ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 91.236.230.220:443.

Database Entry


IOC ID:1778202
IOC: 91.236.230.220:443
IOC Type :ip:port
Threat Type :payload_delivery
Malware: BumbleBee
Malware alias:COLDTRAIN, SHELLSTING, Shindig
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS62005 BV-EU-AS
Country:- EE
First seen:2026-03-29 14:01:13 UTC
Last seen:never
UUID:f18dff42-2b08-11f1-9af6-42010aa4000a
Reporter Lenny_3BO
Reward 5 credits from ThreatFox
Tags:BlueVPS decoy_404
Reference: https://www.virustotal.com/gui/ip-address/91.236.230.220

Avatar
Lenny_3BO
BlueVPS AS62005. Hosts endpointmapperprocess.com with fake 404 decoy page. LE cert issued 2026-03-14. Linked to iOS Safari WebKit exploit campaign on adjacent .154 IP.