46.246.84.17

Classification: Suspicious

46.246.84.17 is a suspicious IP address. Linked to Remcos, Dcrat malware. Reported by 7 threat sources, last seen 2026-08-17. Network: AS42708 Glesys AB.

Current activity

  • VPN node — Provides anonymization that can hide an attacker.

MITRE ATT&CK associations

Malware families: REMCOS (S0332) DCRAT (S9017) ASYNCRAT (S1087)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
VPN IPWhois.io 2025-01-16 11:48:15 2026-08-17 18:17:57 anonymization vpn
Asyncrat Maltrail 2025-03-27 14:07:58 2025-03-27 14:07:58 malicious-activity S1087 AsyncRAT
DCRat ThreatFox Abuse.ch 2024-08-31 04:17:03 2024-10-31 15:18:28 malicious-activity S9017 DCRAT
Remcos ThreatFox Abuse.ch 2024-09-05 04:17:07 2024-09-07 03:20:29 malicious-activity S0332 Remcos
Proxy FireHOL 2023-09-02 11:32:39 2023-10-01 11:10:50 anonymization
Common Raven Maltiverse 2023-02-06 04:48:36 2023-02-07 06:33:58 malicious-activity
HTTP Spammer StopForumSpam.com 2021-05-16 20:35:12 2021-05-27 04:51:36 malicious-activity
Anonymizer Maltiverse Research Team 2021-02-16 18:53:58 2021-03-15 17:43:33 anonymizer
Anonymizer Maltiverse 2019-12-25 01:42:15 2019-12-25 01:42:15

Tags

anonymization apt anonymizer bot abuse as42708 c2 censys portlane rat port:8000 darkcrystal rat port:8888 remcosrat remvio socmer port:9090 dcrat port:5000

Whois information

AS name
AS42708 Glesys AB
AS registry
ripencc
AS date
2011-01-27 00:00:00
AS CIDR
46.246.0.0/17
Registrant
Glesys AB
City
Stockholm
Postal code
101 23
Country
SE — Sweden 🇸🇪
First indexed
2019-12-25 01:42:15
Last updated
2026-08-17 18:17:59

Malicious IPs in the same CIDR

46.246.4.15 46.246.8.121 46.246.97.3 46.246.106.43 46.246.122.83 46.246.3.226 46.246.8.130 46.246.8.138 46.246.44.53 46.246.84.10 46.246.122.104 46.246.122.76 46.246.3.244 46.246.122.121 46.246.6.66 46.246.4.9 46.246.3.206 46.246.41.155 46.246.41.154 46.246.14.6 46.246.3.234 46.246.3.193 46.246.3.241 46.246.39.245 46.246.6.16