46.246.120.178
Classification: Suspicious
46.246.120.178 is a suspicious IP address in Stockholm, SE. Linked to Cosmicduke malware. 8 sightings from 3 threat sources (VPN), last seen 2025-12-23.
MITRE ATT&CK associations
Malware families: COSMICDUKE (S0050)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2025-12-23 01:23:05 | 2025-12-23 01:23:05 | anonymization | |
| Backdoor.CosmicDuke | Hybrid-Analysis | 2019-02-21 06:17:07 | 2021-08-24 06:15:11 | S0050 CosmicDuke | |
| Gen:Variant.Zusy | Hybrid-Analysis | 2020-08-11 02:30:14 | 2021-04-16 22:30:17 | ||
| Gen:Variant.Graftor | Hybrid-Analysis | 2021-04-12 18:15:58 | 2021-04-12 18:15:58 | ||
| Trojan.CosmicDuke | Hybrid-Analysis | 2018-08-01 11:16:26 | 2021-03-21 19:00:09 | S0050 CosmicDuke | |
| Trojan.Generic | Hybrid-Analysis | 2019-08-20 01:00:07 | 2019-08-20 01:00:07 | ||
| Generic.Malware | Hybrid-Analysis | 2018-08-01 20:16:12 | 2018-08-01 20:16:12 | ||
| ransomware | Maltiverse | 2017-10-19 06:45:30 | 2017-10-19 06:45:30 |
Tags
ransomwareWhois information
- AS name
- AS42708 Glesys AB
- AS registry
- ripencc
- AS date
- 2011-01-27 00:00:00
- AS CIDR
- 46.246.0.0/17
- Registrant
- Glesys AB
- City
- Stockholm
- Postal code
- 117 56
- Country
- SE — Sweden 🇸🇪
- First indexed
- 2017-10-19 06:45:30
- Last updated
- 2026-10-19 05:57:10
Malicious IPs in the same CIDR
46.246.44.53 46.246.8.176 46.246.84.14 46.246.97.3 46.246.8.177 46.246.84.11 46.246.6.3 46.246.41.154 46.246.6.8 46.246.12.11 46.246.41.155 46.246.3.206 46.246.3.226 46.246.8.130 46.246.12.13 46.246.12.8 46.246.12.18 46.246.39.245 46.246.123.6 46.246.6.15 46.246.84.3 46.246.6.17 46.246.4.15 46.246.14.21 46.246.12.24