172.67.70.134 Threat Intelligence and Host Information

Aug 22, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 172.67.70.134 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

Mitre ATT&CK IDs: T1014 - Rootkit, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036.004 - Masquerade Task or Service, T1036 - Masquerading, T1041 - Exfiltration Over C2 Channel, T1049 - System Network Connections Discovery, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1059.006 - Python, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1100 - Web Shell, T1105 - Ingress Tool Transfer, T1113 - Screen Capture, T1114 - Email Collection, T1125 - Video Capture, T1129 - Shared Modules, T1132 - Data Encoding, T1140 - Deobfuscate/Decode Files or Information, T1155 - AppleScript, T1156 - Malicious Shell Modification, T1204 - User Execution, T1444 - Masquerade as Legitimate Application, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1480 - Execution Guardrails, T1553 - Subvert Trust Controls, T1560 - Archive Collected Data, T1566 - Phishing, T1568 - Dynamic Resolution, T1574.006 - Dynamic Linker Hijacking, T1583 - Acquire Infrastructure, T1598 - Phishing for Information, T1602.002 - Network Device Configuration Dump
Tags: 1663014711, 411260982, a7i string, aaaa, accept, access, access ta0006, address as, address url, admin country, adobe help, a domains, adversaries, aes128gcm, akamai rank, alerts, all octoseek, all scoreblue, analysis no, analyze, android, anomalous file, apple, apple control, apple inc, apple ios, april, artro, as13335, as133618, as14061, as16509, as32244, as32244 liquid, as50295 triple, as58110 ip, as62597, as autonomous, ascii text, asn13335, asn15169, asn213250, a td, a th, attack, august, authentication, authority, av detection, av detections, azure tls, b image, binrm, blacklist https, body, body doctype, body length, bookmarks, borland delphi, boundsstr, bq mar, brashears, brian sabey, browsing, b script, ca id, ca issuers, ca limited, capture, catalog file, cdn range, centos, certificate, ck id, class, click, cloudflar, cloudflare, cloudflarenet, cname, cncomodo ecc, cnisrg root, cnlet, command, communicating, community score, comodo, connect facebook, contact, contacted, contacted urls, control ta0011, copy, copy md5, copy sha1, copy sha256, core, create, created, creation date, criminal gang, criteria id, critical, crl cache, crlcachedir, cus olet, cus subject, cust exe, customer client, CVE-2017-0147, cybercrime, darklivity, data, date, defense evasion, delphi, delphi generic, depot tech, design, digicert https, digitaloceanasn, directory, displays, dns replication, dns resolutions, dnssec, domain, domain abuse, domain name, domainpath name, domains, domain scam, done adding, dos borland, download, dstroot, dynadot, dynadot inc, dynadot llc, e0b function, e4609l, ecdheecdsa, email, emails, emotet, encodedpixel, encrypt, encrypt cnr10, entries, error, evasion ob0006, ev server, executable, execution, expiration, expiration date, expired, express, facebook, facebook url, falcon sandbox, false, fastly, fear factor, february, filehash, files, files domain, files related, file system, file type, final url, flag, formbook, for privacy, foundation, frame, framing, france unknown, frankfurt, full url, gandi sas, gecko, general, general full, generator, generic, generic malware, generic windos, geoip, germany, germany unknown, get http, gmbh version, google, google https, google safe, google update, google url, greater, group, guard, hacktool, hash, hashes, headers, high, hijacker, historical ssl, history killer, hit, hostname, hostnames, html public, http, http response, https://otx.alienvault.com/pulse/65acace20c18a7d6c5da2e27, hybrid, icmp traffic, ico mainicon, icons library, identifier, identity search, ids detections, impressum, informative, initial access, injection, inject-x64.exe, install, intel, intel mac, internal name, iocs, ip address, ip https, ip security, ip summary, ip traffic, ipv4, issuing ca, itpsolutions, ja3s, january, javascript, jeffrey reimer, js user, june, kb body, kb document, kb file, kb image, kb script, key algorithm, keychainssrc, key info, key usage, khtml, learn, legal, lets, license, limited, line, link, linker, linkid246338, linkid69157 url, liquidweb, llc name, local, lockbit, log id, logo analysis, log operator, look, lsalford, ltcgc, macintosh, main, makefile, malicious, malware, malware infection, man, march, medium, men, meta, microsoft, migrate, miles it, mime, mitre att, modernizr, monitoring, moved, mozilla, ms windows, name server, name size, name tactics, name verdict, network_icmp, next, nib files, no expiration, no na, no no, null, number, ob0002 defense, oc0001 process, oc0003 data, ocomodo ca, ocsp, october, office depot, olet, open, os2 executable, os x, overview dns, packet, parent, passive dns, paste, path, pattern match, pe32, pe32 compiler, pe64 compiler, phishing, php logo, poison, positive ipv4, possible, post http, pragma, primary request, privacy, privacy create, privacy update, private ip, productname, protocol h2, proxy, pulse, pulse pulses, pulses, pulses otx, push, python, python connection, python software, random, reason hostname, record value, redacted for, redirect, redirect chain, referer, referrer, refresh, registrant fax, registrar abuse, registrar iana, registry admin, relic, remote attackers, report spam, request chain, requests domain, research group, resolutions, resolved ips, resource, resource path, restart, reverse dns, rexxfield, root ca, rows, rsa public, rstunf, ruby logo, salford, sample, samples, san francisco, sat jul, scan analysis, scan endpoints, score, score clean, script, search, sectigo https, secure server, security tls, server, servers, service, servicelogin, service privacy, setup, sha1, sha256, show, showing, size, size426kib type, size45b type, smartfolder, smithtech, sniffs, software, software caddy, source browser, source level, span, spawns, splitcount, spyware, srcroot, sreredrum, ssl certificate, status, status code, status page, strings, stwa lredmond, subid, subject, subject public, summary, summary leaf, suspicious, system, system oc0008, ta0008 command, tad436770, tag count, tags, targetdisk, targets, td td, tech, tech country, technology, temp, threat, threat analyzer, threat report, threat roundup, threat score, thumbprint, timestamp entry, tls sni, tls web, tofsee, tools, triple mirrors, trojan, tr tr, tsara brashears, type indicator, type mimetype, ubuntu, united, unknown, upgrade, url http, url https, urls, url scan, urls http, urls https, url summary, url text, v3 serial, valid, validity, value, verify, version, veryhigh, viewer file, visit, webzilla, weeks ago, whois record, whois whois, win16 ne, win32, win32 exe, win64, window, windows, windows nt, x509v3 subject, x8i string, xvideos, y3i string, yara detections, yara rule, yoa https, z6s3i, z6s3i string, z6s3i y3i
View other sources: Spamhaus VirusTotal

