208.91.70.79
Classification: Malicious
208.91.70.79 is a malicious IP address in Chicago, US. Linked to Dcrat malware. Reported by ThreatFox Abuse.ch and IPWhois.io (VPN), last seen 2026-11-07.
Current activity
- Command & Control server — Used by cybercriminals to control victim computers.
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: DCRAT (S9017)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| DCRat | ThreatFox Abuse.ch | 2026-11-07 05:10:19 | 2026-11-07 05:25:06 | botnet malicious-activity | S9017 DCRAT |
| VPN | IPWhois.io | 2026-11-07 05:25:06 | 2026-11-07 05:25:06 | anonymization vpn |
Tags
darkcrystal rat modat port:7000 dcratWhois information
- AS name
- AS40861 Paradise Networks LLC
- Registrant
- Paradise Networks LLC
- City
- Chicago
- State
- IL
- Postal code
- 60666
- Country
- US — United States 🇺🇸
- First indexed
- 2026-11-07 05:25:06
- Last updated
- 2026-11-07 05:25:06