107.173.248.142

Classification: Malicious

107.173.248.142 is a malicious IP address in Buffalo, US. Linked to Viperrat malware. 4,807 sightings from 7 threat sources, last seen 2026-10-16.

Current activity

  • Known attacker — Seen launching attacks over the Internet.
  • Known scanner — Seen scanning hosts over the Internet.

MITRE ATT&CK associations

Malware families: VIPERRAT (S0506)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Unauthorized scanning of hosts Blocklist.net.ua 2026-09-14 16:03:52 2026-10-16 16:24:05 attacker malicious-activity reconnaissance
Bruteforce AbuseIPDB 2026-06-29 04:52:15 2026-10-10 07:25:11 attacker malicious-activity
SSH Attacker AbuseIPDB 2026-06-29 04:52:15 2026-10-10 07:25:11 attacker malicious-activity
SSH Attacker Blocklist.de 2026-03-31 10:00:33 2026-09-28 14:00:14 attacker malicious-activity
Port Scanner AbuseIPDB 2026-07-20 08:41:31 2026-09-27 06:51:15 attacker malicious-activity reconnaissance
HTTP Attacker AbuseIPDB 2026-07-22 01:03:08 2026-09-21 07:38:37 attacker malicious-activity
Hacking AbuseIPDB 2026-06-29 04:52:15 2026-09-21 07:38:37 attacker malicious-activity
Malicious Host HoneyDB 2026-04-05 00:00:00 2026-09-16 00:00:00 attacker malicious-activity
Phishing AbuseIPDB 2026-09-09 20:20:17 2026-09-14 07:09:11 malicious-activity phishing
Mail Spammer AbuseIPDB 2026-09-06 21:09:13 2026-09-14 07:09:11 attacker malicious-activity
IMAP Attacker AbuseIPDB 2026-08-29 10:05:47 2026-09-14 07:09:11 attacker malicious-activity
Malicious Host AbuseIPDB 2026-03-31 23:11:39 2026-09-12 15:00:06 attacker compromised malicious-activity
DDoS Attacker AbuseIPDB 2026-08-29 10:05:47 2026-09-10 01:25:21 attacker malicious-activity
FTP Attacker AbuseIPDB 2026-08-29 10:05:47 2026-09-08 15:22:32 attacker malicious-activity
DNS Compromise AbuseIPDB 2026-09-06 21:09:13 2026-09-06 21:09:13 compromised malicious-activity
DNS Poisoning AbuseIPDB 2026-09-06 21:09:13 2026-09-06 21:09:13 compromised malicious-activity
Known Attacker AbuseIPDB 2026-09-06 21:09:13 2026-09-06 21:09:13 attacker malicious-activity
HTTP Scrapper AbuseIPDB 2026-08-29 10:05:47 2026-09-06 21:09:13 attacker malicious-activity
SQL Injection AbuseIPDB 2026-08-29 10:05:47 2026-08-31 23:47:03 attacker malicious-activity
IoT Attacker AbuseIPDB 2026-08-29 10:05:47 2026-08-31 23:47:03 iot malicious-activity
Suspicious Host AbuseIPDB 2026-06-05 06:19:21 2026-06-05 06:19:21 anomalous-activity
Bruteforce login attacker Blocklist.de 2026-04-05 05:00:17 2026-04-05 05:00:17 malicious-activity
HTTP Attacker Blocklist.de 2026-04-05 03:00:17 2026-04-05 03:00:17 malicious-activity
FTP Attacker Blocklist.de 2026-04-04 06:00:05 2026-04-04 06:00:05 malicious-activity
Viper RAT ThreatFox Abuse.ch 2023-11-09 18:18:26 2023-11-11 17:26:17 malicious-activity S0506 ViperRAT
HTTP Spammer StopForumSpam.com 2020-04-24 04:08:37 2023-01-16 22:50:57 malicious-activity
HTTP Spammer Cleantalk.org 2017-11-02 16:33:06 2017-11-02 16:33:06

Tags

bot abuse as-colocrossing c2 censys rat port:60000 ssh bruteforce attacker ftp apache ddos rfi login joomla wordpress

Whois information

AS name
AS36352 RackNerd LLC
AS registry
arin
AS date
2013-12-27 00:00:00
AS CIDR
107.173.248.0/22
CIDR
107.172.0.0/14
Registrant
RackNerd LLC
Address
325 Delaware Avenue Suite 300
City
Buffalo
State
NY
Postal code
14205
Country
US — United States 🇺🇸
Contact email
[email protected], [email protected]
First indexed
2017-11-02 16:33:06
Last updated
2026-10-16 16:24:05

Malicious IPs in the same CIDR

107.173.248.170 107.173.248.78 107.173.248.183 107.173.248.229 107.173.248.243 107.173.248.168 107.173.248.106 107.173.248.181 107.173.248.235 107.173.248.247 107.173.248.142