128.90.108.35
Classification: Malicious
128.90.108.35 is a malicious IP address in Bogota, CO. Linked to Remcos malware. 10 sightings from 4 threat sources (SIP Attacker, VPN), last seen 2026-10-13.
Current activity
- Command & Control server — Used by cybercriminals to control victim computers.
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2026-10-13 19:08:22 | 2026-10-13 19:08:22 | anonymization vpn | |
| Remcos | ThreatFox Abuse.ch | 2026-10-13 16:01:27 | 2026-10-13 16:25:07 | botnet malicious-activity | S0332 Remcos |
| SIP Attacker | Blocklist.de | 2023-01-17 02:32:57 | 2023-01-18 02:33:24 | malicious-activity | |
| Bruteforce login attacker | Blocklist.de | 2022-09-03 01:58:47 | 2022-09-04 01:56:12 | malicious-activity | |
| HTTP Attacker | Blocklist.de | 2022-09-03 01:49:12 | 2022-09-04 01:49:19 | malicious-activity | |
| SIP Attacker | Maltiverse | 2022-09-01 14:00:08 | 2022-09-01 23:11:38 | malicious-activity | |
| Bruteforce | Maltiverse | 2022-09-01 13:59:02 | 2022-09-01 23:11:38 | malicious-activity | |
| SSH Attacker | Maltiverse | 2022-09-01 13:59:02 | 2022-09-01 14:07:42 | malicious-activity | |
| Port Scanner | Maltiverse | 2022-09-01 14:07:39 | 2022-09-01 14:07:39 | anomalous-activity | |
| Hacking | Maltiverse | 2022-09-01 14:00:21 | 2022-09-01 14:03:20 | malicious-activity |
Tags
sip bruteforce bot attacker login joomla wordpress apache ddos rfi 332ps1ago socmer remvio remcosrat c2 port:2424 remcosWhois information
- AS name
- AS40861 Unus, Inc.
- AS registry
- arin
- AS date
- 1987-12-03 00:00:00
- AS CIDR
- 128.90.108.0/24
- CIDR
- 128.90.0.0/16
- Registrant
- Unus, Inc.
- Address
- 835 W. 6th St. Suite 1440
- City
- Bogota
- State
- TX
- Postal code
- 111411
- Country
- CO — Colombia 🇨🇴
- Contact email
- [email protected], [email protected], [email protected]
- First indexed
- 2022-09-03 01:49:12
- Last updated
- 2026-10-13 19:08:25
Malicious IPs in the same CIDR
128.90.108.138 128.90.108.84 128.90.108.50 128.90.108.200 128.90.108.66 128.90.108.144 128.90.108.119 128.90.108.169 128.90.108.35 128.90.108.73