91.92.243.195
Classification: Malicious
91.92.243.195 is a malicious IP address in New York City, US. Linked to Remcos malware. 99 sightings from 4 threat sources (Bruteforce), last seen 2026-10-17.
Current activity
- Known attacker — Seen launching attacks over the Internet.
- Known scanner — Seen scanning hosts over the Internet.
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Mail Spammer | Blocklist.de | 2026-10-17 12:02:53 | 2026-10-17 12:02:53 | attacker malicious-activity | |
| IMAP Attacker | Blocklist.de | 2026-10-17 11:02:53 | 2026-10-17 11:02:53 | attacker malicious-activity | |
| Unauthorized scanning of hosts | Blocklist.net.ua | 2026-09-22 16:07:33 | 2026-10-16 16:18:46 | attacker malicious-activity reconnaissance | |
| Bruteforce | AbuseIPDB | 2026-09-20 19:13:15 | 2026-10-03 16:00:19 | attacker malicious-activity | |
| Mail Spammer | AbuseIPDB | 2026-09-20 18:45:39 | 2026-09-27 21:11:00 | attacker malicious-activity | |
| Malicious Host | AbuseIPDB | 2026-09-27 08:47:22 | 2026-09-27 08:47:22 | attacker compromised malicious-activity | |
| Port Scanner | AbuseIPDB | 2026-09-20 18:45:02 | 2026-09-26 19:54:25 | attacker malicious-activity reconnaissance | |
| SSH Attacker | AbuseIPDB | 2026-09-21 18:46:47 | 2026-09-21 18:46:47 | attacker malicious-activity | |
| Hacking | AbuseIPDB | 2026-09-20 19:58:21 | 2026-09-21 18:14:54 | attacker malicious-activity | |
| Remcos | ThreatFox Abuse.ch | 2024-08-09 12:17:03 | 2024-08-11 11:22:50 | malicious-activity | S0332 Remcos |
Tags
c2 rat remcos remcosrat port:4190 remvio socmer abuse attacker imap pop3 sasl bot mail spamWhois information
- AS name
- AS202412 OMEGATECH
- AS registry
- ripencc
- AS date
- 2006-08-15 00:00:00
- AS CIDR
- 91.92.243.0/24
- Registrant
- OMEGATECH
- City
- New York City
- State
- NY
- Postal code
- 10203
- Country
- US — United States 🇺🇸
- First indexed
- 2024-08-09 12:17:03
- Last updated
- 2026-10-17 12:02:53
Malicious IPs in the same CIDR
91.92.243.235 91.92.243.151 91.92.243.15 91.92.243.195 91.92.243.61 91.92.243.197 91.92.243.212 91.92.243.216 91.92.243.234 91.92.243.247 91.92.243.241 91.92.243.215 91.92.243.20 91.92.243.63 91.92.243.115