173.254.28.29 Threat Intelligence and Host Information

Feb 20, 2026 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 173.254.28.29 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 64/100

Host and Network Information

  • Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1045 - Software Packing, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1069 - Permission Groups Discovery, T1071 - Application Layer Protocol, T1083 - File and Directory Discovery, T1105 - Ingress Tool Transfer, T1113 - Screen Capture, T1119 - Automated Collection, T1140 - Deobfuscate/Decode Files or Information, T1210 - Exploitation of Remote Services, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1480 - Execution Guardrails, T1553 - Subvert Trust Controls, T1566 - Phishing, T1568 - Dynamic Resolution, T1583.005 - Botnet, T1583 - Acquire Infrastructure, T1590 - Gather Victim Network Information, TA0011 - Command and Control

  • Tags: aaaa, accept, accept encoding, acceptencoding, address, a domains, adversaries, alerts, analysis date, apache, as197540, as46606, asn as24940, asnone related, av detections, azerbaijan asn, backdoor, blog von, body, cdn.calltrk.com, certificate, chrome, ck id, ck matrix, classinfobase, click, cnlocalhost, command, cycbot, date, dclocal, ddos, default, defender, defense evasion, delete c, dennis schrder, dennis schroder, destination, directui, dns query, dns resolutions, dnssec, document, domain, domain add, dynamicloader, dyndns domain, element, emails, encrypt, entries, et smtp, explorer, filehash, files, file score, files ip, file v2, forbidden, format, for privacy, found, gecko, general, germany asn, germany unknown, getclassinfoptr, gmt cache, gmt content, gmt etag, guard, hello2malware, helloworld, high, host, hostname, hostname add, hstr, https domain, hybrid, ids detections, iemobile, iframe, informative, insert, install, ip address, ipv4 add, japan unknown, khtml, killer gecko, learn, less, level domain, local, malware, medium, message, meta, mirai, mitre att, moved, movie, msie, ms windows, mtb nov, mtb oct, named pipe, name servers, name tactics, newexternalport, newinternalport, newprotocol, newremotehost, next associated, nids, ok accept, passive dns, path, pdf library, pe32, port, pragma, present, present jun, present nov, present sep, prox, ransom, record value, redacted for, related pulses, reverse dns, script domains, script urls, servers, sgpauiclassinfo, site top, smartassembly, steals, strings, suspicious, tls sni, total, trojan, trojandropper, twitter, type indicator, united, united kingdom, unknown, url analysis, url http, url https, urls, verdict, whitelisted, win64, windows nt, write, write c, xserver, xxx adult, yara detections, yara rule

  • JARM: 29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158dd

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_emd

Malware Detected on Host

Count: 43 3c23876a5a84ccdaf0b88a74fffeacc4f4084fe100f831d2c5fd8aeaf420d1bb b60a7beb70bf1bed49ac4a9539daa9db71aa1cc1c8c0012e10970e4f65c051f6 18db3c9ff4a4e4f62ae6747d9be66cda8826132637bcaee576a4416e0d33cb96 89d695f6bc1e2026ecec36b22e95272f79ee3a5d22d70d1f3468a9f3af57d7cd 15cddfc7f9d951da409d8c176200b4b181922a551565f033da3e66d7c63e00de 96d1712ecac82d42694507db3317940913ebe93285c26cf1f5f8818f365ed9b2 d9c53f3f6d110a9321b3113d31963ba2563cfadd14c5c4becab602c85affed3d 919ccfa399f0b60f9b0680b0325b3415ab7ef4a357765c305756d56017b1ea9b 74a19a12a8d5ec89f985cc23b0f93daa91fb1ac4cb1daafac2fafc68c1b4d852 7ad4324ea241782ea859af12094f89f9a182236542627e95b6416c8fb9757c59

Open Ports Detected

110 143 2077 2082 2083 2086 2087 2096 21 22 2222 26 3306 443 465 53 5432 587 80 993 995

CVEs Detected

CVE-2007-2768 CVE-2008-3844 CVE-2016-20012 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2020-14145 CVE-2020-15778 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408 CVE-2023-48795 CVE-2023-51385 CVE-2023-51767 CVE-2024-6387 CVE-2025-26465 CVE-2025-32728 CVE-2025-67896

Map

Whois Information

  • NetRange: 173.254.0.0 - 173.254.127.255
  • CIDR: 173.254.0.0/17
  • NetName: UNIFIEDLAYER-NETWORK-8
  • NetHandle: NET-173-254-0-0-1
  • Parent: NET173 (NET-173-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS:
  • Organization: Unified Layer (BLUEH-2)
  • RegDate: 2010-10-05
  • Updated: 2025-10-16
  • Comment: OCITOKEN::173.254.56.0/21:d4854c3f4e2050536e592439214736116a4ab54079a0955645ac348630c7dca9
  • Comment: OCITOKEN::173.254.28.0/22:9d203eac04ebe3ca5350737178c818379abbc15d815bc02b7fb11ffc28f49e5d
  • Comment: OCITOKEN::173.254.4.0/22:f9f809672caf1c35fe3e8af9e641433febac3b4d688663dfb48a2248f5d30532
  • Comment: OCITOKEN::173.254.72.0/21:fa1d47243795b47d1d91b39e74cec66e49dc3d3d5eaf95cc2af87978b0bab93d
  • Comment: OCITOKEN::173.254.48.0/21:9ca683395719d271736ea3d9a47e92142416db48efc479df2ff4b76dd7f519ba
  • Comment: OCITOKEN::173.254.24.0/22:4fb12f4a2e450297dd948113127983e6dc785d31f8fb990fc309b096bb3c849c
  • Comment: OCITOKEN::173.254.80.0/21:a0d6a88acc86ce0a3577e86ab7604a419b6c484e03c15d3a15985c31df79452a
  • Comment: OCITOKEN::173.254.96.0/21:00bd665667c224d443e4ecbd8f7852f8fb78e35560eb0c570e32474b325e9986
  • Comment: OCITOKEN::173.254.120.0/21:7be425aabf1961868aebf13f80e42ea550fec848c1b74f9074afe7ddbf6b2896
  • Comment: OCITOKEN::173.254.40.0/21:9c8eae7499ba8b4579ad0b4485fe84cf047ae55b3225398dbbd78db2d9571360
  • Comment: OCITOKEN::173.254.112.0/21:54046d2ef3ab20786820263f74f3b7f31e06e2d7e2fa6644fccbd1a7a6bd8b15
  • Ref: https://rdap.arin.net/registry/ip/173.254.0.0
  • OrgName: Unified Layer
  • OrgId: BLUEH-2
  • Address: 1958 South 950 East
  • City: Provo
  • StateProv: UT
  • PostalCode: 84606
  • Country: US
  • RegDate: 2006-08-08
  • Updated: 2025-07-24
  • Ref: https://rdap.arin.net/registry/entity/BLUEH-2
  • OrgAbuseHandle: NOC2320-ARIN
  • OrgAbuseName: Network Operations Center
  • OrgAbusePhone: +1-801-765-9400
  • OrgAbuseEmail: abuse@bluehost.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/NOC2320-ARIN
  • OrgTechHandle: ENO74-ARIN
  • OrgTechName: EIG Network Operations
  • OrgTechPhone: +1-877-659-6181
  • OrgTechEmail: eig-net-team@endurance.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/ENO74-ARIN
  • OrgNOCHandle: ENO74-ARIN
  • OrgNOCName: EIG Network Operations
  • OrgNOCPhone: +1-877-659-6181
  • OrgNOCEmail: eig-net-team@endurance.com
  • OrgNOCRef: https://rdap.arin.net/registry/entity/ENO74-ARIN
  • OrgAbuseHandle: EIGAB1-ARIN
  • OrgAbuseName: EIG-Abuse Mitigation
  • OrgAbusePhone: +1-877-659-6181
  • OrgAbuseEmail: IARPOC@Newfold.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/EIGAB1-ARIN
  • RNOCHandle: TECHN497-ARIN
  • RNOCName: Technical Operations
  • RNOCPhone: +1-801-765-9400
  • RNOCEmail: support@bluehost.com
  • RNOCRef: https://rdap.arin.net/registry/entity/TECHN497-ARIN
  • RTechHandle: NETWO2081-ARIN
  • RTechName: Network Operations
  • RTechPhone: +1-801-765-9400
  • RTechEmail: netops@bluehost.com
  • RTechRef: https://rdap.arin.net/registry/entity/NETWO2081-ARIN
  • RAbuseHandle: EIGAB1-ARIN
  • RAbuseName: EIG-Abuse Mitigation
  • RAbusePhone: +1-877-659-6181
  • RAbuseEmail: IARPOC@Newfold.com
  • RAbuseRef: https://rdap.arin.net/registry/entity/EIGAB1-ARIN

Links to attack logs

****** ****** ******

Share on: