144.172.118.4 Threat Intelligence and Host Information

Oct 12, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 144.172.118.4 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 90/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1056.001 - Keylogging, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1100 - Web Shell, T1105 - Ingress Tool Transfer, T1110 - Brute Force, T1114 - Email Collection, T1176 - Browser Extensions, T1491 - Defacement, T1497 - Virtualization/Sandbox Evasion, T1560 - Archive Collected Data, T1566 - Phishing, T1571 - Non-Standard Port, T1573.002 - Asymmetric Cryptography, T1573 - Encrypted Channel, TA0011 - Command and Control

  • Tags: acint, agent, agent tesla, agenttesla, alexa, alexa top, all octoseek, all search, anlise, anonymizers, appdata, apple, apple ios, artemis, as141773, as15169 google, as17506 arteria, as17806 mango, as19969, as32244 liquid, as49505, as61317, as62744, as63932, ascii text, asnone united, asyncrat, attack, authority, auto-generated security, azorult, backdoor, bank, banker, bazaloader, bazarloader, beginstring, bitminer, blacklist, blacklist http, blacklist https, bladabindi, blockchain, body, bradesco, brian sabey, catalog file, cisco umbrella, ck id, class, cleaner, click, cobalt strike, collection, communicating, conduit, contacted, contacted urls, core, covid19, crack, critical, cry kill, cve201711882, cve202229266, cyber security, cyberstalking, cyber threat, cymulate2, dangeroussig, dapato, date, description, description ip, detection list, detplock, dllinject, domain, done adding, downldr, download, downloader, driverpack, dropped, dropper, dumping, emotet, encpk, encrypt, engineering, entries, error, et tor, exit, expired, facebook, fakeinstaller, falcon, fali contacted, fali malicious, file, files, filetour, formbook, fusioncore, general, generator, generic, generic malware, gmt content, gmt contenttype, hacking, hacktool, hallrender.com, heur, hostname, http, hybrid, iframe, immediate, indicator, indicator type, installcore, installer, installpack, internet storm, iobit, ioc, ip address, ip summary, ipv4, japan unknown, keep alive, keylogger, known tor, kraddare, kyriazhs1975, loadmoney, local, lockbit, look, malicious, malicious site, maltiverse, malvertizing, malware, malware norad, malware site, mark sabey, media, mediaget, meta, meterpreter, million, miner, mirai, misc attack, mitre att, monitoring, moved, msil, name verdict, nanocore, nanocore rat, netwire rc, networm, next, Nextray, njrat, node traffic, noname057, null, open, otx octoseek, outbreak, passive dns, pattern match, paypal, phish, phishing, phishing site, phishtank, png image, pony, predator, presenoker, proxy avoidance, pulse as16509, pulse pulses, qakbot, qbot, quasar, raccoon, ransom, ransomexx, ransomware, redline, redline stealer, referrer, refresh, related nids, relayrouter, remcos, response, restart, riskware, root ca, rostpay, runescape, russia unknown, safe site, sample, samples, scan endpoints, script, search, service, silk road, site, smokeloader, softonic, span, spyrixkeylogger, spyware, ssl certificate, stealer, strings, summary, suppobox, swrort, systweak, tag count, team, threat, threat report, tools, tor, TOR, tor exit node, trojan, trojanspy, tsara brashears, Tsara brashears, twitter, type, union, united, unknown, unsafe, url http, urls, url summary, verify, vidar, wacatac, whois record, whois whois, win32, win64, windows nt, xcnfe

  • Known tor exit node

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: blocklist_de, blocklist_de_ssh, blocklist_net_ua, botscout_1d, botscout_30d, botscout_7d, cleantalk_30d, cleantalk_new_30d, cybercrime, dm_tor, et_compromised, et_tor, greensnow, haley_ssh, sblam, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, stopforumspam, tor_exits_1d, tor_exits_30d, tor_exits_7d, tor_exits

  • Known TOR node
  • Country: United States
  • Network:
  • Noticed: 50 times
  • Protocols Attacked: ssh
  • Countries Attacked: Bangladesh, Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Malaysia, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: houston.texas4tor.com 144.172.118.4

Malware Detected on Host

Count: 46 dfc41ce030340214dfb943f97574b23d44728460586c139e7873732fcd44c1af b11e614cdd02aecb8d6ae65bf67bfac8cbefd68830065217e2cb48922743bb12 c1392283ae24b836d9afc2f5dba43dbb5782e8b7c4074de7da7f7dcd8858f905 68801c449b903e06dc672f0bf8dbef9ccbf409a04715c22e111d9028d678460f cf93542e5b93485475fb98443c8bba33c21774239e88c833e491dd50f67a209a 5690536a7ec6f6972d707ae296eccdb30972451608688842dcd6c70e6f5ef5ea 155cc390568a88b0bc789e1d7cf2dda7fc2f0943b31055c9a4f87d95261f4ee0 3523c46d42f35d67ba6841ddc5cdd50b3378220dfc49f512bac44c2c92b6d329 2fd353ffcace535b5c0cdd3b70784bcbf1d4e35879a3109ed8825c2f970d22d3 7282e2fdb25b07554b082f5cf1697315ed5ce3005f985cbe96a34da965869db5

Map

Whois Information

Links to attack logs

dofrank-ssh-bruteforce-ip-list-2023-03-26 digitaloceantoronto-ssh-bruteforce-ip-list-2024-02-15 ****** dotoronto-ssh-bruteforce-ip-list-2023-03-27 vultrparis-ssh-bruteforce-ip-list-2024-02-24 aws-ssh-bruteforce-ip-list-2021-04-11 digitaloceanfrankfurt-ssh-bruteforce-ip-list-2024-03-06 nmap-scanning-list-2021-12-27 bruteforce-ip-list-2021-03-12 dosing-ssh-bruteforce-ip-list-2023-03-27 vultrparis-ssh-bruteforce-ip-list-2024-03-01 dolondon-ssh-bruteforce-ip-list-2023-03-14 vultrwarsaw-ssh-bruteforce-ip-list-2023-03-22 vultrparis-ssh-bruteforce-ip-list-2023-03-27 bruteforce-ip-list-2021-04-21 dolondon-ssh-bruteforce-ip-list-2023-03-22 vultrparis-ssh-bruteforce-ip-list-2024-02-15 vultrparis-ssh-bruteforce-ip-list-2024-02-21 ****** bruteforce-ip-list-2021-03-20 dotoronto-ssh-bruteforce-ip-list-2023-03-20 dofrank-ssh-bruteforce-ip-list-2023-03-21 ******

Share on: