208.91.197.91

Classification: Whitelisted

208.91.197.91 is a whitelisted (trusted) IP address listed by Maltiverse. 71 sightings from 20 threat sources, last seen 2026-07-18.

Current activity

  • Hosting provider — Shared hosting infrastructure.

MITRE ATT&CK associations

Malware families: SMOKE LOADER (S0226) PONY (S0453)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Hosting Provider Maltiverse 2026-07-18 09:16:01 2026-07-18 09:16:01 benign hosting
virut Maltiverse Research Team 2018-10-04 01:53:22 2022-06-24 00:58:17 malicious-activity
SmokeLoader ThreatFox Abuse.ch 2022-05-15 21:21:06 2022-05-15 21:21:06 malicious-activity S0226 Smoke Loader
Malicious site Hybrid-Analysis 2018-10-17 08:30:06 2021-11-13 11:45:04
Malware Hybrid-Analysis 2018-04-27 07:30:10 2021-10-20 10:00:08
Trojan.DOC.Agent Hybrid-Analysis 2021-10-20 09:15:09 2021-10-20 09:15:09
Kryptik.ACFG Hybrid-Analysis 2021-08-05 02:30:38 2021-08-05 03:45:11
Phishing site Hybrid-Analysis 2019-10-18 06:35:07 2021-06-18 04:00:11
FileRepMetagen [Malware] Hybrid-Analysis 2021-06-08 07:15:21 2021-06-08 07:15:21
Backdoor.MSIL Hybrid-Analysis 2021-06-04 10:17:05 2021-06-04 11:30:22
Malware.Generic Hybrid-Analysis 2021-02-01 06:00:08 2021-06-03 16:00:10
Phishing Maltiverse 2021-04-19 01:41:18 2021-04-19 01:41:18 compromised
FileRepMalware Hybrid-Analysis 2021-02-11 12:00:16 2021-04-16 13:17:38
Scr.Malcode Hybrid-Analysis 2021-04-15 14:15:46 2021-04-15 14:15:46
Generic.Malware Hybrid-Analysis 2018-04-18 09:15:13 2021-04-15 14:07:23
BehavesLike.Dropper Hybrid-Analysis 2021-04-13 23:30:34 2021-04-14 00:21:35
Trojan.MSIL Hybrid-Analysis 2021-04-10 20:17:07 2021-04-10 21:08:07
Gen:Variant.Jacard Hybrid-Analysis 2021-03-15 14:00:51 2021-03-15 14:00:57
Malicious url Cyber Threat Coalition 2020-12-14 21:46:03 2021-03-04 16:58:56 malicious-activity
Malicious Hostname Cyber Threat Coalition 2020-12-14 04:13:19 2021-03-03 16:16:20 malicious-activity
Trojan.Generic Hybrid-Analysis 2018-08-20 08:00:29 2021-02-24 01:00:32
DangerousObject.Multi Hybrid-Analysis 2021-02-08 22:17:11 2021-02-08 22:17:13
Phishing Phishtank 2017-10-15 15:50:43 2021-01-26 13:20:40 compromised malicious-activity
Social Engineering Phishtank 2018-07-13 08:20:56 2021-01-26 13:20:40 malicious-activity
apple phishing Antiphishing.com.ar 2020-09-28 11:21:47 2021-01-26 12:34:28
Covid19 scam Cyber Threat Coalition 2020-11-20 20:02:31 2020-12-13 22:02:48 malicious-activity
Covid19 scam DomainTools 2020-04-19 17:37:55 2020-08-25 01:47:46 malicious-activity
Phishing Three UK OpenPhish 2020-08-10 06:24:41 2020-08-10 06:24:41
Social Engineering OpenPhish 2020-05-12 03:51:04 2020-08-10 06:24:41 malicious-activity
Phishing Generic/Spear Phishing OpenPhish 2020-07-14 05:00:20 2020-07-31 11:52:11
Malware site Hybrid-Analysis 2020-03-12 20:15:23 2020-07-08 13:45:52
uber phishing Antiphishing.com.ar 2019-11-22 01:47:35 2020-06-15 03:20:03
paypal phishing Antiphishing.com.ar 2020-06-03 09:40:54 2020-06-03 09:40:54
Covid19 scam CCN-CERT 2020-04-13 15:14:19 2020-06-02 11:04:27 malicious-activity
Phishing M & T Bank Coporation OpenPhish 2020-05-12 03:51:04 2020-05-12 03:51:04
banjori Bambernek 2017-10-15 09:32:56 2020-04-20 20:48:25 malicious-activity
suppobox Maltiverse Research Team 2020-04-20 01:25:35 2020-04-20 01:25:35
