204.11.58.39 Threat Intelligence and Host Information

Apr 17, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 204.11.58.39 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 80/100

Host and Network Information

  • Mitre ATT&CK IDs: T1005 - Data from Local System, T1010 - Application Window Discovery, T1021.001 - Remote Desktop Protocol, T1027 - Obfuscated Files or Information, T1055 - Process Injection, T1056.001 - Keylogging, T1057 - Process Discovery, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1105 - Ingress Tool Transfer, T1106 - Native API, T1110 - Brute Force, T1114 - Email Collection, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1218 - Signed Binary Proxy Execution, T1442 - Fake Developer Accounts, T1454 - Malicious SMS Message, T1518 - Software Discovery, T1546 - Event Triggered Execution, T1566 - Phishing, T1583.001 - Domains, T1583.005 - Botnet, T1583.006 - Web Services, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1591.002 - Business Relationships, T1600 - Weaken Encryption

  • Tags: all octoseek, analyzer, anydesk, apple, as15169 as16509, as19871 as22612, as9002, banking, bot, bot network, breadcrumbs, briannsabey breadcrumbs, business email compromise, c2, caas, ck id, cobalt strike, command_and_control, comspec, contacted, copy, core, cracked, create new, critical, cybercrime, cyber security, dangerous, domain, expiration, exploit, factory, filehashmd5, filehashsha1, filehashsha256, fraud, gpt analyzer, hackers, hacktool, hallrender, hijacker, hosting, hostname, identifying, installer, ioc, iocs, ipv4, lazarus, localappdata, malicious, mitre att, model, monitoring, networm, next, Nextray, no expiration, octoseek, open path, parked domains, parking payload, pattern match, payload, pcap, pdf report, phishing, powershell, pulse use, quasar rat, ransomware, referrer, renos, resolutions, scams, scan endpoints, ssh hijacking, T1622 - Debugger Evasion, teams, tracking, tsara brashears, typosquatting, url http, url https, usbank, webp, win64

  • JARM: 29d29d15d29d29d00042d42d0000009435214b849738c4ebab4534b5d158dd

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_emd, hphosts_fsa, hphosts_psh

Malware Detected on Host

Count: 11 f8d44d7880640da690ec310d1d562a37f0f63e45503d8eb8710f40dd062cf401 e43a9c8b661ab22c94254903d163f8923e4f8cfe1919d99c973715017ed428a6 917de3d72af9798430cb2287a3653d296351f885d91c6a76cf9d9a299b00967e 22b5a335c60ba26745ed636f92af204ef6ba6b02f53b8b7538e940b933f135c0 5d59b84c0f011840202362b48cda0ffc42f24945a4de761a2c7bd90744a3bedc 7f70eca58b7b5017eb530464700ddb7d1229805b13b30afb1489f512c1e58ae9 56156c5b658580571c626897cd0e5c5ec46583f6907ead2ef5d73ee76324f18e 9e5f987ad43b66c469e9fed02999cfb62feff01049b5f1ef33804918bead665c ee1b131f3c83d19f38167fa583281f36ab8a55613bdba28139b46017ba5211a9 c4ca022c937c7980b59bd83851a2fc29565df7d90c9c96670160f5ae1959aa10

Open Ports Detected

110 143 2082 2083 2086 2087 21 22 2222 26 3306 443 465 53 587 80 995

CVEs Detected

CVE-2007-2768 CVE-2008-3844 CVE-2016-20012 CVE-2017-15906 CVE-2018-15473 CVE-2018-15919 CVE-2018-20685 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2020-14145 CVE-2020-15778 CVE-2021-36368 CVE-2021-41617 CVE-2023-38408 CVE-2023-48795 CVE-2023-51385 CVE-2023-51767 CVE-2025-26465

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: