104.47.66.10 Threat Intelligence and Host Information

Jan 11, 2024 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.47.66.10 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1012 - Query Registry, T1027 - Obfuscated Files or Information, T1030 - Data Transfer Size Limits, T1036.004 - Masquerade Task or Service, T1036 - Masquerading, T1045 - Software Packing, T1057 - Process Discovery, T1059.002 - AppleScript, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1078.004 - Cloud Accounts, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1090 - Proxy, T1100 - Web Shell, T1105 - Ingress Tool Transfer, T1106 - Native API, T1114 - Email Collection, T1119 - Automated Collection, T1122 - Component Object Model Hijacking, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1415 - URL Scheme Hijacking, T1448 - Carrier Billing Fraud, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1497 - Virtualization/Sandbox Evasion, T1546.015 - Component Object Model Hijacking, T1548 - Abuse Elevation Control Mechanism, T1562.003 - Impair Command History Logging, T1588.004 - Digital Certificates, TA0009 - Collection, TA0011 - Command and Control, TA0037 - Command and Control

  • Tags: aaaa, active, active2, address, admin country, a domains, agent tesla, alexa, alexa top, alfper, algorithm, all octoseek, all search, analyze, android, anonymizer, apache, api call, appdata, apple, apple app store compromise, apple computer, apple support compromise, app store, april, artemis, as13414 twitter, as14061, as15169 google, as16276, as22612, as24940 hetzner, as32934, as43350 nforce, ascii text, asnone united, asyncrat, attack, august, ave maria, azorult, bank, banker, beginstring, blacklist, blacklist http, blacklist https, body, body length, bradesco, ca g2, ca lann, california, caltech.edu, carnegie mellon, carnegie mellon university, certificate, certificates, chaos, chrome, cisco umbrella, citadel, city, city center, ck id, class, click, cmu server, cname, cobalt strike, code, collections, communicating, component loop, contact, contacted, contacted urls, contact phone, cookie, copy, core, count blacklist, country, country us, covid19, creation date, critical, csc corporate, cus cnapple, cus cngts, cus cnincommon, cybercrime, cyber stalking, cyber threat, dangerous, data, date, detection list, detections type, dgs, digicert inc, digicert tls, divi child, dnspionage, dns replication, domain, domain holder, domain name, domain record, domains, domain status, dropped, ecc ca, email, emotet, encrypt, engineering, entries, error, et, et intelligence, et tor, execution, exit, expiration date, false, family, february, feeds ioc, files, files domain, files related, final url, firehol gozi, first, for privacy, found, fraud services, full name, g1 oapple, galaxy, galaxy watch, gamehack, gear s, gear s2, gear s3, gear sport, general, generator, genericm, germany unknown, ghost rat, gmail, gmtn, gmt x, google, google attack, google llc, google playstore, hacker profile, hacktool, headers, highly targeted, hijacker, historical ssl, hostname, hostnames, html info, http, http response, hybrid, icloud compromise, identify, ids detections, info, installbrain, installcapital, installcore, installer, investigation, iocs, ioc search, ios, ip address, ip summary, ipv4, issuer, july, kb body, key algorithm, key info, keylogger, known tor, komodo, kraken, lazarus, life, llc validity, local, location united, log id, lolkek, lookups, malicious, malicious site, malicious url, malvertizing, malware, malware generator, malware site, markmonitor, masquerading, matsnu, medium, meta, meta http, meta tags, metro, metroby-tmo, michael roberts, microsoft, million, miner, misc attack, mitre att, mon oct, moved, mydoom-90, name, name servers, name verdict, nanocore, nanocore rat, net128, net1280000, netsky, network, networm, new ioc, neworder.doc, next, nexus category, no data, node tcp, node traffic, none file, null, number, nxdomain, nymaim, object, obsession, occamy, ogoogle trust, orgid, orgtechhandle, orgtechref, otx octoseek, packing t1045, passive dns, password, paste, pattern match, pe resource, phishing, phishing site, phishtank, pittsburgh, ponmocup, pornographer, postal code, ppi useragent, pragma, present jun, privacy admin, privacy tech, project, public key, public server, pulse pulses, pulses none, pulse submit, python infostealer, qakbot, quasar, qwest, ramnit, ransom, ransomexx, ransomware, ratel, rauschenberg, record type, record value, red, redacted for, redline stealer, redlinestealer, referrer, refresh, registrar, registrar abuse, registrar iana, registrar url, registrar whois, registry arin, registry domain, related tags, relayrouter, resolutions, reverse dns, rexxfield cyber, roots, rsa cn, rsa server, rsa sha256, rtechhandle, rtechref, safe site, sample, samples, samsug, samsung galaxy, scan endpoints, script, script urls, search, security, select contact, server, servers, services, serving ip, setcookie geous, sha256, show, showing, simda, site, site kit, slander, soc, spammer, span, ssl certificate, status, status code, stealer, stevens creek, stmi ouincommon, strange, strings, subject public, summary, suppobox, suricata, tackle company, tag count, tag tag, target, targeting, team, team malware, teams api, tech country, threat, threat analyzer, threat report, threat roundup, tinba, title, title rexxfield, tld count, tls web, t-mobile, tofsee, tools, tor known, tor relayrouter, tracey richter, traffic, trojan, trojanclicker, trojanspy, tsara brashears, ttl value, tulach, type textplain, union, united, united kingdom, unknown, url analysis, url http, urls, url summary, urls url, ursnif, v3 serial, validity, value0, vawtrak, verdict, virtool, voyeurism, watch, webtoolbar, whois lookups, whois record, whois whois, win32, win32 exe, winamp, windir, window, worm, write, yara detections, zbot, zeus, zombie devices

  • JARM: 2ad2ad0002ad2ad0002ad2ad2ad2adf9fdf4eeac344e8b5003264da73585be

  • View other sources: Spamhaus VirusTotal

  • Country: United States
  • Network: AS8075 microsoft corporation
  • Noticed: 9 times
  • Protcols Attacked: SSH
  • Countries Attacked: Netherlands, United Kingdom of Great Britain and Northern Ireland, United States of America

Malware Detected on Host

Count: 1404 5e817cc0390a78051866952da0cc8e2b6d04b9e1a8798cf80d1923d3afd05c35 0d59fb3ee725564095f3cbb88652abb7c0df969719608b98889f0c0ac702d139 f63a3c061a58110ae7d2d2a0640d58a09800a2c9e46874cbd929bfe0ace8cf81 eff9430fd7c767261605486496bff37b62652167c8a209eff25939e1a7c69c53 1f884bc647b15727722571594167a0ac24ce522bebd9be7b1820418397f30c55 b74f7f269a97e34d99a81007b33a1410e080c6164b3b4daa832f6eeeba9598ed e390d8045ba3be1716c355ad041c083fbea49dec0d5c6cbca2e3bc750f34bcb1 5d39d06da63faa83f48256f5ff75d570d88b91ab952bedfbe35b47a63937ee3c 74397d65b4c42d474f3b20d3d47c0e3d5edce6bbf4659041f20a42a22d93e0d0 b560bb9054217b2f796bc24694ba5d022a59d8ac5558168ef9fef4fe9d80926a

Open Ports Detected

25 443 80

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: