92.53.96.150 Threat Intelligence and Host Information

Oct 21, 2023 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 92.53.96.150 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

  • Mitre ATT&CK IDs: T1005 - Data from Local System, T1016 - System Network Configuration Discovery, T1020 - Automated Exfiltration, T1021 - Remote Services, T1025 - Data from Removable Media, T1027 - Obfuscated Files or Information, T1033 - System Owner/User Discovery, T1036 - Masquerading, T1039 - Data from Network Shared Drive, T1041 - Exfiltration Over C2 Channel, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1057 - Process Discovery, T1059 - Command and Scripting Interpreter, T1070 - Indicator Removal on Host, T1071 - Application Layer Protocol, T1080 - Taint Shared Content, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1102 - Web Service, T1105 - Ingress Tool Transfer, T1106 - Native API, T1112 - Modify Registry, T1113 - Screen Capture, T1119 - Automated Collection, T1120 - Peripheral Device Discovery, T1137 - Office Application Startup, T1140 - Deobfuscate/Decode Files or Information, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1218 - Signed Binary Proxy Execution, T1220 - XSL Script Processing, T1221 - Template Injection, T1485 - Data Destruction, T1486 - Data Encrypted for Impact, T1490 - Inhibit System Recovery, T1491 - Defacement, T1498 - Network Denial of Service, T1534 - Internal Spearphishing, T1547 - Boot or Logon Autostart Execution, T1559 - Inter-Process Communication, T1562 - Impair Defenses, T1564 - Hide Artifacts, T1566 - Phishing, T1568 - Dynamic Resolution, T1583 - Acquire Infrastructure, T1608 - Stage Capabilities

  • Tags: adwind, adwind rat, agent tesla, agenttesla, aggah, alienspy, all at, amadey, ammyy, ammyy admin, analyze, andromut, angler, apart, april, asyncrat, august, aurora, ave maria, axpergle, azorult, belarus, bitcoin, bladabindi, bokbot, browserpassview, chacha, chanitor, chatgpt, chthonic, click, cloudeye, cobalt strike, cobaltstrike, copy, cridex, crimson, crimson rat, cryptbot, crysis, cve201711882, cyber security, danabot, darkcomet, darkside, datos, descubrimiento, desfiguracin, desktop, dharma, discord, dofoil, domains, dridex, dunihi, dyre, egregor, el, el malware, emotet, emotet malware, empresa, eternalblue, execution, exfiltracin, fake net, fallout, fareit, february, first, flawedammy, flawedammyy, formbook, friendly, gamaredon, gamaredon group, gandcrab, glupteba, gootkit, gozi, graph api, group, grupo gamaredon, guloader, hancitor, hashes, hawkeye, hermes, houdini, hunter, hworm, icedid, ioc, iocs ip, javascript, jenxcus, june, kill, killswitch, loader, lockbit, loki bot, lokibot, macos, mailpassview, mailto, maldoc, malicious, malspam, malware, march, mars, maze, mega, mexico, microsoft, mimikatz, nanocore, nanocore rat, napoleon, nemty, netwalker, netwire, neutrino, next, Nextray, njrat, nuclear, open, orcus, orcus rat, panda banker, path, phishing, phobos, pinkslipbot, please, poisonivy, polish, pony, powershell, predator, predator pain, psexec, qakbot, qbot, quasar, quasar rat, raccoon, racealer, ransom, ransomware, rats, recent blog, redline, redline stealer, remcos, revenge, revenge rat, revil, ryuk, ryuk ransomware, scarimson, screen, seen, servhelper, service, shadow, shell, siplog, smokeldr, smoke loader, smokeloader, snake, sockrat, sodinokibi, spelevo, squirrelwaffle, sticky, systembc, teamspy, teamviewer, terdot, thief, track them, trickbot, trojan, troldesh, ukraine, un ladrn, urls, ursnif, vawtrak, vidar, virustotal, wannacry, wannycry, wcry, wcry ransomware, windigo, winrar, xtremerat, zbot, zloader

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: gpf_comics, hphosts_fsa

Malware Detected on Host

Count: 205 353fbdff2833c0da7b85d6532c5cba24612a9cd62e6a1dd4b98acbbe3fac6485 2af93f28385da854504154ed199f421ad00e12751842f730be3ce9fd7cd4bb33 ccbee1585f33aa777536f3e78ffc0a4d431dba22a658e082035c075f11411fd9 c5d0764ef1e70700522c33a96367c5a16ef6d715a38e662337add9703be0a726 5f1121bddd56189e23bc644b7566b94c95c17cebd58a87d4513900c0b2c028ee 626fdc6a87a205cd1854ba10fb2a77266cae3d00324dd8dfd38adf070a4c05f3 98f291632787ad78b24d2b719c892f0821230c1202ce8d70aebdc10433ad9876 b00d2ad39bdb0413e94b3507c39a14ccbe238c07afeb68a0ed460a741255f239 2cd6f3a096f782d0db587d8338c4a9bd66650ba7fb76e1f29f1fc7c1a89438d6 bbe2e8e28000372a50681b9a70bd99bd15ee477a31690a10ad1624a7018a10f5

Open Ports Detected

21 22 443 80

Map

Whois Information

  • inetnum: 92.53.96.0 - 92.53.96.255
  • netname: TimeWeb-1
  • descr: Shared hosting
  • country: RU
  • admin-c: TMWB-RIPE
  • tech-c: TMWB-RIPE
  • status: ASSIGNED PA
  • mnt-by: TIMEWEB-MNT
  • created: 2008-03-18T10:59:13Z
  • last-modified: 2008-03-18T10:59:13Z
  • role: TimeWeb Co. Ltd. Role Account
  • address: 22/2 lit.A,Zastavskaya str.
  • address: 196006, Saint-Petersburg
  • address: Russia
  • phone: +7 812 2481081
  • phone: +7 495 0331081
  • abuse-mailbox: abuse@timeweb.ru
  • admin-c: AB44608-RIPE
  • tech-c: AB44608-RIPE
  • tech-c: AG26308-RIPE
  • nic-hdl: TMWB-RIPE
  • mnt-by: TIMEWEB-MNT
  • created: 2008-03-18T10:36:42Z
  • last-modified: 2023-05-24T11:48:07Z
  • route: 92.53.96.0/24
  • origin: AS9123
  • mnt-by: TIMEWEB-MNT
  • created: 2013-07-28T16:10:42Z
  • last-modified: 2022-09-02T12:43:18Z
Share on: