104.18.40.244 Threat Intelligence and Host Information

Oct 21, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.18.40.244 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 53/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1012 - Query Registry, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1089 - Disabling Security Tools, T1106 - Native API, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1133 - External Remote Services, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1428 - Exploit Enterprise Resources, T1485 - Data Destruction, T1564 - Hide Artifacts, T1566 - Phishing, T1573 - Encrypted Channel

  • Tags: 443 ma2592000, aaaa, accept, access, access ta0001, access ta0006, activity, activity mirai, address, address domain, a domains, adversaries, adware malware, ag alberto, ag ingo, air force, alerts, all quiet, all scoreblue, all search, analyzer paste, andariel, android, anomalous file, a nxdomain, apple, april, as12337 noris, as133618, as14061, as15169 google, as15598, as16276, as16552 tiggee, as16625 akamai, as174 cogent, as19024, as1921, as20940, as21342, as24940 hetzner, as29789, as32787 akamai, as32934, as35994 akamai, as397241, as40021 contabo, as44273 host, as45430, as47846, as49505, as51167 contabo, as62597 nsone, as63949 linode, as714 apple, as8068, as8075, as8560, as8972 host, as9009 m247, asn as15598, asnone dns, asnone germany, asnone related, asnone united, austria, av detections, avg clamav, backdoor, binbusybox, bios, bits, body, brazil, brian sabey, browsing, cachecontrol, cape, catalog tree, certificate, charter communications, checkin, china unknown, chrome, clickable urls, cname, cnapple public, cnc beacon, code, command, connection, contacted, content type, control ta0011, cookie, copy, copyright, cp bus, creates, creation date, cryp, cur cono, cve201717215, cyber folks, cyber warfare, czechia unknown, data redacted, date, date hash, date tue, ddos, default, defense evasion, delete, delete c, delete shadows, delphi, demonbot, denvecolorado, denver, denver colorado, detected m1, discovery e1082, div div, dns query, docguard, dock, domain, domain name, download, dynamicloader, e1203 data, e1564 hidden, echo request, ee edcje4j, ekyxe, emails, emails info, encrypt, entries, eofae, error, etpro malware, evasion ob0006, execution, expiration date, expires thu, exploit, exploitation, exploit none, externalport, fakedout threat, federation asn, filehash, files, file samples, files domain, files ip, file size, files location, files matching, file type, fin ivdo, flag united, format, for privacy, found, france unknown, gafgyt, germany, germany mail, germany unknown, gmt cache, gmt content, gmt contenttype, gmt setcookie, gmt vary, google safe, grum, guard, hash avast, hashes cape, helloworld, hichina, hide artifacts, high, high assurance, hitmen, holidaycheck ag, home network, honduras, hosting, hostmaster, hostname, http, http headers, http host, http request, huawei hg532, huawei remote, icmp traffic, ids detections, immobilien ag, impact ob0008, impact ta0040, inbound, indonesia, install, installcore, instrumentation, internalport, iocs, ios, ip address, ip check, ip country, ip traffic, ipv4, ireland, ireland unknown, issuing ca, javascript, june, kraupa, kryptikxp, kurt walther, labs pulses, licess, lnmp, lnmp a, location united, look, lredmond, m1, magic pdf, mail spammer, main, malware, malware traffic, malware worm, masquerade, media center, medium, memcommit, memory pattern, memreserve, meta, method status, mexico, miniigd upnp, mirai, mirai variant, mitm, mitre att, module load, moved, msdefender apr, msie, msms57295540, ms windows, mtb apr, mtb aug, name servers, networks, next, nids, nondns, nxdomain, ob0005 defense, odigicert inc, onelouder, onl our, open, otx scoreblue, overview ip, oxypumper, packing t1045, passive dns, pattern domains, payload hello, pdb path, pdf document, pdf execution, pe32, pedraz, pe resource, persistence, phy samo, .pl, please, poland, poland unknown, porn, pornhub.software, port, possible, post, powershell, process32nextw, project pi, pulse pulses, pulses, pulse submit, puma se, push, quantum fiber, ransom, read c, realtek sdk, record type, record value, recycle bin, redacted for, regbinary, regdword, registrar, regsetvalueexa, related nids, related pulses, resolverror, reverse dns, rpcs, rsa ca, rsa tls, russia as49505, sabey, sameorigin, samples, sandbox, scan endpoints, script domains, script urls, search, serce internetu, server, server ca, server error, servers, sha256, shell, show, showing, sinkhole cookie, slcc2, slovakia, soap command, spammer, spectrum, ssdeep, ssl certificate, status, stream, stwashington, subdomains, susp, suspicious, sweep, swipper, t1036, t1045, t1047, t1129, t1189 found, tcp syn, thailand, timo salzsieder, title, tofsee, tools, total, tptjsw, trid adobe, trojan, trojandropper, trojan features, trojanspy, tsara brashears, ttl value, tulach, type get, united, united kingdom, unknown, updated date, url analysis, url hostname, url http, urls, urls http, urls https, useragent, users, value snkz, vhash, vietnam, virtool, virus, virustotal, whitelisted, whitesky, whois, win32, win64, windows, windows nt, world, wow64, write, write c, wsasend, x cache, xe e, xport, yara detections, yara rule, yomi hunter, zenbox

