91.218.114.4
Classification: Malicious
91.218.114.4 is a malicious IP address in Moscow, RU. Linked to Maze malware. 38 sightings from 5 threat sources (Mail Spammer), last seen 2026-10-06.
Current activity
- Known attacker — Seen launching attacks over the Internet.
MITRE ATT&CK associations
Malware families: MAZE (S0449)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Mail Spammer | Barracuda | 2019-10-24 11:00:14 | 2026-10-06 17:39:37 | attacker malicious-activity | |
| Generic.Ransom.Maze.Packed | Hybrid-Analysis | 2020-01-28 15:01:20 | 2021-11-30 19:45:22 | ||
| Malicious url | Cyber Threat Coalition | 2020-12-14 15:12:35 | 2021-11-02 06:09:15 | malicious-activity | |
| Covid19 scam | Cyber Threat Coalition | 2020-11-24 18:49:19 | 2020-12-13 14:22:45 | malicious-activity | |
| Trojan.Ransom.Cerber | Hybrid-Analysis | 2020-07-30 13:15:13 | 2020-07-30 13:15:13 | ||
| Malicious site | Hybrid-Analysis | 2019-11-07 00:45:07 | 2020-07-04 18:00:19 | ||
| IOC_19052020 | CronUp Threat Intel | 2020-05-20 03:02:05 | 2020-05-20 03:02:05 | ||
| Malware | IBM X-Force Exchange | 2019-11-01 10:52:00 | 2020-04-20 11:06:00 | ||
| Gen:Variant.Johnnie | Hybrid-Analysis | 2020-03-05 13:00:12 | 2020-03-05 13:00:12 | ||
| Ransom.MAZE | Hybrid-Analysis | 2020-03-05 12:30:13 | 2020-03-05 12:30:16 | S0449 Maze | |
| Trojan.Generic | Hybrid-Analysis | 2019-10-24 11:00:13 | 2020-03-05 12:30:12 | ||
| Trojan.Cryptor | Hybrid-Analysis | 2020-03-05 12:30:11 | 2020-03-05 12:30:11 | ||
| Kryptik.ykrex | Hybrid-Analysis | 2020-02-17 13:00:20 | 2020-02-17 13:00:20 | ||
| Generic.Malware | Hybrid-Analysis | 2019-11-08 19:15:18 | 2020-02-06 21:01:50 | ||
| Ransom.Maze | Hybrid-Analysis | 2020-02-03 14:45:05 | 2020-02-03 14:45:05 | S0449 Maze | |
| Riskware | Hybrid-Analysis | 2020-01-30 16:45:08 | 2020-01-30 16:45:08 | ||
| Gen:Variant.Ransom.Maze | Hybrid-Analysis | 2020-01-19 20:30:36 | 2020-01-19 20:30:36 | S0449 Maze | |
| Trojan.Lethic.Gen | Hybrid-Analysis | 2020-01-13 19:31:26 | 2020-01-13 19:31:26 | ||
| Kryptik.ANF.gen | Hybrid-Analysis | 2019-12-18 12:45:05 | 2019-12-18 12:45:05 | ||
| Trojan.Ransom | Hybrid-Analysis | 2019-12-16 15:15:17 | 2019-12-16 15:15:17 | ||
| Botnet Command and Control Server | IBM X-Force Exchange | 2019-12-11 19:09:00 | 2019-12-11 19:09:00 | ||
| Downloader.wu | Hybrid-Analysis | 2019-11-28 00:17:05 | 2019-11-28 00:17:05 | ||
| DFI | Hybrid-Analysis | 2019-11-27 10:15:12 | 2019-11-27 10:15:12 | ||
| Gen:Variant.Strictor | Hybrid-Analysis | 2019-11-21 05:30:04 | 2019-11-21 05:30:04 | ||
| Gen:Variant.Ranpack | Hybrid-Analysis | 2019-11-20 23:00:08 | 2019-11-20 23:00:08 | ||
| Obfuscation.e868ff0a | Hybrid-Analysis | 2019-11-19 17:30:10 | 2019-11-19 17:30:10 | ||
| QVM19.1.50A9.Malware | Hybrid-Analysis | 2019-11-18 22:00:08 | 2019-11-18 22:00:08 | ||
| Obfuscation.8b6f262e | Hybrid-Analysis | 2019-11-18 21:00:15 | 2019-11-18 21:00:15 | ||
| Adware.Gen2 | Hybrid-Analysis | 2019-11-10 22:15:03 | 2019-11-10 22:15:03 | ||
| BehavesLike.Ransomware | Hybrid-Analysis | 2019-11-07 13:15:05 | 2019-11-07 13:15:05 | ||
| Obfuscation.31365a38 | Hybrid-Analysis | 2019-11-07 10:45:20 | 2019-11-07 10:45:20 | ||
| Obfuscation.8492b4cd | Hybrid-Analysis | 2019-11-06 09:45:12 | 2019-11-06 09:45:12 | ||
| TROJ_FRS.VSNTJT19 | Hybrid-Analysis | 2019-10-31 12:00:08 | 2019-10-31 12:00:08 | ||
| Obfuscation.e700d6d8 | Hybrid-Analysis | 2019-10-29 09:45:12 | 2019-10-29 09:45:12 | ||
| Spam | IBM X-Force Exchange | 2014-08-07 13:40:00 | 2015-06-18 10:06:00 |
Tags
malware covid19 coronavirus scam phishingWhois information
- AS name
- AS50867 LLC IT BASIS
- AS registry
- ripencc
- AS date
- 2010-07-12 00:00:00
- AS CIDR
- 91.218.114.0/24
- CIDR
- 91.218.112.0/22
- Registrant
- LLC IT BASIS
- Address
- Barabannyi line , 4/4 107023 Moscow RUSSIAN FEDERATION
- City
- Moscow
- Postal code
- 144700
- Country
- RU — Russian Federation 🇷🇺
- First indexed
- 2019-10-24 11:00:13
- Last updated
- 2026-10-06 17:39:39