104.18.40.87 Threat Intelligence and Host Information

Oct 21, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.18.40.87 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 51/100

Host and Network Information

  • Mitre ATT&CK IDs: T1059 - Command and Scripting Interpreter, T1071 - Application Layer Protocol, T1105 - Ingress Tool Transfer, T1497 - Virtualization/Sandbox Evasion

  • Tags: aaaa, a domains, all search, apple, as13335, ascii text, blister, class, click, cobalt strike, communicating, core, creation date, critical, date, discord, download, error, et tor, execution, exit, general, generator, hacktool, historical ssl, http, hybrid, ip address, june, known tor, link, local, malware, meta, metro, misc attack, name verdict, network, node traffic, otx octoseek, passive dns, pattern match, pixel, pulse pulses, referrer, relayrouter, resolutions, roblox, scan endpoints, script urls, search, showing, ssl certificate, status, stopransomware, strings, t1507537243, t1604023287, threat roundup, united, unknown, url http, urls, whois record, whois whois, win32, woff2

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 14 21088a0db88bd0350d9f1316e9c41d727c714cdda8b7d0c677b24f9aafad8b8c a3e62ac3bacee163f49446f7e3c80a1c88ca009c7752c4041177b89746231bf2 a61669c579fc135b2dc00f154fb4bbeb581c6f4c46f836de293549bedb40b0b3 6f5cdbceeb9cf44b625d467d587f0bf7d4fd435b6f9f9c72e9820b33582cc216 6f7bb444c8468b96a8caa68e5af09a05025c6404b60ebd82daec90dc7523e1f1 1352fe5052b27fdd52e5e18d4876fd79013d9fa7cab0c1e75dd3473cb1b506be be49cc31aee5a527038aecb2bb339a8272488a0144d2abea50a779db39ac26bf 58625739962a3ab5806cdb09e1da1a4ac3ede05907d1a595261ad51e3ad75790 4a9feb14c927f1f366a6446fbf1daf8b5edd7158f69b5a22f3eb2a82d4399eab 52f572cb3fd594c0c4789ed182361cb7a0ac2d34e3c8937be89ddcbb0ba912d9

Open Ports Detected

2052 2053 2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2025-10-20

Share on: