91.216.248.20 Threat Intelligence and Host Information

Oct 21, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 91.216.248.20 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 41/100

Host and Network Information

  • Tags: cyber security, ioc, malicious, Nextray, phishing

  • JARM: 2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06b

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: coinbl_hosts, hphosts_psh

Malware Detected on Host

Count: 21 53a25b4b715855f13b61b58ac20deeef139c7d28b0005dce530ec650ed1c09e0 7ebb8fcd2dc224a7877acbdff54e3de67679683c2efad6c48354acc0cb80e71e eba0146fde79a8c4f45b49e32477894235e0ffcf55329f6a1a275b9fda7b0eb1 d86c9bba3dc842d52259325e492c2fea9a9709eda74efe5281122c55b8d88bb4 f632701d3fb836c9a86efff8ca268d2c90cdd375630810dbb3543223f92044c0 5c821c92d5a0594487bce5d51260fffb893f016ad0fce62a36e144c990de0a2e 1a97f29caceca8172097969189954ccfbb1e8e0cb0f3a304a480a9e206158a90 4b017da929e1ba7682bb4ab2db3dd738b87b361f5609a840c8ccceb594a807e2 6bf493452bab46c3395a4e41f1e5f587738eb6cb009315e27780d219070b3890 5029f959a9610a081db09774a2e8fb6e3552e057e71454b9e3f1481a63885862

Open Ports Detected

123 22 3306 443 80

CVEs Detected

CVE-2022-31628 CVE-2022-31629 CVE-2022-37454

Map

Whois Information

  • inetnum: 91.216.248.0 - 91.216.248.255
  • netname: DE-LIMACITY-CLOUD
  • country: DE
  • abuse-c: ACRO293-RIPE
  • org: ORG-TG211-RIPE
  • admin-c: PHIL42-RIPE
  • tech-c: PHIL42-RIPE
  • status: ASSIGNED PI
  • mnt-by: RIPE-NCC-END-MNT
  • mnt-by: TRAFFICPLEX-MNT
  • mnt-routes: TRAFFICPLEX-MNT
  • mnt-domains: TRAFFICPLEX-MNT
  • created: 2010-07-13T13:31:44Z
  • last-modified: 2021-04-28T11:57:39Z
  • organisation: ORG-TG211-RIPE
  • org-name: TrafficPlex GmbH
  • org-type: LIR
  • address: Konsul-Smidt-Str. 90
  • address: 28217
  • address: Bremen
  • address: GERMANY
  • country: DE
  • phone: +4942140899450
  • admin-c: RA10375-RIPE
  • tech-c: RA10375-RIPE
  • abuse-c: AR62322-RIPE
  • mnt-ref: TRAFFICPLEX-MNT
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: TRAFFICPLEX-MNT
  • created: 2021-01-22T09:08:09Z
  • last-modified: 2021-01-22T09:08:12Z
  • person: Phillipp Roell
  • address: TrafficPlex GmbH
  • address: Konsul-Smidt-Str. 90
  • address: 28217 Bremen
  • address: Germany
  • phone: +4942140899450
  • nic-hdl: PHIL42-RIPE
  • mnt-by: TRAFFICPLEX-MNT
  • created: 2015-06-16T18:56:18Z
  • last-modified: 2021-04-22T09:32:21Z
  • route: 91.216.248.0/24
  • descr: Roell
  • origin: AS47447
  • mnt-by: MNT-23MEDIA
  • created: 2011-01-21T11:53:15Z
  • last-modified: 2011-01-21T11:53:15Z
Share on: