5.79.65.65 Threat Intelligence and Host Information

Aug 10, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 5.79.65.65 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 52/100

Host and Network Information

  • Mitre ATT&CK IDs: T1036 - Masquerading, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1082 - System Information Discovery, T1112 - Modify Registry, T1119 - Automated Collection, T1123 - Audio Capture, T1129 - Shared Modules, T1143 - Hidden Window

  • Tags: aaaa, abuse contact, address, a div, algorithm, alienvault name, all scoreblue, already, android, as15169 google, as16276, as43350 nforce, as44273 host, as55286, asnone bulgaria, august, authority, bazaarloader, behav, bios, body, certificate, class, cname, cngo daddy, code, contacted hosts, contact phone, cookie, copy, corrupt, created, creation date, crypter, cryptor, cuckoo, cus starizona, cyber, data, date, date hash, default, de indicators, delete c, div div, dns replication, dnssec, dock, domain, domain address, domain name, domains, domains ii, dynamic, dynamicloader, ebury, email, emails, endpoints all, enigmaprotector, entries, et tor, execution, exit, exit node, expiration date, filehash, filehashsha1, filehashsha256, file samples, files domain, files location, files matching, first, flag, flag united, formbook, for privacy, france unknown, fraud, g2 validity, hacktool, hashes, high, hostname, hstr, http, identifier, intel, ip address, ipv4, jsauto25 jun, key algorithm, key identifier, key info, known tor, link, lockbit, locky, lowfitrojan, malicious, malware, media center, meta, misc attack, modified, module load, months ago, msie, msms33388520, ms windows, name servers, next, n∅ ip, node traffic, number, overview ip, passive dns, path, pe32, persistence, pm lowfitrojan, pragma, process32nextw, process details, pulse pulses, ragnar locker, ransom, ransomware, read c, record type, redacted for, redcap, registrar abuse, registrar iana, related nids, related pulses, relayrouter, sales, scan endpoints, script script, script urls, search, september, server, servers, set cookie, shadowpad, show, showing, slcc2, span, span a, span span, status, subject key, subject public, suricata, suspicious, swipper, t1129, target, template, traffic group, trojan, trojan features, ttl value, twitter, unique, united, united kingdom, unknown, url http, urls, v3 serial, virustotal, white cve, whois lookups, win32, windows nt, wow64, write, write c, x509v3 key, xamzexpires300, xor ddos, xorddos, xrat, xtrat, yapaxi, yara detections, yaxpax, zp6axi0

  • View other sources: Spamhaus VirusTotal

  • Country: Netherlands
  • Network:
  • Noticed: 1 times
  • Protocols Attacked: SSH
  • Passive DNS Results: ns2.namedynamics.net ns2.brainydns.com 2833664808.cs-utilities.com 2833664808.cs-utility.com NS2.TACOMADC.COM

Malware Detected on Host

Count: 33 88d592c593337e71bb339ffc46b3c18c41eb2b8e9cbab16b59109e5ab41ed968 02a04b4a37a6432fb334ca339a24caaae3f658474370f102cc451c28eb507950 d333cbefa9aeb36f629e5c6cc78dbd94a7d8cea3acfa82d64566d4582d8d4d0d 00e8ce8a8f73dd04a5362046bdfed894000947eef72406576214dae643e99f68 c75f64499b0c329a4694c03e832eec033b6eaf9c7a7bb90899e1dbbc95e79f06 98fd82d50143588bfa01a7dc77b8dff01a7e117f62c6d17a4efdcce75495fea8 2365947b682389d2f810a650b207216feb6efce9dd2ff25490e314289d9af1ba 56ddf4038c9c42045b87f01700c8a9586dca7220cd6d739422f5cf800e390e1e cf48d89a96162c0b1fbe276b6cbd7d05b8dcf82ff7d02354a4f894eb93e0fbd0 ceec03758ad018a86fa4d944240f8819221a39ad10ed6579e421cd7eac14deae

Open Ports Detected

1022 443 53 80 8080

Map

Whois Information

  • inetnum: 5.79.64.0 - 5.79.127.255
  • netname: NL-LEASEWEB-20120614
  • country: NL
  • org: ORG-OB3-RIPE
  • admin-c: lswn1-RIPE
  • tech-c: lswn1-RIPE
  • status: ALLOCATED PA
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: LEASEWEB-NL-MNT
  • mnt-lower: LEASEWEB-NL-MNT
  • mnt-domains: LEASEWEB-NL-MNT
  • mnt-routes: LEASEWEB-NL-MNT
  • created: 2012-06-14T07:52:30Z
  • last-modified: 2017-11-16T10:10:08Z
  • organisation: ORG-OB3-RIPE
  • org-name: LeaseWeb Netherlands B.V.
  • country: NL
  • org-type: LIR
  • address: Postbus 93054
  • address: 1090BB
  • address: Amsterdam
  • address: NETHERLANDS
  • phone: +31203162880
  • fax-no: +31203162890
  • admin-c: lswn1-RIPE
  • abuse-c: LWAD-RIPE
  • mnt-ref: RIPE-NCC-HM-MNT
  • mnt-ref: LEASEWEB-NL-MNT
  • mnt-by: RIPE-NCC-HM-MNT
  • mnt-by: LEASEWEB-NL-MNT
  • created: 2004-04-17T11:42:05Z
  • last-modified: 2020-12-16T12:49:01Z
  • role: Leaseweb NL NOC
  • address: Hessenbergweg 95, 1101 CX. Amsterdam
  • admin-c: SPW1-RIPE
  • nic-hdl: lswn1-RIPE
  • mnt-by: LEASEWEB-NL-MNT
  • created: 2017-11-16T10:05:00Z
  • last-modified: 2022-07-05T12:59:36Z
  • route: 5.79.64.0/18
  • descr: LEASEWEB
  • origin: AS60781
  • mnt-by: LEASEWEB-NL-MNT
  • created: 2014-03-10T12:46:38Z
  • last-modified: 2015-09-30T23:00:01Z

Links to attack logs

****** ****** ******

Share on: