IPMediumSignal 26/100
92.38.145.145
Location
United StatesAtlanta, Luxembourg
ASN
AS199524
Gcore NA Anycast
First Seen
Oct 9, 2020
Last Seen
Jun 10, 2026
Found in 9 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
26%
Signal Score
26 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionAtlanta, Luxembourg
ASNAS199524
OrganizationGcore NA Anycast
Feed Intelligence Summary
9 reports26% confidence
9
Source reports
26%
Confidence score
Category tags
aaaaabuse contactacademic institutionsacceptaccess ta0001account securityactive relatedactive scanactive scanningadded activeaddressagentakamaiakamai bypassalbertaalberta doctorsalberta health servicesalberta medical associationalberta ndpalberta ucpalibaba cloudall domainall hostnameall octoseekall reportalone emailamadeyamerica flaganchoranchor httpsanti-analysisappleapple phonearrayartifacts vascioasiaasnone countryattackattraustinaustraliaautoitave_mariaazaz09backdoorbackurlbad reputationbazaarbearerbelgiumbitcoinblockchainbodybody doctypebody lengthbooleanbotnetbotnet activitybrazilbrian sabeysbridgebrothbrute forcebrute force attemptsbulletproof hostingbuttonbypassbypass passwordc++ malwarec0002 wininetc2ca g2calls processcanadacapturecarol brittoncatalog treecdn obfuscationcdnscgb osectigochecker apicheckschecks creationchildchristopher ahmanncity of edmontoncivil servicesck idck idsck matrixclassclick-based attackclosecloud infrastructurecloudflare bypasscnamecnccnr12 cuscode executioncode injectioncode integritycommandcommand & controlcommand and controlcommand executioncommand linecommentcommodity contracts intermediationcommunication protocolcommunication technologiescompanyconfigconnect careconnectcare albertacontent lengthcontent typecookiecor curacorporationcountry namecovenent healthcowrie honeypotcowrie interactionscrc32creation datecredential accesscredential harvestingcredential stuffingcrlf linecrowdsourced rulecrypcrypto exchangecrypto miningcrypto walletcryptocurrencycus odigicertcus sttexascvedadjokedatadata accessdata copyingdata encryptiondata exfiltrationdata manipulationdata securitydata store exposuredata transferdata uploadddosdecentralized financedecoy systemdefense evasiondelete cdelete servicedelphidenial of servicedenmarkdesigndestination unreachabledetailsdf bitdgadialerdicator roledigicert globaldigicert incdigital currencydigital signaturedionaea honeypotdionaea interactionsdisruption of servicesdistributed attacksdll readdnsdns attackdnssecdocusign iamdocusign onlinedoin itdopple aidrive-by compromisedropped infodspmdustmapdynadot llcdynamicdynamicloaderedgeedmonton police serviceseducationeducation sectoreducational resourceseducational serviceseducational technologyeduroamelectronic health recordsemailsemotetemotionencryptencryptionenter scentityentrieserica ogerica souriserrorerror reportingeuropeeurope/asiaev rsaevidence destructionexclude suggesexecutable fileexpiration dateexpiration httpexpiry dateexploitation activityextortionextr dataextr pleaseextra datafailedfalsefattfatt signaturesfilefilesfiles domainfiles ipfiles mitrefiles relatedfirstfirst counterflagfloridafloxiffloxif.afnumberfor privacyforbidden accessforcepoint dlpformfoundfragmentation attackftp brute forcefull namefull pathfull reportsfunctiong2 tlsgamaredongeckogenericgeneric cilgeneric iniget httpget naget richardglobalcgmtngooglegoogle searchgoogle taggovernment of albertagovernment technologygraphgraph summaryguest systemhackinghall evanshandlehas descriptionheadheader intelhealth care and social assistancehealth information technologyhealthcare information systemshealthcare sectorhelp dnshichinahighhigher educationhiringhoneytrap honeypothoneytrap interactionshospital managementhosthostilehostinghostname addhostname enumerationhotjarhtml documenthtml internethtml titlehttp attackhttp gethttp probinghttp scannerhttpshttps httphub customerhullhull timeshunterhybridiana idiana registraricmpico rtgroupiconidentity & access exploitationidron anviframeiframe tagsinc cndigicertinclude datainclude reviewindiaindicatorindicators showinfo initialinformation gatheringinformation oginformation stealerinformation technologyinformation theftinfostealerinfrastructure acquisitionreconnaissanceingress tool transferinitial accessinjection activityinjection t1055input validation bypassinquest labsintegerintegrationintelinvalid attemptinvalid codeinvolved directinvolved dnsiociocsiot securityips spreadipv4ipv4 addirelandisnanit infrastructureit4us cloneit4us ransomwareitalyitemja3sjames lampkejays youtubejson arrayk-12 educationkennykenny lawkhtmllast seenlearnlearn moreleaveliberalliberal friendslink initiallink librarylinux i686linux malwarelinux platformlinux verdictlinux x8664livellp associatelocallog idloginlsan franciscolucas achalummalumma infectionmailmailoney honeypotmailoney interactionsmalicious activitymalicious downloadmalicious filemalicious linksmalicious payloadsmalicious powershell activitymalicious softwaremalwaremalware behaviourmalware capturemalware deploymentmalware distributionmalware hosting infrastructuremalware signingmanagermarkmonitor incmarkusmassinamatch infomatch lowmbisslshortmd5mediamedia centermedical servicesmediummember idmetadata analysismeyerministry of healthminutes agomitre attmitre attackmobilemobile carriersmobile networksmobile securitymonitoringmonomontserratmovedmozimp41 connectionms defendermsiemtu denialmufanommutexes nothingmwdbnamename md5name responsename serversname tacticsnamecheap incnation-state activityneedednet technologynetwirenetworknetwork anomalynetwork infonetwork intrusionnetwork intrusion detectionnetwork probenetwork scannetwork scanningnetwork securityneueneutralnextnext associatednone googlenorth americanothingnull targetnumberobjectoc0006 httpoceaniaoffice macrooffice outboundoforcepoint llcopen threatoperating systemoperating system securityotx descriptionotx logooverview zenboxp0fp0f signaturespackingpalantirian abuseparent pidparentspasspassive dnspasswordpassword bypasspath mtu discoverypath traversalpatient carepe resourcepe32 executableperforms dnsphasephishingphishing attackphishing trappleaseplease clickplease subpoemporkbun llcporn revengeportpost httppost-compromise activitypostal codepresent aprpresent augpresent decpresent febpresent janpresent sepprevprivacy adminprivacy billingprivacy techprivilege escalationprocess hollowingprocess injectionprocess32nextwprocesses extrapropprotectprotocol exploitationpseudopublic administrationpublic infrastructurepublic keypublic policypublic serverpulse pulsespulse submitpulsespulses hostnamepythonquasi governmentquery timeqwins ltdr connectionransomransomwareransomware infectionratrdap databasereadsreconnaissancerecord valueredacted forreferenrefloadapihashrefreshregexpregistry keysregulatory agenciesreimerrelated pulsesrelated tagsrelicremote accessremote access trojanremote servicesreply uniquereport spamrequestresearchedresolved ipsresource hijackingreverse dnsrichard massinarl httprocketreachrogersrole titlerootrootkit tendenciesrsa sha256rst seenrticonrticon neutralrussiarussia unknownsabeysabey data centerssabey pornsafe browsingsandbox evasionsc datasc pulsescanscan endpointsscannerscanning activityscreenshots noscriptscript domainsscript urlsscripting attacksscrollse httpsea xsearchsecurity operationssecurity scansensor-taggedsentrypeer botnetsentrypeer interactionsserversserviceservice disruptionservice privacysha valuesshell codeshowshowingsigmaslcc2smtp probingsneaky serversnitsocial engineeringsocial media securitysoftware developmentsoftware exploitationsoftware integritysourissouris alsouth americaspamspam brianspam deletespanspawnsspf infossdeepssh attackssh monitoringssl certificatestatusstatus codestopstop showstringstringssupportsuricata alertssurveysurveyssweet homeswippersymbolsystem disruptiont1005t1014t1016t1018t1021t1021.001t1027t1030t1036t1040t1041t1045t1046t1053t1053.005t1055t1055 processt1055.012t1056t1057t1059t1059.001t1059.002t1059.003t1059.007t1060t1064t1068t1069.001t1070t1071t1071.001t1071.004t1078t1080t1082t1083t1086t1090.002t1095t1105t1106t1110t1110.002t1112t1113t1119t1125t1129t1132t1132.001t1133t1134t1140t1143t1176t1189t1189 networkt1190t1195t1203t1204t1204 user executiont1204.001t1204.002t1205t1210t1213t1218t1480t1485t1486t1490t1491t1495t1496t1497t1497.001t1497.003t1498t1499.001t1499.002t1499.003t1518t1539t1542t1543t1546t1547t1548t1548.002t1548.003t1553t1553.002t1554.001t1554.003t1560t1562t1562.001t1564t1565t1566t1566 phishingt1566.001t1566.002t1566.003t1566.004t1567t1568t1568.002t1571t1573t1574t1583t1583.001t1583.003t1583.005t1584t1586t1586.001t1587.001t1588t1588.002t1589.001t1590t1590 gathert1590.001t1593.001t1595t1595.001t1595.002t1595.003t1608.001ta0004 processtannertanner interactionstargettargeted harassmenttbmvidtcp connectionstech countrytelecom servicestelecommunicationstelnet threattelusterracetexastext textthe brother sabeythird-party compromisethreat actorthreat detectionthreat intelligencetitletitle addedtls webtoggletoolstor nodetowntown counseltpottreaty 6treaty 7treaty 8tridenttrojan malwaretrojandroppertrust bypasstrust manipulationtsara brashearsturkeytwittertyp domaintypetype datatype indicatortype nametypeof btypeof etypeof symbolualbertaudp connectionsukraineunicode textunitedunited kingdomunited statesuniversity of calgaryunknown nsupdate dateurlhausurlsurls httpurls httpsurls showusus registrantuser executionutf8 textvessel statevictim won casevidarview ericavirgin islandsvirtoolvoidvoip attackvulnerabilityvulnerability scanwaitingwarzonewarzoneratweb application attackweb application exploitationweb exploitationweb securityweb trafficwebsitewidgetwin16 newin32 dynamicwin32 exewin32 malwarewindowwindows folderwindows malwarewindows ntwindows platformwindows sandboxwininet c0005winxxwormwritewrite cxxx videosyara ruleyes conformancezip archivezldtzsiqchatwindow
Activity Timeline
Jun 10Jun 10
Threat Activity Heatmap
· Peak: 2026-06-10LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreLow Risk
26
SIGNAL
Signal Score
26%
Confidence
9
Reports
First seenOct 9, 2020
Last seenJun 10, 2026
GeolocationUS
CountryUnited States
LocationAtlanta, Luxembourg
ASNAS199524
OrgGcore NA Anycast
Coords49.7498, 6.1661
VirusTotal
Not checked
WHOIS
- description
- C:\Windows\System32\ -> Type: Application, .exe - 04.17.26 - ab5b274a2c6e44377502584eee7585aa0afb4f2b60d7f7856e7a8b0bdd741bb8 Graph: https://www.virustotal.com/graph/embed/g19076ca1a92b4c99b21cd83e9244315342062f35cee14d3e8716d83222fd67dd?theme=dark
- raw
- NetRange: 92.0.0.0 - 92.255.255.255 CIDR: 92.0.0.0/8 NetName: 92-RIPE NetHandle: NET-92-0-0-0-1 Parent: () NetType: Allocated to RIPE NCC OriginAS: Organization: RIPE Network Coordination Centre (RIPE) RegDate: 2007-03-27 Updated: 2025-02-10 Comment: These addresses have been further assigned to users in the RIPE NCC region. Please note that the organization and point of contact details listed below are those of the RIPE NCC not the current address holder. ** You can find user contact information for the current address holder in the RIPE database at http://www.ripe.net/whois. Ref: https://rdap.arin.net/registry/ip/92.0.0.0 ResourceLink: https://apps.db.ripe.net/db-web-ui/query ResourceLink: whois.ripe.net OrgName: RIPE Network Coordination Centre OrgId: RIPE Address: P.O. Box 10096 City: Amsterdam StateProv: PostalCode: 1001EB Country: NL RegDate: Updated: 2013-07-29 Ref: https://rdap.arin.net/registry/entity/RIPE ReferralServer: whois.ripe.net ResourceLink: https://apps.db.ripe.net/db-web-ui/query OrgTechHandle: RNO29-ARIN OrgTechName: RIPE NCC Operations OrgTechPhone: +31 20 535 4444 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN OrgAbuseHandle: ABUSE3850-ARIN OrgAbuseName: Abuse Contact OrgAbusePhone: +31205354444 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN
- references
- http://remote.edikamin.com/, http://flat.trafficadvance.net/AccessMySOL.IVRMobileEntra?D=10927&C=7&MP=41%7C, http://deposito.hostance.net/dialer/, Found in Alt YouTube = Titled ‘watch’ | Infected System uploads to YT, Domains Contacted:Wealthy2019.com.strangled.net • wealth.warzonedns.com • wealthyme.ddns.net, DYNAMIC_DNS Query to a *.strangled .net Domain 192.168.122.91 1.1.1.1 • DNS Query to DynDNS Domain *.ddns .net, Observed DNS Query to a *.warzonedns .com domain - Likely Hostile 192.168.122.91 1.1.1.1, simswap.in (possible Mirai or relationship to), https://intelinsights.substack.com/p/bulletproof-hosting-hunt, https://www.virustotal.com/graph/embed/gdef52451e74740eaabbbcc6db2209b722e6a17129ba94f4eb92fa176bcea66f7?theme=dark, https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb, https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb/iocs, https://viz.greynoise.io/analysis/16d9bc15-d3ed-4e71-9631-16742e511649, https://any.run/malware-trends/, https://urlhaus.abuse.ch/, FormBook: FileHash-SHA256 5b9fa34fac18f4084221969800faddfe1cf0afc22d601d211ee695934e7d62cb, FormBook: 45.159.189.105, FormBook: http://45.159.189.105/bot/regex, Emotet: www.youtube.com/watch?v=GyuMozsVyYs, Relic: bam.nr-data.net [Apple Private Data Collection], capitana.onthewifi.com, xfe-URL-Jivosite.com-stix2-2.1-export.json, xfe-IP-141.8.195.43-stix2-2.1-export.json, xfe-URL-Sprinthost.net-stix2-2.1-export.json, xfe-URL-Sprinthost.com-stix2-2.1-export.json, xfe-URL-onlinenic.com-stix2-2.1-export.json, https://salesiq.zoho.com/widget, https://www.googletagmanager.com/gtm.js?id=GTM-NJ8ZJVS, https://dr9ruy61rbeb4.cloudfront.net/public/default/js/jquery.1.12.4.min.js, https://dr9ruy61rbeb4.cloudfront.net/public/default/js/henfon.js, https://dr9ruy61rbeb4.cloudfront.net/public/default/js/login.js, https://www.googletagmanager.com/gtag/js?id=AW-981945515, https://script.hotjar.com/modules.842d4c8f486a0abe4e43.js, https://js.zohocdn.com/salesiq/js/floatbutton9_0842f44b8ddd3f3849043768247b4538_.js, https://script.hotjar.com/preact-incoming-feedback.5dfa9419517f52a1fde8.js, https://dr9ruy61rbeb4.cloudfront.net/public/default/js/jquery.flexslider-min.js, https://vars.hotjar.com/box-21ccaa45726c0f3c8c458f7a87eb2298.html, https://www.googletagmanager.com/gtm.js?id=GTM-PDQG75
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 5 years ago · Last seen 14 days ago
Appeared in 9 threat reports