Malicious domain Telefonica Peru 2020-04-08 18:01:38 2020-04-09 05:12:46
Gen:Variant.Zusy Hybrid-Analysis 2020-03-24 12:30:29 2020-03-24 12:30:35
Unsafe.AI_Score_99% Hybrid-Analysis 2020-02-11 17:15:54 2020-02-11 17:16:00
BehavesLike.CryptDoma Hybrid-Analysis 2019-12-04 11:15:10 2019-12-04 11:15:12
Phishing National Australia Bank Limited OpenPhish 2019-12-02 08:52:40 2019-12-02 08:52:40
Simda Bambernek 2017-10-15 17:19:29 2019-11-23 12:40:07 anomalous-activity
Ramnit Bambernek 2018-06-14 06:43:31 2019-11-23 12:34:44 anomalous-activity
proslikefan Maltiverse Research Team 2019-11-16 00:53:50 2019-11-16 00:53:50
Phishing National Australia Bank Phishtank 2019-10-27 02:37:30 2019-10-27 02:37:30
W32.HfsAutoB Hybrid-Analysis 2019-10-08 15:00:33 2019-10-08 15:00:33
Spyware.Gootkit Hybrid-Analysis 2019-10-05 12:17:04 2019-10-05 12:17:24
Gen:Variant.Ser.Ursu Hybrid-Analysis 2019-06-03 19:45:35 2019-06-03 19:45:49
banjori Maltiverse Research Team 2019-05-12 13:28:31 2019-05-12 13:28:31
Virut Bambernek 2019-03-09 07:00:37 2019-03-09 07:00:37
Phishing Bank of America OpenPhish 2019-02-26 08:35:02 2019-02-26 08:35:02
Spamming Alienvault Ip Reputation Database 2018-02-28 11:36:24 2019-02-19 07:10:11
Phishing PayPal Phishtank 2017-11-06 14:24:11 2018-10-22 09:03:59
Trojan.Injector Hybrid-Analysis 2018-07-17 10:15:18 2018-07-17 10:15:18
Phishing Bendigo Bank Phishtank 2018-07-13 08:20:56 2018-07-13 08:20:56
Social Engineering Google Safebrowsing 2018-07-02 08:45:00 2018-07-02 08:45:00
CVE-2017-8570 Hybrid-Analysis 2018-06-27 01:45:17 2018-06-27 01:46:08
Phishing RuneScape Phishtank 2018-06-10 17:51:15 2018-06-10 17:51:15
HEUR:Trojan.MSIL Hybrid-Analysis 2018-05-15 14:30:50 2018-05-15 14:30:58
Gen:Trojan.Heur Hybrid-Analysis 2018-04-30 10:45:56 2018-04-30 10:45:57
virut Maltiverse 2018-03-28 02:44:14 2018-03-28 02:44:14
Pony Cybercrime-tracker.net 2018-03-19 08:33:04 2018-03-19 08:33:04 S0453 Pony
Defacement Zone-H 2017-12-22 08:35:56 2017-12-22 08:35:56
Malware distribution site Malwaremustdie.org 2017-12-09 23:53:12 2017-12-09 23:53:12
ET CNC Zeus Tracker Reported CnC Server UDP Emerging Threats 2017-10-15 14:01:36 2017-11-18 16:35:02
ET CNC Zeus Tracker Reported CnC Server TCP Emerging Threats 2017-10-24 11:10:56 2017-11-18 16:35:01
Suppobox Bambernek 2017-11-15 11:45:42 2017-11-15 11:45:42
ZeuS Zeustracker 2017-11-10 20:17:08 2017-11-10 20:17:08
apt Maltiverse 2017-11-10 01:36:22 2017-11-10 01:36:22
Malicious domain SANS Internet Storm Center 2017-11-09 19:21:50 2017-11-09 19:21:50
Commonwealth Bank Netbank phishing Maltiverse 2017-11-02 16:43:18 2017-11-02 16:43:18

Tags

c&c c2 dga smokeloader dofoil sharik smoke smoke loader malware banjori phishing ramnit sector:financial bank of america virut simda national australia bank limited covid19 coronavirus scam m & t bank coporation generic/spear phishing sector:telecommunications three uk

Whois information

AS name
AS40034 Confluence Networks Inc
AS registry
arin
AS date
2011-04-15 00:00:00
AS CIDR
208.91.197.0/24
CIDR
208.91.196.0/23
Registrant
Confluence Networks Inc
Address
3rd Floor, J & C Building, P.O. Box 362
City
Washington
State
DC
Postal code
20511
Country
US — United States 🇺🇸
Contact email
[email protected], [email protected]
First indexed
2017-10-15 09:32:56
Last updated
2026-09-27 23:53:32