198.202.211.1
Classification: Whitelisted
198.202.211.1 is a whitelisted (trusted) IP address listed by Maltiverse. 71 sightings from 5 threat sources, last seen 2026-10-10.
Current activity
- VPN node — Provides anonymization that can hide an attacker.
- Hosting provider — Shared hosting infrastructure.
MITRE ATT&CK associations
Malware families: SOCGHOLISH (S1124)
Where it has been seen
Observed by Maltiverse Threat Observatory sensors in CO, HN, NI and US, across education, financial services, manufacturing and technology networks.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2026-03-12 18:59:18 | 2026-10-10 02:29:18 | anonymization vpn | |
| Hosting Provider | Maltiverse | 2026-07-22 20:08:31 | 2026-07-22 20:08:44 | benign hosting | |
| Suspicious Host | AbuseIPDB | 2026-02-07 07:29:37 | 2026-05-30 01:25:15 | anomalous-activity | |
| Proxy | IPWhois.io | 2026-04-13 00:07:14 | 2026-05-13 02:14:29 | anonymization | |
| Malicious Host | HoneyDB | 2026-05-02 00:00:00 | 2026-05-02 00:00:00 | malicious-activity | |
| VPN PublicVpnConfigs | Maltiverse Threat Observatory | 2026-03-10 08:00:44 | 2026-03-16 08:00:44 | country_code:co country_code:hn country_code:ni country_code:us industry:education-and-nonprofits industry:financial-services industry:manufacturing industry:technology-and-telecommunications | |
| FAKEUPDATES | ThreatFox Abuse.ch | 2025-05-19 14:17:04 | 2025-05-21 07:27:16 | malicious-activity | S1124 SocGholish |
Tags
fakeupdates socgholish port:443 fakeupdate port:1194 port:51820 port:992 port:5555 port:500 port:4500 port:1701 port:1723Whois information
- AS name
- AS209242 Webflow, Inc
- Registrant
- Webflow, Inc
- City
- San Francisco
- State
- CA
- Postal code
- 94119
- Country
- US — United States 🇺🇸
- First indexed
- 2025-05-19 14:17:04
- Last updated
- 2026-10-10 02:29:19