Country: United States
Network:
Noticed: 11 times
Protocols Attacked: Anonymous Proxy
Countries Attacked: Australia, United States of America
Passive DNS Results: shinepay.co jyxd010.com staging.metricmover.app www-stage.tessutietendaggipanini.it abuja-tekhkon.info dev.ezblockchain.net skin9.supvid.com everesttoys.com jayupete-paceze.endpoint.4everland.co s3-web.miragerust.com hm.consumidormoderno.com.br www.tudosobrehospedagemdesites.com.br srcotomotiv.com api.fanspicy0.com experienciaunach.cl www.hhibeachandtennis.com jun88.team help.shinepay.co www.nicovip.com nicovip.com tudosobrehospedagemdesites.com.br miragerust.com download.nashvpn.net zidevent.be baruchlabunski.com portablespace.co.uk skin2.supvid.com partner.cddit.com.br crop.top endpoint.4everland.co app.ezblockchain.net conectebs.top www.consumidormoderno.com.br god-101.com wp-test.authenticityleads.com www.smarthomebit.com smarthomebit.com tessutietendaggipanini.it nextrembrandt.com www.mmoexp.com mmoexp.com proxy.vn teepr.com www.baruchlabunski.com xrpball.pro fanspicy0.com skin6.supvid.com skin12.supvid.com crm.ezrsgold.com www.wirtschaftsbund-salzburg.at wirtschaftsbund-salzburg.at s75tnxq.duitmy.com ezblockchain.net fretvuio.info updater.l2ashenvale.club preview-library.presencelearning.com gateway-external.dash.fi www.dhclaw.com www.rustacademy.net help.quickplaysport.us www.studentpirgs.org www.maistolyga.lt new.kodi-professional.ua app.mosaic.ag vip.ydllovetv.xyz ydllovetv.xyz fire.co rentproxy.org metricmover.app smartfx.com www.smartfx.com iboplayer.pro ss.tudou.us.kg dev.tudosobrehospedagemdesites.com.br sitedemo.tudosobrehospedagemdesites.com.br catalog.presencelearning.com blog.waveplay.com www.paragaranti.com moyo.vn site.supvid.com www.winemarketjournal.com siffra.ai content.dash.fi studentpirgs.org psa-temp-endpoint.4everland.co www.usheadlines.today cmdb.cddit.com.br bet77b.com 2020-sms.com www.supvid.com mondopescadavoli.it kanga.presencelearning.com skin14.supvid.com my.smartfx.com worker-test.authenticityleads.com cdn.morphsuits.co.uk rgnsprttop.top hostingviet.vn blogs.rmkv.com rmkv.com crm-demo.cddit.com.br www.pinstructure.com webproxy1.cddit.com.br www.tessutietendaggipanini.it nouveautes-tele.com maistolyga.lt skin8.supvid.com skin4.supvid.com stage.authenticityleads.com worker-staging.authenticityleads.com authenticityleads.com skin11.supvid.com cdn.backend.casinopro.se user6.supvid.com 4y2inkjwdfh.online user7.supvid.com tts-staging.productiveshop.com digihorseempires.io rm-autodalys.lt www.rm-autodalys.lt hhibeachandtennis.com codestaging.authenticityleads.com usheadlines.today supvid.com sinuasi.ee davitthanseronline.com sprinktechug.com pagasswitch.com www.sprinktechug.com www.battigdesign.com www.orroland.com mamalabels.cz lamania.eu www.nettleshipsawyer.co.uk www.nouveautes-tele.com www.traveligo.pl room.presencelearning.com backend.casinopro.se clpim.clarks.in daryus.com.br consumidormoderno.com.br iacx.consumidormoderno.com.br www.cvtgf.com www.ranking.bio www.yeenmall.com secretogreen.com nexyvox.com cvtgf.com yeenmall.com apolo777.com maxjuwels.com premio.consumidormoderno.com.br lb11.onlyforgame.uk lb10.onlyforgame.uk lb1.onlyforgame.uk lb2.onlyforgame.uk lb9.onlyforgame.uk lb3.onlyforgame.uk grabmybag.com mypay.co.uk ranking.bio cdn.dveri.ru files.dveri.ru www.azkarbon.com ppi.ac.id warm-glass.co.uk waveplay.com azkarbon.com library.presencelearning.com dveri.ru sda.productiveshop.com www.tattooyourstyle.fr tattooyourstyle.fr lb4.onlyforgame.uk duitmy.com sl2024.live update.l2ashenvale.club autoupdate.l2ashenvale.club thespecialgiftszone.com support.eu.evertz.com www.wsovn.net evertz.com staging.cryptonaute.fr xrhma.depolas.gr depolas.gr www.depolas.gr embersofthelastwar-1.obsidianportal.com platform.hellspin13.com go.dash.fi selmalewis.com wsovn.net hellspin13.com ashenvale.club btcpay.l2ashenvale.club kingdombase.com omtch.com dev.directorio.pescadata.org qa.directorio.pescadata.org ver.productiveshop.com staging.azkarbon.com av.evertz.com apps.presencelearning.com partners.dash.fi kamranstandoorihut.com kaizen-shop.gr dev.tattooyourstyle.fr zcgm.neids.ru rustacademy.uk rustacademy.eu preview-flutterapp.presencelearning.com preview-kanga.presencelearning.com rustacademy.us pt.fx-exchange.com l2ashenvale.club emails.presencelearning.com zhbu2.neids.ru woszd.neids.ru dev.backend.africabusinessplus.com ct8hs.neids.ru fx-exchange.com trustargos.com presencelearning.com grpc.webhooks.dash.fi asisucedio.com clcart.clarks.in sink.btloader.com clarks.in www.clarks.in toolz4industry.com rustacademy.net serpil-payment-headoffice-dev.xpress-ix.com page.localfinancialadvice.co.uk namieasysite.com direct-cuves.fr clbackend.clarks.in www.productiveshop.com kiosk-api.xpress-ix.com front-api.xpress-ix.com pma.dearuniverse.de vendure.dearuniverse.de www.justnaturism.com justnaturism.com postapaste.com id.trustargos.com central.trustargos.com prod.backend.africabusinessplus.com feature.backend.africabusinessplus.com cryptonaute.fr africabusinessplus.com tparents.net coached.spitch.jp justvanilla.productiveshop.com serpil-payment-api-dev.xpress-ix.com fiduciaire-yadan.fr iovigilo.it acrosuperk.spitch.jp sm-hs.spitch.jp payment-ui.xpress-ix.com wpaog-lom-middleware.net willbox.spitch.jp www.pages.ventesgroupemarcelle.com maintenance.ventesgroupemarcelle.com staging.matchachin.com sourpusscanada.com www1.valefiel.com olympus-japan.spitch.jp aaa.spitch.jp localadvisor.localfinancialadvice.co.uk admin.localfinancialadvice.co.uk www.localfinancialadvice.co.uk localfinancialadvice.co.uk njaro.spitch.jp mikoshie.spitch.jp tts.productiveshop.com cinca.spitch.jp admin.clevescene.com posting.clevescene.com cosmic-jgs.spitch.jp gamerpillar.com itsraininginsharn.obsidianportal.com rsbc.cz tts-api.productiveshop.com ticketu.live relations.spitch.jp yoshida-kaiun.spitch.jp i-plug.spitch.jp www.moulia.fr webfilter.netassurity.com perroneconstruction.com jems.spitch.jp www.drcontactlens.com onusswap.com about.spitch.jp phpmyadmin.productiveshop.com smile-s.spitch.jp drcontactlens.com productiveshop.com help.obsidianportal.com api.dearuniverse.de ipemobile.com zxc142.com lime-inc.spitch.jp new.productiveshop.com ciq.productiveshop.com dot.productiveshop.com lse.productiveshop.com pro.productiveshop.com site.productiveshop.com dkd.productiveshop.com www.barrien.info hastcorp.spitch.jp www.waterfordvisitorcentre.com www.bollywood-boulevard.com bollywood-boulevard.com www.matchachin.com matomo.dearuniverse.de top-spark.spitch.jp new.dearuniverse.de scripts.hatton-jewellers.com www.hatton-jewellers.com pwntilldawn.com shop.dearuniverse.de www.fanatikcos.com.br www.dearuniverse.de edu.confluxnetwork.org portal.pwntilldawn.com creator.dearuniverse.de www.bonusbooks.co.il red-earth.obsidianportal.com live.dearuniverse.de www.bestcrypto4u.com nextmode.spitch.jp hatton-jewellers.com kds-info.spitch.jp fanatikcos.com.br bluememe.spitch.jp periperibrosonline.co.uk machida-tky.spitch.jp dearuniverse.de kemono.games e-broad.spitch.jp collage.spitch.jp jbcde.spitch.jp online.pwntilldawn.com camorr.obsidianportal.com www.valefiel.com bscanner.com.ua www.dbmwebdesign.de stockandflow.spitch.jp dev2.spitch.jp www.churchhrnetwork.com churchhrnetwork.com asgoeslightsogoesdarkness.obsidianportal.com api.onus.exchange www.onus.exchange onus.exchange bangdefx.vip funaisoken.spitch.jp jjnn114.com solxyz.spitch.jp overalls.spitch.jp sunloft.spitch.jp garage.spitch.jp defence.rsbc.cz cube-company.spitch.jp confluxnetwork.org sapmed.spitch.jp dhclaw.com penguins.finance goal-consulting.spitch.jp media1.clevescene.com media2.clevescene.com photos.clevescene.com www.gentledental.com xiaokuawa.xyz nagasaki-koutairen.jp temp.spitch.jp makino.spitch.jp fujiarte.spitch.jp sandbox.spitch.jp ynu.spitch.jp nakayoka.spitch.jp www.rightsourcing-gmbh.com ubun.spitch.jp cosball.app theyounabis.com momoconft.com cf.bubbleroom.dk corp-app01.cddit.com.br www.casinopro.se www.wonkywonderful.com m.gipsybee.com www.loanlawyer.law m.clevescene.com clevescene.com www.lucalito.com www.attorneydavid.com.cdn.cloudflare.net hwp.rsbc.cz casinopro.se www.forgefix.co.uk.cdn.cloudflare.net www.clevescene.com mtaautomation.com bestcrypto4u.com www.isodesign-cannes.com lucalito.com www.gradesfixer.com bonusbooks.co.il en.newstrend.news stagingapi.paywithmoon.com www.bluemarblejobs.com.cdn.cloudflare.net chickenuniononline.com arisingdarkness.obsidianportal.com help.momentumsquad.com northsand.spitch.jp login.paywithmoon.com www.communtopia.com linkerjob.com.mx votetest.confluxnetwork.org dimdim.ua www.mpofibercable.com 2iio.ru arocena.testing.botiga.com.uy wonkywonderful.com unibexlabs.com quoteswishesmsg.com lovebydesign.nl mpofibercable.com accounts.ifengge.cn api.ifengge.cn apps.ifengge.cn ws.ifengge.cn www.ifengge.cn ifengge.cn www.newstrend.news kamanja.io www.kamanja.io www.bluemarblejobs.com grafterboylounge.co.uk directorio.pescadata.org api.paywithmoon.com analytics.revantoptics.com staging2.mpofibercable.com blog.obsidianportal.com morphsuits.co.uk www.morphsuits.co.uk www.ventesgroupemarcelle.com www.bkm-mannesmann.shop spitch.jp magazine.dimdim.ua dev.spitch.jp bex-corp.spitch.jp base.jovemaprendizbrasil.com.br blog.jovemaprendizbrasil.com.br funnelbeam.cc www.philippe-fournier-viger.com.cdn.cloudflare.net test.spitch.jp www.gothikalenses.com www.jovemaprendizbrasil.com.br jovemaprendizbrasil.com.br www.estateinvest.com.ua wien-pro.net www.shaikhsaeed.com shaikhsaeed.com shop.shaikhsaeed.com fr-pay.ru community.teacherph.com forums.teacherph.com www.footboom.com support.netassurity.com www.netassurity.com netassurity.com www.psychguides.com extension.auth.paywithmoon.com momentumsquad.com nqesh.teacherph.com buynsta.com packages.section42.io cdn.teacherph.com www.attorneydavid.com jolitaskincare.eu delmau-shop.nl lemongroup.nl www.creactive-travel.com www.al-ain.org.uk www.forgefix.co.uk cosmolot.ua romanatakeawayeuxton.co.uk damiensdinner.com www.dentalofficesupport.com indianexpressstockport.co.uk www.philippe-fournier-viger.com athletesystems.ca tax-rates.org www.deweymister.com.au.cdn.cloudflare.net www.keller-x.ch www.teacherph.com mediahub.com www.kjekk.nl bo.excoin.io ns2.regnowonline.com

Malware Detected on Host

Count: 48 9eb0f08b07159c511cc11c0d7720e53911a4ec106947caa769777cdbb5ffb6fd 356fff564c353c405d5d2f0b5e320cd528216de973f82edf90b52f8b8fd2ccab d9bd83327a01e091fb1c544f6fa567a459df51a462ebb10375b715321de1a1cc 02c228903b5b9f4ac67410dfd99f76f117652ee78a1e7c086be7b9d7bf7ca3cd 3aeb8da1f1bde0a2a87d96f47a0049fe7fb55103f77b62b5e646283bc75bcea3 5ef4a6d420574cac5e14f2b8c0f2ff41a402f046e92fb21c7275479777824121 f0a25c76945d8b2a69039b7148449df24896752f03b113756a107d9e6ba81054 284b721a4748a680b6989eef59f5d6d03162a3e3a4cc9428a78ed5686076ad12 8274124d0bd8a5e1b9760347054d91d573530e1c3603e46385ed9f380d6a4747 c542928afb3b56d8ee1fa3f606a1936809c02235148b6cb3220a9d817a589da2

Open Ports Detected

2052 2082 2083 2086 2087 443 80 8080 8443 8880

Map

Whois Information

NetRange: 172.64.0.0 - 172.71.255.255
CIDR: 172.64.0.0/13
NetName: CLOUDFLARENET
NetHandle: NET-172-64-0-0-1
Parent: NET172 (NET-172-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Cloudflare, Inc. (CLOUD14)
RegDate: 2015-02-25
Updated: 2024-09-04
Comment: All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse
Comment: Geofeed: https://api.cloudflare.com/local-ip-ranges.csv
Ref: https://rdap.arin.net/registry/ip/172.64.0.0
OrgName: Cloudflare, Inc.
OrgId: CLOUD14
Address: 101 Townsend Street
City: San Francisco
StateProv: CA
PostalCode: 94107
Country: US
RegDate: 2010-07-09
Updated: 2024-11-25
Ref: https://rdap.arin.net/registry/entity/CLOUD14
OrgRoutingHandle: CLOUD146-ARIN
OrgRoutingName: Cloudflare-NOC
OrgRoutingPhone: +1-650-319-8930
OrgRoutingEmail: noc@cloudflare.com
OrgRoutingRef: https://rdap.arin.net/registry/entity/CLOUD146-ARIN
OrgNOCHandle: CLOUD146-ARIN
OrgNOCName: Cloudflare-NOC
OrgNOCPhone: +1-650-319-8930
OrgNOCEmail: noc@cloudflare.com
OrgNOCRef: https://rdap.arin.net/registry/entity/CLOUD146-ARIN
OrgTechHandle: ADMIN2521-ARIN
OrgTechName: Admin
OrgTechPhone: +1-650-319-8930
OrgTechEmail: rir@cloudflare.com
OrgTechRef: https://rdap.arin.net/registry/entity/ADMIN2521-ARIN
OrgAbuseHandle: ABUSE2916-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-650-319-8930
OrgAbuseEmail: abuse@cloudflare.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2916-ARIN
RTechHandle: ADMIN2521-ARIN
RTechName: Admin
RTechPhone: +1-650-319-8930
RTechEmail: rir@cloudflare.com
RTechRef: https://rdap.arin.net/registry/entity/ADMIN2521-ARIN
RNOCHandle: NOC11962-ARIN
RNOCName: NOC
RNOCPhone: +1-650-319-8930
RNOCEmail: noc@cloudflare.com
RNOCRef: https://rdap.arin.net/registry/entity/NOC11962-ARIN
RAbuseHandle: ABUSE2916-ARIN
RAbuseName: Abuse
RAbusePhone: +1-650-319-8930
RAbuseEmail: abuse@cloudflare.com
RAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2916-ARIN

Links to attack logs

Share on: