204.44.192.79 Threat Intelligence and Host Information

Apr 17, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 204.44.192.79 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 54/100

Host and Network Information

  • Mitre ATT&CK IDs: T1010 - Application Window Discovery, T1012 - Query Registry, T1018 - Remote System Discovery, T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1057 - Process Discovery, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1068 - Exploitation for Privilege Escalation, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1095 - Non-Application Layer Protocol, T1098 - Account Manipulation, T1105 - Ingress Tool Transfer, T1112 - Modify Registry, T1125 - Video Capture, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1158 - Hidden Files and Directories, T1210 - Exploitation of Remote Services, T1414 - Capture Clipboard Data, T1428 - Exploit Enterprise Resources, T1490 - Inhibit System Recovery, T1497 - Virtualization/Sandbox Evasion, T1510 - Clipboard Modification, T1512 - Capture Camera, T1518 - Software Discovery, T1529 - System Shutdown/Reboot, T1562 - Impair Defenses, T1564 - Hide Artifacts, T1566 - Phishing, T1571 - Non-Standard Port, T1573 - Encrypted Channel, T1574 - Hijack Execution Flow, T1583.005 - Botnet, T1614 - System Location Discovery, TA0011 - Command and Control

  • Tags: 1 upx1, aaaa, accept, accept encoding, access denied, active, active file, activity, added active, address, address virtual, admin, a domains, age2592000 path, aitm, alerts, alf features, algorithm, a li, all scoreblue, apache, as13768 aptum, as15169 google, as16625 akamai, as20940, as21499 host, as2914 ntt, as29873, as31898 oracle, as3257 gtt, as35994 akamai, as396982 google, as397240, as397241, as4230 claro, as44273 host, as45102 alibaba, as47748 daticum, as62597 nsone, as8068, as8075, asn as8068, asnone bulgaria, asnone canada, asnone germany, august, authentihash, author avatar, av detections, aws, aws botnet, b59bn timestamp, b715, binary, body, body length, botnet, brendan coates, brian sabey, bruter cnc, cab null, ca issuers, calls, canada, canada unknown, cape, certificate, checkin, china, click, cname, code, commerce cloud, compiler, config, contacted, contact phone, content, contentlength, content type, copy, create c, created, createdate, creation date, c request, critical, currently, cus lsan, cyber attack, daley, data, data redacted, date, date hash, december, default, delete c, delphi, denver, denver co, detections file, discovery, div div, div li, dnssec, domain, downloads, dynamic, eastman kodak, easyshare, email, emails, encrypt, entries, et malware, evasion ta0005, execution, expiration date, explorer, false, fcolorffffff, february, filehash, filehashmd5, filehashsha1, filehashsha256, files, file samples, files domain, file size, files location, files matching, file type, final url, flag united, format, france, generic, germany, get http, ghostscript, gmt etag, gmt max, gmtn, gmt server, gobrut, gobrut malware, gtmkj5bfwx, guloader, hackers, hallrender, headers, high, hijack, historical ssl, hong kong, hosting, hostname, hostpapa, html, html info, http, http performs, http response, https, icmp traffic, idlinea8 sep, ids, imphash, im unaware, information, info sections, inhibit system, injection, install, intel, invalid url, ip address, ipv4, ja3s, kb body, kodak, kodak easyshare, kukacka, langchinese, level 3, lhangzhou, link, linux x8664, li ul, local, location united, log id, magic pe32, malware, malware c, malware config, markmonitor, may sleep, md5 chi2, md5 process, media center, medium, meta, meta http, meta tags, microsoft color, mitm, mitre att, moved, mozilla, msft, msie, ms windows, mtb dec, name, namecheap, name file, name servers, name type, name virtual, net1, next, november, ns nxdomain, number, nxdomain, oalibaba, object, october, odigicert inc, oglobalsign, oracle, overview ip, packer, passive dns, path, pecompact, persistence, photolan, please, pnpd5d, post http, pragma, pre crime, quantum fiber, quantumfiber, quantumfiber.com, rdds service, read c, record, record value, ref b, referrer, regbinary, regdword, registrant, registrar, registrar abuse, registrar iana, registrar url, registrar whois, regsetvalueexa, regsetvalueexw, regsz, related nids, related pulses, related tags, report spam, research group, rich pe, role title, round, rsdsr7siwwd d, sales, salitiy, sample, sandbox evasion, scan endpoints, script domains, search, server, server ca, servers, service, serving ip, set cookie, sha256, show, showing, singapore, sitegg, size entropy, size raw, slcc2, soa nxdomain, spotify artists, sqlite, sqlite version, ssdeep, ssh attacker, status, status code, stzhejiang, subject, suricata, susp, sysinternals, t1010, t1012, t1027, t1036 creates, t1055, t1057, t1059, t1497, tag manager, tags, target tsara brashears, tech contact, tech id, text, threat roundup, timestamp, tlsv1, tls web, tracker, trackers google, traditional, trent wiltshire, trid upx, trojan, trojan features, twitter, ubuntu, united, united kingdom, unix, unix malware, unknown, upx0, upx2, upx software, url http, url https, urls, utc facebook, utc gtm5z5w687v, utc gtmp4hkt96, utc na, vhash, virtool, virus, vt graph, wed may, west domains, whitelisted ip, win16 ne, win32, win32 exe, windows, windows nt, worm, wow64, write, write c, xa10629, xo544, xport, yara detections, zenbox

  • JARM: 15d3fd16d29d29d00042d43d0000009ec686233a4398bea334ba5e62e34a01

  • View other sources: Spamhaus VirusTotal

Open Ports Detected

2077 2080 2082 21 26 443 465 587 80 993 995

Map

Whois Information

Links to attack logs

****** ****** ******

Share on: