213.152.162.19
Classification: Malicious
213.152.162.19 is a malicious IP address in Amsterdam, NL. Linked to Remcos malware. 101 sightings from 5 threat sources, last seen 2026-11-07.
Current activity
- Command & Control server — Used by cybercriminals to control victim computers.
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| DCRat | ThreatFox Abuse.ch | 2026-11-07 05:10:25 | 2026-11-07 05:25:06 | botnet malicious-activity | |
| VPN | IPWhois.io | 2025-04-26 04:27:02 | 2026-10-14 23:08:17 | anonymization vpn | |
| Remcos | ThreatFox Abuse.ch | 2026-10-14 21:10:20 | 2026-10-14 21:25:06 | botnet malicious-activity | S0332 Remcos |
| Parasite SEO | Blocklist.net.ua | 2026-07-22 16:01:19 | 2026-07-22 16:01:19 | attacker malicious-activity | |
| Suspicious Host | AbuseIPDB | 2025-04-26 02:55:14 | 2026-03-02 02:42:48 | anomalous-activity | |
| Malicious Host | AbuseIPDB | 2025-04-25 23:22:12 | 2025-04-29 20:09:21 | compromised malicious-activity | |
| Bruteforce | AbuseIPDB | 2025-04-25 22:33:24 | 2025-04-28 00:07:14 | malicious-activity | |
| Bruteforce login attacker | Blocklist.de | 2025-04-27 07:32:38 | 2025-04-27 07:32:38 | malicious-activity | |
| HTTP Attacker | Blocklist.de | 2025-04-27 06:32:24 | 2025-04-27 06:32:24 | malicious-activity | |
| HTTP Attacker | AbuseIPDB | 2025-04-25 22:33:24 | 2025-04-27 02:58:40 | malicious-activity | |
| Hacking | AbuseIPDB | 2025-04-25 23:00:35 | 2025-04-26 21:51:29 | malicious-activity | |
| HTTP Scrapper | AbuseIPDB | 2025-04-25 22:33:24 | 2025-04-26 21:51:29 | anomalous-activity | |
| SQL Injection | AbuseIPDB | 2025-04-25 23:22:12 | 2025-04-26 11:02:23 | malicious-activity | |
| SSH Attacker | AbuseIPDB | 2025-04-26 00:00:48 | 2025-04-26 00:58:52 | malicious-activity | |
| DDoS attack | AbuseIPDB | 2025-04-25 22:45:32 | 2025-04-25 22:45:32 | malicious-activity |
Tags
apache ddos rfi attacker login bruteforce bot joomla wordpress abuse socmer remotehost remvio remcosrat port:25674 c2 remcos port:57490 modat darkcrystal rat dcratWhois information
- AS name
- AS49453 Global Layer B.V.
- Registrant
- Global Layer B.V.
- City
- Amsterdam
- Postal code
- 1012
- Country
- NL — Netherlands 🇳🇱
- First indexed
- 2025-04-26 04:26:59
- Last updated
- 2026-11-07 05:25:06