  • View other sources: Spamhaus VirusTotal

  • Country:
  • Network:
  • Noticed: 3 times
  • Protocols Attacked: Anonymous Proxy
  • Countries Attacked: Australia, Belgium, Brazil, Chile, Germany, Guatemala, Hungary, Ireland, Japan, Kenya, Mexico, Morocco, Netherlands, Peru, Poland, Russian Federation, Singapore, Slovakia, Spain, Taiwan, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: prod65.escabona.com webhooks.garmin.com inte.dxp.wmftg.com subscriber-events-prod.economist.com www-u.botoxspasticity.com temp-test.aontravelprotection.com eurofinance.com www.mtvanhoevenberg.com www.paxlovid.ie api.leadinsights.informa.com consolplus.com www.eurofinance.com.cdn.cloudflare.net payback-bonusprogramm.de mtvanhoevenberg.com oficinista.net myexactaccount.com api-dev.leadinsights.informa.com pvcantitrust.com bonus-codes.com paxlovid.ie nboanywhere.ldry.com accounts-spectrumenterprise.ops.ringcentral.com leadinsights.informa.com pentestcom2jgc59inte-slot.paastest.epimore.com ctl-common.gateway-qaint2.qa.finra.org www.escabona.com jama.ama-assn.org.ezp.waldenulibrary.org oyabudairyfarms.com www.perigold.com secure.perigold.com c.escabona.com escabona.com secure.id.dbsdigibank.com.cdn.cloudflare.net www.perigold.com.cdn.cloudflare.net www.supeco.fr betsvenezuela777.com www.hadleyschools.org stage-sharejs.ceros.com cm.whitecap.com estsynergy.com ctl-grid.gateway-qaint2.qa.finra.org api.postpaid.arabel.io staging.quilterpca.co.uk gateway-qaint2.qa.finra.org patch-azure-8a52-v202410-269-17.auth0app.com wt.patch-azure-8a52-v202410-269-17.auth0app.com edge.tenants.patch-azure-8a52-v202410-269-17.auth0app.com equaltoday.com superiorusd.org employees.ldry.com hvac-fastparts.com search-proquest-com.ezp.waldenulibrary.org ezp.waldenulibrary.org doi-org.ezp.waldenulibrary.org ctiv.alexanderstreet.com.ezp.waldenulibrary.org revoltcharging.de j6171z.com journals.aom.org jme.bmj.com.ezp.waldenulibrary.org modivo.si secure.segurazo.com dev-shop-9485.pkwteile.ch dev-seo3706and3643.pkwteile.ch m.mall.hr dev-seo4877.pkwteile.ch www.narvonbeverage.com mstage.pkwteile.ch stage.pkwteile.ch dev-shop-9468.pkwteile.ch dev-seopb4185.pkwteile.ch dev-shop-9293.pkwteile.ch dev-seo5106.pkwteile.ch dev-seo4137.pkwteile.ch dev-sites-7611r.pkwteile.ch medien-de.financescout24.ch media.es.norwegian.com dev-bvs-responsive.pkwteile.ch dev-seo4982.pkwteile.ch dev-shop-8209.pkwteile.ch dev-softsearch.pkwteile.ch dev-shop-8124.pkwteile.ch dev-andrei90g-tjs.pkwteile.ch dev-shop-9089.pkwteile.ch sa-12767.pkwteile.ch www.southwestrisk.org press.testfakta.com dev-seo4772.pkwteile.ch press.pinewood.eu dev-seotestask.pkwteile.ch dev-shop-7550.pkwteile.ch dev-seo3488.pkwteile.ch gigantti.mynewsdesk.com dev-shop-8379.pkwteile.ch dev-shop-8651.pkwteile.ch dev-paypal.pkwteile.ch dev-seo4778.pkwteile.ch dev-seo4549origin.pkwteile.ch www.gls-nyheder.dk uutiset.taloushallintoliitto.fi press.vingruppen.se press.tranter.com press.urbangreen.se press.trysil.com press.thewineagency.se pressrum.skandiamaklarna.se pressrum.presto.se pressroom.elkjop.no pressrum.ventim.se pressrum.oresundskraft.se pressroom.elgiganten.dk press.rusta.no press.mgmotors.dk press.ok.se press.pensure.se press.ngi.no press.raddabarnen.se press.kiamotors.dk press.greenmountain.no press-jp.kuas.ac.jp press.heba.se press.inuit.se press.gallerif15.no presse.surplex.com presserum.fuchs.com press.elsakerhetsverket.se presse.novap.no press-en.airodoctor.com presse.mannheimer.de press-en.kuas.ac.jp presse.rogaland-teater.no presse.reiseland-brandenburg.de presse.potsdam-marketing.de presse.hermes-arzneimittel.com presse.fendt-caravan.com presse.fus.no presse.ens.dk presse.doyma.de presse.fehmarn.de presse.abbvie.dk press.dynamiccode.se presse.algeco.de presse.apollorejser.dk presscentre.rotork.com press.bjurfors.se press.airodoctor.com nyhetsrum.skelleftea.se nyhetsrum.xlbygg.se press.aareon.no nyhetsrum.sj.se nyheter.mercell.com nyhetsrum.elitfonster.se nyheter.kaunisiron.se nyheder.foedevarebanken.dk news.verdensskove.org nyheder.ford.dk noticias.abbvie.pt nyheder.cabiweb.dk nyheder.aggruppen.dk news.thatcham.org newsroom.walser.de newsroom.visma.com newsroom.treasurysystems.com newsroom.karlsberg-verbund.de newsroom.losan-pharma.de newsroom.en.schilthorn.ch newsroom.konicaminolta.dk newsroom.gonortheast.co.uk newsroom.kairosred.eu newsroom.bpw.de newsroom.ekornes.com newsroom.basilicom.de newsroom.cure.finance newsroom-en.bpw.de newsroom-de.rolandberger.com newsroom.bax.de newsroom.digitalyachtamerica.com newsroom.dm.de news.riabu.com news.pitchmark.net newsroom.amedes-group.com news.met.police.uk news.kaunisiron.se news.kebony.us news.infobricgroup.com news.londonsport.org news.mattel.de news.gomogroup.com newsdesk.visitlinkoping.se news.erzgebirge-tourismus.de news.fpz.de newsdesk.hoegheiendom.no news.binosight.com medien.ww-energie.com medien-fr.financescout24.ch media.visma.nl media.visma.fi media.us.norwegian.com media.no.norwegian.com media.fr.norwegian.com media.skiskyting.no media.se.norwegian.com media.uk.norwegian.com media.rac.co.uk media.visma.dk media.ridsport.se media.dk.norwegian.com incident.no.norwegian.com media.ar.norwegian.com en-press.ens.dk incident.es.norwegian.com en.newsdesk.gehwol.de incident.fr.norwegian.com de.press.tranter.com fagnyheter.gyldendal.no incident.en.norwegian.com aktuelt.elproffen.no newsroom.ifrafragrance.org southwestrisk.org presse.gallerif15.no news.de.dsv.com news.sigikid.de nyheter.intunor.com pressrum.fuchs.com nyheter.soprasteria.no press.hurtigruten.com nyheter.cmport.com press.designeyeweargroup.com presse.deutsche-glasfaser.de presse.ruhr-tourismus.de nyheder.cmport.com press.kasthall.com www.fordmedia.cz press.trainor.no newsportal.vista.ch newsroom.alltours.de press.aareon.se press.bogner.com press.hydroscand.se press.aleap.no press.byggfakta.se presse.compass-group.no media.en.norwegian.com press.kasthall.se dev-seo4210.pkwteile.ch dev-shop-8526.pkwteile.ch news.lindorff.com press.grantthornton.se www.Monicawarneraward.com newsroom.iccopr.com blogg.hsb.se nieuws.lindorff.nl dev-jquery.pkwteile.ch newsroom.paulaner.de nyheter.lindorff.no media.ifolor.fi utbildningsradio.mynewsdesk.com dev-sa-11740.pkwteile.ch newsroom.outbox.de press.dafgards.se news-se.elmia.se dev-prf-new.pkwteile.ch dev-seotyres.pkwteile.ch dev-seo4549.pkwteile.ch dev-alya-barvin-8096.pkwteile.ch dev-branch-test.pkwteile.ch dev-seo3872.pkwteile.ch press.atomic.com dev-seo4667.pkwteile.ch de.press.atomic.com dev-newalternate.pkwteile.ch dev-shop-7061.pkwteile.ch dev-oldalternate.pkwteile.ch narvonbeverage.com dollarstore.mynewsdesk.com aacert.vdcs.visa.com dev-seo4579.pkwteile.ch press.folkofolk.se dev-seo4198.pkwteile.ch dev-seo4198before.pkwteile.ch nyheter.bydelstovner.no nyhetsrum.besttransport.se press.rusta.se presse.lantmannen-unibake.no press.dibs.se press.sambla.se nyheter.biovac.no mynewsdesk.hafslundstrom.no news.er-ag.de presse.instabank.no media.fagbokforlaget.no presse.danishagro.dk news.abbvie.de news.vdw-pensionsfonds.de presse.ngi.no pressrum.clever.nu news.dbr.de press.telia.se press.svenskfast.se presse.cappelendamm.no news.viktvaktarna.se newsroom.paulaner.com presse.enova.no newsroom.hacker-pschorr.de press.falck.com presse.burgbad.de news.fuellett.de presse.samskipnaden.no nyheter.nordvik.no www.presseservice.rudolf-mueller.de news.falcksverige.se media.fredolsencruises.com dev-ci-fix.pkwteile.ch dev-php80.pkwteile.ch press.urbangreen.wtmgdev.com press.swedwatch.org dev-seo3484.pkwteile.ch dev-seo3674.pkwteile.ch www.pediatricortho.org newsroom.nccgroup.com svenska-kyrkan-malmo.mynewsdesk.com newsroom.united-domains.de newsroom.wa3rm.com news.surfboardpayments.com centralimport.ca news-en.elmia.se dev-sa-9895-himaster.pkwteile.ch press.tillvaxtverket.se press.autocirc.com mnd-ssl-proxy.mynewsdesk.com kompasset.kuto.dk www.mynewsdesk.com pkwteile.ch www.pkwteile.ch data.eiu.com.cdn.cloudflare.net bdocap.com news.allbry.se newsroom.fr.schilthorn.ch newsroom.de.schilthorn.ch de.strabag-newsroom.com nyheter.mercell.no rolandberger-com.mynewsdesk.com adventist.link m.pkwteile.ch segurazo.com new.pkwteile.ch mynewsdesk.com press.berzeliigroup.com test.pkwteile.ch mtest.pkwteile.ch presse.spies.dk news.wmtrains.co.uk lazabola.site www.minashhui.work omiedesemne.com cheosaroztiewab.gq litceysel.ru walnahifoun.ga www.thetvdeals.net dreamlivingeats.com www.employmentlawletter.com cpcontacts.thetvdeals.net cpcalendars.thetvdeals.net thetvdeals.net www.gilcon.com.au noibrancounttucsung.tk leccomphandcessbal.gq denptanens.tk elearnplay.com gulffritdeforci.cf causecutetherapy.best coolreypaugerfbe.tk tabloid-id.com parobet5.com console.cf deslymosdownvi.tk tonyashvanian.com www.tonyashvanian.com nails-academy.ru pieminglinasa.gq seasydesi.online mauprotkapawid.ga cpcontacts.astridcastellanos.co astridcastellanos.co cpcalendars.astridcastellanos.co www.astridcastellanos.co coirenesi.tk www.parobet5.com tremexsiconreha.ga credsulep.tk acticonnysac.ml casinonorsk24.info ravewenno.tk stopdonsysdrildio.tk siocricovprog.ml erinudfreelpen.gq mieprogmarx.ml hepidev.com cornbardlyken.ml aflxrrhd.tk online.nayjoursoagethea.tk almakbuharikav2.cf rayotomasyon.com.tr ridesforshare.com prestamosmarcospaz.com.ar rantpovocom.tk tolkienmusic.tk sittoftletle.ru tigersinais.com.br kmworks.app www.kmworks.app kulturfoto-lieser.de plicpusliatai.ga toppillion.top dowhereb.com semyanich-sid.website smashtrack.xyz tobitqui.gq burrponpei.ga rasmingdimupat.tk huenesirapasra.tk bestgacorlandcapt.tk aditpraskingkou.tk tenmai.tk centlinendtudarel.tk behobyrule.tk oitwestmi.com rihcellwebsite.eu.org edconnect.co nicewritemypaper.com burriu.tk foto-intererov.com luniverse.idrt.link waasreviews.com xbetk-15k.xyz lisulripolve.tk edafagguiresen.tk ittipehardlama.ga shaddocks-irrepealably-do.club hydraruzxpnew4afl.com thewebexperto.com gratiss.asia inmsas.com bwsrestaurant.de 6868070.cn tovode.club xujewogu.ml basfinggosickpluc.cf trenhapansitztore.ml dev.by-skeify.com pepsncoks.com app.cliente-bb.mobi ymtrungeonethe.ml gki288.com tyxz.one.cdn.cloudflare.net cliente-bb.mobi denidgiawellre.tk soilisemicopfi.tk evveynetefoot.gq shopaoac.site nfrogjbetose.xyz www.nulledsoftware.net nulledsoftware.net nktimeline.com cuboweb.cl cehu.site awireless.xyz www.awireless.xyz quilgo.com new.aperturedental.com.au www.ppornobiz.xyz ppornobiz.xyz sxjeet.com www.arcmethodcourses.com leadersvilla.website tworelginewcelink.tk quotranlictumbfuncve.gq pupge10287638.tk www.forevertemp.com travels.finance www.badassceobabe.com pernimenloli.tk www.sunnahcamp.com wisbohammar-dressage.se vibraalpha8.com surategomruepia.tk www.opros2020ug.xyz opros2020ug.xyz jewelryalfajr.ml freemp3downloads.cc aramrapevedep.tk igpuff.club papagankids.com probsandmererede.tk neybegpowebnist.tk slipweisunminater.ga tbhcircle.com ninarenehohnholz2020.tk rainabook.ga gigolo-cristian.com www.gigolo-cristian.com

Malware Detected on Host

Count: 2 7ff5359ece165f7769c8f36f1955d8462926912b901a95c3e31ab5d33fc9fc07 6a01cb86ae93e4aac11e1f0a1f64699eb69ea8dc90707fb7d4c8a682561292f1

Open Ports Detected

2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2025-10-20

Share on: