104.18.40.200 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 104.18.40.200 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

🟠 Elevated — 49/100

Host and Network Information

• View other sources: Spamhaus VirusTotal Shodan AbuseIPDB
• Noticed: 1 time
• Protocols Attacked: Anonymous Proxy
• Open Ports: 2082, 2083, 2086, 2087, 2095, 2096, 443, 80, 8080, 8443, 8880
• Tor Node: No

Tags

• abuse contact
• address
• address range
• admin country
• admin id
• ad temdac
• adversaries
• alerts
• algorithm
• allocation type
• allowed date
• ally s
• anorexx
• arizona
• ascii text
• assigned pa
• australia
• authority
• beginstring
• body
• brashears
• brashears porn
• browsing
• busty xxx
• ca validity
• cddad ad
• certificate
• cgb stgreater
• chrome
• ch ua
• cidr
• ck id
• ck matrix
• click
• cnsectigo rsa
• cobalt strike
• command
• comments
• contacted
• copy
• copy md5
• copy sha1
• copy sha256
• creation date
• crlf line
• daily
• data
• data upload
• date
• defense evasion
• delete
• delphi
• denmark unknown
• dnssec
• doctype html
• domain
• dynamic
• dynamicloader
• ebony
• ebony riding
• encrypt
• enter so
• enter soudcfidi
• enter soupce
• entity ah36ripe
• entries
• entries http
• error
• exchange
• excludea
• exe size
• expiration date
• exploit
• extr
• extraction
• extraction data
• extraction f
• extraction fail
• extra data
• failed
• father sex
• file name
• files
• files ip
• file type
• filter tsara
• flag
• found
• general
• gmt content
• go daddy
• google safe
• green
• handle
• head
• high
• high process
• hos hos
• hostile
• hosting
• hostname
• http
• https
• hybrid
• ic excluded
• icloader apr
• included
• included review
• include review
• include u
• informative
• injection t1055
• ip address
• ipv4 add
• key identifier
• lander script
• learn
• local
• location united
• lowfi
• malware
• mb first
• md5 google
• md5 sha256
• medium
• memcommit
• meta
• method
• mi11255597wp
• mitre att
• most relevant
• moved
• msie
• msil
• mtb apr
• named pipe
• name tactics
• network traffic
• next
• next associated
• none related
• null
• number
• open
• open threat
• orgabuseref
• orgid
• orgtechhandle
• otx telemetry
• panca type
• passive dns
• path
• pattern match
• porn
• pornhub
• porn videos
• postalcode
• praw type
• present jul
• present jun
• present oct
• pr extract
• process details
• public
• pulse
• pulse pulses
• pulses
• pulse submit
• read
• read c
• record value
• refresh
• related pulses
• review
• ripe
• ripe ncc
• ripe network
• roberta
• safe browsing
• scottsdale
• s data
• search
• sec ch
• secure server
• seen
• sentinelone
• servers
• sha1
• sha256
• show
• showing
• show process
• show technique
• size
• span
• spawns
• status
• strings
• sugges data
• suggeste
• suspicious
• t1055
• tags none
• tech email
• tools
• trojan
• trojanspy
• trydda dada
• tsara
• tsara brashears
• type data
• type win32
• typ url
• ua full
• ua platform
• udi ad
• u extractio
• united
• unknown aaaa
• update date
• ur extraction
• url add
• url analysis
• url hos
• urls
• url url
• utf8
• v3 serial
• video
• virtool
• virustotal api
• watch
• watch tsara
• whois server
• win32
• win64
• write
• x509v3 subject
• x adblock
• xe7xf3xf2x14x9d
• yara rule

MITRE ATT&CK TTPs

• T1045 - Software Packing
• T1055 - Process Injection
• T1057 - Process Discovery
• T1063 - Security Software Discovery
• T1071 - Application Layer Protocol
• T1082 - System Information Discovery
• T1105 - Ingress Tool Transfer
• T1119 - Automated Collection
• T1480 - Execution Guardrails
• T1562 - Impair Defenses

Passive DNS

• instit.ppd.luqi.fr

Attack Log References

• anonymous-proxy-ip-list-2025-10-20

Whois Information