104.244.78.207 Threat Intelligence and Host Information

Jan 11, 2024 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.244.78.207 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

Mitre ATT&CK IDs: T1078 - Valid Accounts, T1083 - File and Directory Discovery, T1098.004 - SSH Authorized Keys, T1105 - Ingress Tool Transfer, T1110.004 - Credential Stuffing, T1110 - Brute Force
Tags: Bruteforce, Brute-Force, cowrie, cyber security, ioc, malicious, Nextray, phishing, ssh, SSH
View other sources: Spamhaus VirusTotal

Country: Luxembourg
Network: AS53667 frantech solutions
Noticed: 50 times
Protcols Attacked: ssh
Countries Attacked: Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: lu2.ageshop.top sparlk.com dogcou.com bapsna.com hemplure.com ledmaxs.com liftrips.com vanohm.com dovogue.com playleona.com soracist.com organile.com runbowen.com heydefo.com kipsilk.com palmoons.com conaday.com fanishow.com bolosee.com dhalon.top klamboys.com ustinn.top revwit.com digsac.com bagveiw.com tomhertz.com asscad.com thychi.com reprinse.com toryali.com dogealva.com fromonup.com prieale.com powsale.com miradele.com rapais.com kamijob.com minfog.com tiedmoan.com sardgo.com lawirk.com sitsus.top abobaa.top yabait.com coxgps.top hawitryna.top samoda.top wonajlepsze.top radwea.top luxusb.top neobar.top dorisf.top villal.top www.ayino.top ayino.top 104.244.78.207.sslip.io this-is-a-tor-exit-node.justaguy.be

Malware Detected on Host

Count: 1 bfaa0d5932b14d955e0aa3e6b9602134f15e99dba3834eaad5b945404ef18184

Open Ports Detected

Map

Whois Information

NetRange: 104.244.72.0 - 104.244.79.255
CIDR: 104.244.72.0/21
NetName: PONYNET-14
NetHandle: NET-104-244-72-0-1
Parent: NET104 (NET-104-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS53667
Organization: FranTech Solutions (SYNDI-5)
RegDate: 2014-11-10
Updated: 2014-11-10
Ref: https://rdap.arin.net/registry/ip/104.244.72.0
OrgName: FranTech Solutions
OrgId: SYNDI-5
Address: 1621 Central Ave
City: Cheyenne
StateProv: WY
PostalCode: 82001
Country: US
RegDate: 2010-07-21
Updated: 2017-01-28
Ref: https://rdap.arin.net/registry/entity/SYNDI-5
OrgAbuseHandle: FDI19-ARIN
OrgAbuseName: Dias, Francisco
OrgAbusePhone: +1-778-977-8246
OrgAbuseEmail: fdias@frantech.ca
OrgAbuseRef: https://rdap.arin.net/registry/entity/FDI19-ARIN
OrgTechHandle: FDI19-ARIN
OrgTechName: Dias, Francisco
OrgTechPhone: +1-778-977-8246
OrgTechEmail: fdias@frantech.ca
OrgTechRef: https://rdap.arin.net/registry/entity/FDI19-ARIN
NetRange: 104.244.72.0 - 104.244.79.255
CIDR: 104.244.72.0/21
NetName: BUYVM-LUXEMBOURG-01
NetHandle: NET-104-244-72-0-2
Parent: PONYNET-14 (NET-104-244-72-0-1)
NetType: Reallocated
OriginAS: AS53667
Organization: BuyVM (BUYVM)
RegDate: 2017-10-01
Updated: 2017-10-01
Ref: https://rdap.arin.net/registry/ip/104.244.72.0
OrgName: BuyVM
OrgId: BUYVM
Address: 3, op der Poukewiss
City: Roost
StateProv:
PostalCode: 7795
Country: LU
RegDate: 2017-10-01
Updated: 2017-10-01
Ref: https://rdap.arin.net/registry/entity/BUYVM
OrgTechHandle: FDI19-ARIN
OrgTechName: Dias, Francisco
OrgTechPhone: +1-778-977-8246
OrgTechEmail: fdias@frantech.ca
OrgTechRef: https://rdap.arin.net/registry/entity/FDI19-ARIN
OrgAbuseHandle: FDI19-ARIN
OrgAbuseName: Dias, Francisco
OrgAbusePhone: +1-778-977-8246
OrgAbuseEmail: fdias@frantech.ca
OrgAbuseRef: https://rdap.arin.net/registry/entity/FDI19-ARIN

Links to attack logs

dofrank-ssh-bruteforce-ip-list-2022-11-26 vultrmadrid-ssh-bruteforce-ip-list-2022-11-24 ****** dotoronto-ssh-bruteforce-ip-list-2022-12-05 vultrmadrid-ssh-bruteforce-ip-list-2022-11-27 dofrank-ssh-bruteforce-ip-list-2022-12-07 dolondon-ssh-bruteforce-ip-list-2022-12-12 vultrparis-ssh-bruteforce-ip-list-2022-12-07 ****** ******

Share on: