89.32.41.19
Classification: Malicious
89.32.41.19 is a malicious IP address in Timisoara, RO. Linked to Menupass activity. 517 sightings from 3 threat sources (Mail Spammer), last seen 2026-10-08.
Current activity
- Known attacker — Seen launching attacks over the Internet.
- Known scanner — Seen scanning hosts over the Internet.
MITRE ATT&CK associations
Intrusion sets: MENUPASS (G0045)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Potassium | ThreatFox Abuse.ch | 2026-10-06 16:57:12 | 2026-10-08 04:25:04 | malicious-activity | G0045 menuPass |
| Mail Spammer | Barracuda | 2024-12-02 06:28:33 | 2026-10-06 18:09:33 | attacker malicious-activity | |
| Hacking | AbuseIPDB | 2026-08-31 04:50:22 | 2026-09-30 22:00:03 | attacker malicious-activity | |
| Bruteforce | AbuseIPDB | 2026-08-26 17:50:15 | 2026-09-30 22:00:03 | attacker malicious-activity | |
| Mail Spammer | AbuseIPDB | 2026-07-08 21:01:21 | 2026-09-27 00:34:17 | attacker malicious-activity | |
| Port Scanner | AbuseIPDB | 2026-08-26 21:11:10 | 2026-09-27 00:34:17 | attacker malicious-activity reconnaissance | |
| SIP Attacker | AbuseIPDB | 2026-08-27 15:50:27 | 2026-09-26 16:24:39 | attacker malicious-activity | |
| DDoS Attacker | AbuseIPDB | 2026-08-29 05:41:52 | 2026-09-25 07:42:32 | attacker malicious-activity | |
| SSH Attacker | AbuseIPDB | 2026-09-11 09:32:16 | 2026-09-24 13:19:15 | attacker malicious-activity | |
| HTTP Scrapper | AbuseIPDB | 2026-08-27 06:31:26 | 2026-09-23 22:23:08 | attacker malicious-activity | |
| HTTP Attacker | AbuseIPDB | 2026-08-27 06:31:26 | 2026-09-23 22:23:08 | attacker malicious-activity | |
| Phishing | AbuseIPDB | 2026-09-11 09:32:16 | 2026-09-22 05:49:00 | malicious-activity phishing | |
| DNS Compromise | AbuseIPDB | 2026-09-11 09:32:16 | 2026-09-11 09:32:16 | compromised malicious-activity | |
| DNS Poisoning | AbuseIPDB | 2026-09-11 09:32:16 | 2026-09-11 09:32:16 | compromised malicious-activity | |
| IMAP Attacker | AbuseIPDB | 2026-08-27 08:25:54 | 2026-08-27 08:25:54 | attacker malicious-activity | |
| Malicious Host | AbuseIPDB | 2026-08-27 08:25:54 | 2026-08-27 08:25:54 | compromised malicious-activity | |
| Suspicious Host | AbuseIPDB | 2024-12-02 01:59:36 | 2024-12-23 15:42:06 | anomalous-activity |
Tags
woof ddos mirai botnet potassium port:15987 port:7193 port:49376 port:23789 port:27651 port:38429 port:42061Whois information
- AS name
- AS48874 NETPROTECT SRL
- AS registry
- ripencc
- AS date
- 2005-11-29 00:00:00
- AS CIDR
- 89.32.41.0/24
- Registrant
- NETPROTECT SRL
- City
- Timisoara
- Postal code
- 300789
- Country
- RO — Romania 🇷🇴
- First indexed
- 2024-12-02 06:28:31
- Last updated
- 2026-10-08 04:25:04
Malicious IPs in the same CIDR
89.32.41.146 89.32.41.117 89.32.41.42 89.32.41.43 89.32.41.19 89.32.41.38