2.1.0.4 Threat Intelligence and Host Information

Apr 05, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 2.1.0.4 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 75/100

Host and Network Information

Mitre ATT&CK IDs: T1007 - System Service Discovery, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1040 - Network Sniffing, T1055 - Process Injection, T1057 - Process Discovery, T1106 - Native API, T1112 - Modify Registry, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1566 - Phishing, T1598 - Phishing for Information
Tags: 443 ma2592000, aaaa, address first, a div, a domains, ads into, a li, all scoreblue, all search, android, a nxdomain, apple, apple id, applei_imessage_ios, apple ios, apple message, as13414 twitter, as142403 yisu, as19679 dropbox, as20940, as2914 ntt, as32934, as3356 level, as4134 chinanet, as4837 china, asnone china, asnone united, body, calls, center hr, certificate, checking, china as4837, china asn, china unknown, chrome, cname, collections, contacted, copy, country unknown, create c, cybercrime, date, default, discovery, div div, dns replication, dns resolutions, dnssec, dns show, dock, domain, email, encrypt, entries, execution, expiration date, facebook, file, files, files copied, files deleted, files location, form, for privacy, get http, get na, gmt content, hacktool, head body, hichina, highlighted, hostname, http, https, icloud_apple_id, infrastructure, ingestion time, injection, invalid url, invoked methods, ip address, ip traffic, ipv4, ipwnderv1, isadmin, javascript, javascript http, kos, latest version, location china, media center, medium, meta, mobile, moved, msie, name servers, net technology, neural netw, next, number, open, otx scoreblue, passive dns, password, pe resource, persistence, phishing, please, please enter, popularity, post http, pragma, problems, process, process32nextw, p span, pulse submit, pyinstaller, query type, read c, record type, redacted for, referrer, reflection, registrar, regsetvalueexw, related nids, request, rwi dtools, scan endpoints, script script, script urls, search, seen asn, seen last, self, server, server ca, servers, shell commands, shellexecuteexw, show, showing, slcc2, span a, status, status hostname, suspicious, sxe0x0cx1cxf8, td tr, telephony, threat network, thumbprint, title, tmobile, trident, tsara brashears, type name, ul div, umbrella, united, unknown, url analysis, url http, urls, utc cisco, utc statvoo, valid from, walmart, win32, win32 exe, window, windows nt, wow64, write, write c, written, xebrbxeax1ezxf0, yara detections, yuming, za z0
View other sources: Spamhaus VirusTotal
Contained within other IP sets: b3b0, bitcoin_blockchain_info_1d, bitcoin_blockchain_info_30d, bitcoin_blockchain_info_7d, bitcoin_nodes_1d, bitcoin_nodes_30d, bitcoin_nodes_7d, bitcoin_nodes, blocklist_de, blocklist_de_ssh, blocklist_net_ua, botscout_1d, botscout_30d, botscout_7d, bruteforceblocker, ciarmy, cleanmx_phishing, cleanmx_viruses, cleantalk_30d, cleantalk_7d, cleantalk_new_30d, cleantalk_new_7d, cleantalk_updated_30d, cleantalk_updated_7d, cobaltstrike, cruzit_web_attacks, cta_cryptowall, cybercrime, dm_tor, esentire_dorttlokolrt_com, esentire_downs1_ru, esentire_getarohirodrons_com, esentire_maddox1_ru, esentire_manning1_ru, et_tor, greensnow, haley_ssh, hphosts_ats, hphosts_emd, hphosts_fsa, hphosts_psh, lashback_ubl, nixspam, normshield_all_wannacry, normshield_high_wannacry, nullsecure, packetmail, packetmail_ramnode, php_spammers_30d, proxylists_1d, proxylists_30d, proxylists_7d, proxylists, proxyspy_30d, proxyspy_7d, proxz_30d, sblam, socks_proxy_1d, socks_proxy_30d, socks_proxy_7d, sslproxies_1d, sslproxies_30d, sslproxies_7d, stopforumspam_180d, stopforumspam_1d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, stopforumspam, taichung, turris_greylist, yoyo_adservers

Country: France
Network:
Noticed: 5 times
Protocols Attacked: Anonymous Proxy
Countries Attacked: Brazil, Chile, China, Germany, Ireland, Singapore, Switzerland, United States of America

Map

Links to attack logs

Share on: