104.18.2.79 Threat Intelligence and Host Information

Jun 24, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.18.2.79 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Potentially Malicious Host 🟡 49/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1012 - Query Registry, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1089 - Disabling Security Tools, T1106 - Native API, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1133 - External Remote Services, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1428 - Exploit Enterprise Resources, T1485 - Data Destruction, T1564 - Hide Artifacts, T1566 - Phishing, T1573 - Encrypted Channel

  • Tags: 443 ma2592000, aaaa, accept, access, access ta0001, access ta0006, activity, activity mirai, address, address domain, a domains, adversaries, adware malware, ag alberto, ag ingo, air force, alerts, all quiet, all scoreblue, all search, analyzer paste, andariel, android, anomalous file, a nxdomain, apple, april, as12337 noris, as133618, as14061, as15169 google, as15598, as16276, as16552 tiggee, as16625 akamai, as174 cogent, as19024, as1921, as20940, as21342, as24940 hetzner, as29789, as32787 akamai, as32934, as35994 akamai, as397241, as40021 contabo, as44273 host, as45430, as47846, as49505, as51167 contabo, as62597 nsone, as63949 linode, as714 apple, as8068, as8075, as8560, as8972 host, as9009 m247, asn as15598, asnone dns, asnone germany, asnone related, asnone united, austria, av detections, avg clamav, backdoor, binbusybox, bios, bits, body, brazil, brian sabey, browsing, cachecontrol, cape, catalog tree, certificate, charter communications, checkin, china unknown, chrome, clickable urls, cname, cnapple public, cnc beacon, code, command, connection, contacted, content type, control ta0011, cookie, copy, copyright, cp bus, creates, creation date, cryp, cur cono, cve201717215, cyber folks, cyber warfare, czechia unknown, data redacted, date, date hash, date tue, ddos, default, defense evasion, delete, delete c, delete shadows, delphi, demonbot, denvecolorado, denver, denver colorado, detected m1, discovery e1082, div div, dns query, docguard, dock, domain, domain name, download, dynamicloader, e1203 data, e1564 hidden, echo request, ee edcje4j, ekyxe, emails, emails info, encrypt, entries, eofae, error, etpro malware, evasion ob0006, execution, expiration date, expires thu, exploit, exploitation, exploit none, externalport, fakedout threat, federation asn, filehash, files, file samples, files domain, files ip, file size, files location, files matching, file type, fin ivdo, flag united, format, for privacy, found, france unknown, gafgyt, germany, germany mail, germany unknown, gmt cache, gmt content, gmt contenttype, gmt setcookie, gmt vary, google safe, grum, guard, hash avast, hashes cape, helloworld, hichina, hide artifacts, high, high assurance, hitmen, holidaycheck ag, home network, honduras, hosting, hostmaster, hostname, http, http headers, http host, http request, huawei hg532, huawei remote, icmp traffic, ids detections, immobilien ag, impact ob0008, impact ta0040, inbound, indonesia, install, installcore, instrumentation, internalport, iocs, ios, ip address, ip check, ip country, ip traffic, ipv4, ireland, ireland unknown, issuing ca, javascript, june, kraupa, kryptikxp, kurt walther, labs pulses, licess, lnmp, lnmp a, location united, look, lredmond, m1, magic pdf, mail spammer, main, malware, malware traffic, malware worm, masquerade, media center, medium, memcommit, memory pattern, memreserve, meta, method status, mexico, miniigd upnp, mirai, mirai variant, mitm, mitre att, module load, moved, msdefender apr, msie, msms57295540, ms windows, mtb apr, mtb aug, name servers, networks, next, nids, nondns, nxdomain, ob0005 defense, odigicert inc, onelouder, onl our, open, otx scoreblue, overview ip, oxypumper, packing t1045, passive dns, pattern domains, payload hello, pdb path, pdf document, pdf execution, pe32, pedraz, pe resource, persistence, phy samo, .pl, please, poland, poland unknown, porn, pornhub.software, port, possible, post, powershell, process32nextw, project pi, pulse pulses, pulses, pulse submit, puma se, push, quantum fiber, ransom, read c, realtek sdk, record type, record value, recycle bin, redacted for, regbinary, regdword, registrar, regsetvalueexa, related nids, related pulses, resolverror, reverse dns, rpcs, rsa ca, rsa tls, russia as49505, sabey, sameorigin, samples, sandbox, scan endpoints, script domains, script urls, search, serce internetu, server, server ca, server error, servers, sha256, shell, show, showing, sinkhole cookie, slcc2, slovakia, soap command, spammer, spectrum, ssdeep, ssl certificate, status, stream, stwashington, subdomains, susp, suspicious, sweep, swipper, t1036, t1045, t1047, t1129, t1189 found, tcp syn, thailand, timo salzsieder, title, tofsee, tools, total, tptjsw, trid adobe, trojan, trojandropper, trojan features, trojanspy, tsara brashears, ttl value, tulach, type get, united, united kingdom, unknown, updated date, url analysis, url hostname, url http, urls, urls http, urls https, useragent, users, value snkz, vhash, vietnam, virtool, virus, virustotal, whitelisted, whitesky, whois, win32, win64, windows, windows nt, world, wow64, write, write c, wsasend, x cache, xe e, xport, yara detections, yara rule, yomi hunter, zenbox

  • View other sources: Spamhaus VirusTotal

  • Country:
  • Network:
  • Noticed: 2 times
  • Protocols Attacked: Anonymous Proxy
  • Countries Attacked: Australia, Belgium, Brazil, Chile, Germany, Guatemala, Hungary, Ireland, Japan, Kenya, Mexico, Morocco, Netherlands, Peru, Poland, Russian Federation, Singapore, Slovakia, Spain, Taiwan, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: bc.place ujangbet.ink ujangbet.blog www.visionmacher.org newsdesk.mynewsdesk.com visionmacher.org svensk-byggtjanst.mynewsdesk.com wt.patch-aws-t01d-v202510-54-10.auth0app.com edge.tenants.patch-aws-t01d-v202510-54-10.auth0app.com stockholms-lans-museum.mynewsdesk.com becauseitdeservesbetter.com golinesports.com presse.sparkasse-freiburg.de grona-lunds-tivoli.mynewsdesk.com pflegedienst-tettau-karriere.de presse.fressnapf.de paopaochat.org www.taptone.com phhalik.ph nas.anh.lu www.freies-atmen.de presse.norsk-tipping.no resources.mynewsdesk.com ps.anh.lu eutelsat-com.mynewsdesk.com regionvasterbotten.mynewsdesk.com press.fredolsen1848.com news.froda.se press.pinewood.eu nyhetsrum.rusta.se media.findus.fi v5-emote.com news.q1.eu jameshardiepromo.com 7s2lo.vip news.morrowbatteries.com news.pinqponq.com press.atria.se juniqe.nl presse.culligan.at nyhetsrum.sturegallerian.se qa-se-gew-fbmvp-21404-updateservicetyper.az.ssdgws.co.uk press.stockholmslansmuseum.se press.vingruppen.se presse.findus.no mnd-assets.mynewsdesk.com 8xbet749.cc press.calidrisforlag.no presse.dermasence.de hk.anh.lu sg.anh.lu preprod.flexcar.com media.iamroadsmart.com media.fi.norwegian.com anh.lu uutishuone.rusta.fi cinemark.com.py newsroom.vingagroup.com presse.lbs.de chat-nl.com cache-test.mynewsdesk.com macaoph666.com uutiset.taloushallintoliitto.fi press.culligan.be flared.us eth-dc.vmehta.net presse.vitusapotek.no newsroom.apobank.de media.dk.norwegian.com portal.area1security.com pphg-revamp-author.mynewsdesk.com swampattack.com press.urbangreen.wtmgdev.com newsdesk.furetank.se dev.pcdtnamao.com.br onlinepaymentcenter.net www.neuecasinos.com neuecasinos.com media.fagbokforlaget.no press.sunotec-group.com news.mr-gamble.com news.kvasirtechnologies.com presse.abbvie.dk nyhetsrum.besttransport.se presse.hemsedal.com press.weeffect.se nyheter.balticgruppen.se presse.compass-group.no press.bjurfors.se press.folkoperan.se mediacentre.nghomes.net newsroom.basilicom.de newsroom.bax.de de.press.atomic.com qa-partner-auth0.gupshup.io stage.portaldeliverybrasil.com raleigh-ergo.ch edge.tenants.gupshup.auth0app.com gupshup.auth0app.com wt.gupshup.auth0app.com abercrombie.vmehta.net kronos.vmehta.net eci.vmehta.net newsroom.united-domains.de www.pfizeroriginalsprogram.ca england-and-wales-cricket-board-ecb.mynewsdesk.com adp.vmehta.net press.kasthall.se nyheter.motionstudios.se press.berzeliigroup.com nyheder.foedevarebanken.dk pfizer.th www.pfizer.th presse.spkmth.de presse.calligraphy-cut.com press.heba.se presse.barnim.de press.airodoctor.com press.svenskfast.se press.sizes.se presse.tec.dk nyheter.mercell.no presscentre.rotork.com nyheter.movementgroup.com nyhetsrum.xlbygg.se press.telia.se press.kvinnatillkvinna.se nyhetsrum.elitfonster.se presse.burgbad.de www.fordmedia.cz press.semper.se presse.surplex.com presse.glitreenergi.no newsroom.kairosred.eu newsroom.amedes-group.com newsroom-2020-iframe-tester.mnd-staging.com newsroom.losan-pharma.de en.newsdesk.gehwol.de incident.no.norwegian.com news.erzgebirge-tourismus.de aktuelt.elproffen.no happylung.pfizer.th oneshop-kazakhstan-staging.decathlonkz.com ipfs.vmehta.net www.raleigh-ergo.ch newsroom.nccgroup.com hexicon-ab.mynewsdesk.com adminmisventajas-back-preprod.spain.decathlon.net app1.vmehta.net dpw.at nyheter.ebab.se ekbet37.com bydfi.download zeelandtruss.com pfizerpro.pfizer.th news.brandizzanalytics.com pressrum.ventim.se presse.hurtigruten.no press.byggfakta.se press.hurtigruten.com press.samblagroup.com nyheder.cmport.com press.myrorna.se nyhetsrum.sj.se presse.ruhr-tourismus.de pressrum.clever.nu presse.hermes-arzneimittel.com presse.mannheimer.de presse.danishagro.dk nyhetsrum.skelleftea.se press.bogner.com nyheder.aggruppen.dk presse.sskm.de press.vanersborg.se press.trysil.com nyheter.intunor.com presse.rundfunkbeitrag.de uutiset.fresh.fi press.procurator.se press-jp.kuas.ac.jp press.vinunic.se presse.gothaer.de presse.telia.no presse.careerbuilder.de presse.algeco.de news.viktvaktarna.se nyheter.bydelstovner.no presse.klimaschutzagentur-reutlingen.de presse.potsdam-marketing.de press.rusta.se press.designeyeweargroup.com nyheder.ford.dk press.dynamiccode.com news.nottinghamshire.police.uk newsroom.gonortheast.co.uk newsroom.ekornes.com newsroom.paulaner.com newsroom.fr.schilthorn.ch medien-de.immoscout24.ch news-en.elmia.se news.er-ag.de media.visma.fi news.met.police.uk news.hdwm.de medien-en.scout24.ch news.infobricgroup.com newsdesk.gehwol.de medien.ww-energie.com incident.es.norwegian.com incident.fr.norwegian.com incident.en.norwegian.com insertlive.com newsroom-en.eurowings-discover.com presse.spies.dk postman.mynewsdesk.com press.dafgards.se www.insertlive.com news.moray.gov.uk pressrum.helloworld.se press.grantthornton.se newsroom-de.rolandberger.com richtersystem.fr newsroom.eurowings-discover.com vmehta.net ipfs2.vmehta.net eth-le.vmehta.net mnd-ssl-proxy.mynewsdesk.com test-azure-healthy-lab-2410.auth0c.com edge.tenants.test-azure-healthy-lab-2410.auth0c.com wt.test-azure-healthy-lab-2410.auth0c.com presse.samskipnaden.no presse.doyma.de presserom.enova2016.cust.avento.no uutishuone.fuchs.com presse.maritim.de tamro-dev-uutiset.dev.knowit.fi uutiset.polar.com www.gls-nyheder.dk press.autocirc.com presse.apollorejser.dk presse-de.cochlear.com nyheter.lindorff.no nyheter.kvalitetsindex.se presse.fus.no press.elsakerhetsverket.se press.dibs.se pressrum.skandiamaklarna.se news.verdensskove.org press.thorengruppen.se press.sambla.se press.ngi.no press.maritim.com presse.whd.de pressroom.elkjop.no pressrum.fuchs.com nyheter.soprasteria.no press.tillvaxtverket.se presse.kiel-marketing.de press.kommuninvest.se presse.fendt-caravan.com press.cavotec.com www.presseservice.rudolf-mueller.de nyheter.kaunisiron.se nieuws.lindorff.nl nyheter.blodtrycksdoktorn.se nyheter.acetec.se press.swedwatch.org pressroom.elgiganten.dk presse.hurtigruten.de press.mgmotors.dk press.yta.se presse.reiseland-brandenburg.de presse.novap.no presse.instabank.no press.ok.se presse.ens.dk press.gallerif15.no nyhetsrum.hager.com press.aareon.no nyheder.cabiweb.dk presse.rogaland-teater.no presse.deutsche-glasfaser.de press.greenmountain.no presse.sio.no press.smc.global pressrum.presto.se presse.cappelendamm.no noticias.abbvie.pt nyheter.biovac.no press.kiamotors.dk press.rusta.no presse.trainor.no press.raddabarnen.se press.kasthall.com presse.weserbergland-tourismus.de nyheter.nordvik.no press.telenor.dk press.thewineagency.se nyheter.cmport.com news.wmtrains.co.uk press.pensure.se nyheter.colliers.se presserum.fuchs.com press.atomic.com presse.fehmarn.de presse.gallerif15.no press.dynamiccode.se press.folkofolk.se press.aleap.no se-press.inspecta.com press.hydroscand.se pressrum.oresundskraft.se presse.ngi.no press.explorepotsdam.com nyheter.mercell.com press-en.kuas.ac.jp press.inuit.se press.trainor.no press.boulebar.se press-en.airodoctor.com press.denios.se press.tranter.com press.vitterhetsakademien.se press.urbangreen.se press.teknikmagasinet.se presserom.fuchs.com newsroom.walser.de newsroom.prca.org.uk newsroom.storasoder.se news.sigikid.de news.vdw-pensionsfonds.de newsroom.saltwater-stone.com newsroom.veolia.de news.ubi.se newsroom.paulaner.de newsroom.treasurysystems.com newsroom.rolandberger.com newsroom.wa3rm.com newsroom.visma.com news.thatcham.org news.surfboardpayments.com newsroom.outbox.de newsroom.northumbria.ac.uk newsroom.appsfactory.de newsroom.bpw.de news.pitchmark.net newsroom.karlsberg-verbund.de news.riabu.com newsroom.iccopr.com newsroom.cure.finance newsroom.de.schilthorn.ch newsroom-en.bpw.de newsroom.hacker-pschorr.de newsroom.alltours.de newsroom.en.schilthorn.ch news.paulcamper.de newsroom.ifrafragrance.org newsroom.digitalyachtamerica.com newsroom.dm.de news.paulcamper.com newsportal.vista.ch media.no.norwegian.com news.fpz.de media.skiskyting.no news.fuellett.de medien-fr.anibis.ch media.visma.nl medien-de.advertising.scout24.ch media.ridsport.se media.ifolor.fi news.allbry.se media.fredolsencruises.com medien-fr.advertising.scout24.ch news.abbvie.de news.kebony.us medien-de.anibis.ch news.dein-muenchen.org news.abbvie.se news.gomogroup.com news.dbr.de media.rac.co.uk newsdesk.thestartupguys.co.uk news.londonsport.org medien-fr.immoscout24.ch media.visma.se medien-de.scout24.ch medien-fr.autoscout24.ch news.nl.dsv.com news.binosight.com media.ar.norwegian.com media.en.norwegian.com news.lindorff.com kompasset.kuto.dk media.visma.dk news.kaunisiron.se mynewsdesk.hafslundstrom.no news.cmport.com media.se.norwegian.com news.kebony.de media.visma.no newsdesk.visitlinkoping.se news.falcksverige.se news.mattel.de de.press.tranter.com fagnyheter.gyldendal.no en-press.ens.dk presse.paul-lange.de blogg.hsb.se mynewsdesk.com www.mynewsdesk.com ectest.kamanfluidpower.com sub.dxctngnadxc5fow4prod.paastest.co.uk qa-gb-ind-fixfbmvp-10076-fixtfstatekeyna.az.ssdgws.co.uk etoro-finance.com www-stage.mark-compressors.com www.epos-audio.pt www.americanattractions.co.uk wisenbakersgarage.com mulder.properrate.com.cdn.cloudflare.net mulder.properrate.com americanattractions.co.uk www.omnexgroup.com agent.omnexgroup.com u5.com omnexgroup.com www.epos-audio.pt.cdn.cloudflare.net tra168.com sub.dxctngnadxcdd21linte.paastest.co.uk.cdn.cloudflare.net isabrochures.co.uk store.bemorechillmusical.com.cdn.cloudflare.net www.dartforums.com.cdn.cloudflare.net www.6zh1.com www.k3ow.com www.ig5y.com www.q49m.com k3ow.com 6zh1.com ztt0.com kvd5.com www.ztt0.com q49m.com ig5y.com

Malware Detected on Host

Count: 1 59dda6f0f56c0b4627d31bafbd9cc879165b4885556a7b9c7c6c2cefc735c329

Open Ports Detected

2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2025-06-23 anonymous-proxy-ip-list-2025-06-22

Share on: