16:12:40Z
  • route: 77.91.68.0/24
  • origin: as198178
  • mnt-by: lir-ge-fast-1-MNT
  • mnt-by: lir-us-365hosting-1-MNT
  • created: 2024-11-02T10:54:35Z
  • last-modified: 2024-11-02T10:55:08Z

Links to attack logs

****** ****** ******

Share on: