5.79.68.109 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 5.79.68.109 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 70/100

Host and Network Information

• Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1049 - System Network Connections Discovery, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1059 - Command and Scripting Interpreter, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1105 - Ingress Tool Transfer, T1106 - Native API, T1114 - Email Collection, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1518 - Software Discovery, T1546 - Event Triggered Execution, T1588 - Obtain Capabilities

• Tags: address, agent tesla, all octoseek, analyze, andromeda, any.run, api blog, ascii text, august, ave maria, banking, bluenoroff, body length, bundled, cfqirgdhj5, cfqirgdhj5 http, cfqirgdhj5 url, ck id, code, communicating, contact, contacted, contacted urls, cookie, copyright, core, cracked, danabot, dark power, dark web, data leak, december, de indicators, digital profile, dinkle threat, docs pricing, domains, dropped, europe, execution, exploit, factory, family, fareit, fareit bot, february, feeds ioc, file, file encryption, final url, first spotted, formbook, frankfurt, general, general full, germany, get h2, getprocaddress, gmbh version, gmt connection, gootkit, gopher, hallrender, hashes, headers, headers date, historical, historical ssl, hostnames, http, http response, hybrid, indicator, info, injection, iocs, ioc search, ip address, ipconfig, json data, july, kb body, landersystem, lazarus, localappdata, login, lolkek, main, makop, maltiverse, malware, maxage86400, mitre att, mkdir, name, netstant, new ioc, njrat, north america, obz4usfn0, obz4usfn0 http, obz4usfn0 url, passive dns, password, paste, path, pattern match, payloads, ping, play ransomware, pony, pony loader, pony malware, pony stealer, pony trojan, post, protocol h2, putty, ransomware, redline, redline stealer, referrer, relacionada, remote access, resolutions, reverse dns, sample, samples, scan endpoints, schstasks, screenshot, search live, security tls, serving ip, sfqh4dt74w0 url, sha256, show technique, siblings parent, siplog, software, spammer, ssl certificate, status code, stealer, teams api, temp, threat, threat analyzer, threat roundup, ukhdaauqaaaaaac, unicode text, unique, url https, urls, urls https, value, variables, vj87, warzone, whois record, whois ssl, whois whois, win64, windir

• View other sources: Spamhaus VirusTotal

• Contained within other IP sets: hphosts_ats, hphosts_emd, hphosts_fsa, hphosts_psh, hphosts_wrz

• Country: Netherlands
• Network: AS60781 leaseweb netherlands b.v.
• Noticed: 1 times
• Protcols Attacked: SSH
• Countries Attacked: United States of America
• Passive DNS Results: admin.marylandlaserweightloss.com listcralwer.com admin.dayforehcm.com goodsamcampingworldcardactivate.com dinsneyplus.com dev.expirianidworks.com sitemap.spicykitchen-marsh.co.uk aspirecreditcsrd.com train.dayforehcm.com www.firstcaliforniaphysicianpartners.com admin.myfaceboxers.com shop.expirianidworks.com ww3.hura.watch gum4k.com afterhourstavern.com greatislandtattoostudio.com developer.tradirie.com ww3.blooklet.com www.admin.oktaverify.com bcg.oktaverify.com store.dunkinrunonyou.com www.ww4.dunkinrunonyou.com webinar.marylandlaserweightloss.com levypharmacy.com myembarkvet.com expirianidworks.com www.mochiads.com vadneysundergroundplumbing.com setnamedicare.com midlancredit.com spicykitchen-marsh.co.uk waterlefegolf.com lourencocleaningservices.com myfaceboxers.com myferrillgas.com gimket.com rinalditruckrentals.com rabonico.com customersupportlinks.com experinidworks.com activarewisely.com allmovieforyou.co aetnaretireehealthaccess.net accesoriosegda.com anetamedicare.com alighmenthealthplan.com android4games.com assetcarelic.com athelicgreens.com aspirecredcard.com bluesealbuidlingsupply.com bonitadentaltx.com cactusjacksdoncaster.co.uk cellmaper.net comik.fun creativebeginningschristian.com cunninghamsflorist.co.uk deltekenterprises.com diningdealusa.com doubleboarranch.com espumahotelandrestaurants.com epicgzmes.com forbiddenknowledge.net haifamajic.com havant-tandoori.co.uk jasmineindianrestaurant.co.uk lnrdevice.com mecurycards.com motorhomes4u.com mobileusim.com motionpromedia.com neighborlysofware.com nflbrite.com noodlemagazin.com peqcock.com payalteonhealth.com partientnotebook.com patientportalaegislabs.com scoolcloud.co.uk signinatt.com staropolskakuchnia.com themicanopyinn.com tweetshopcaraudio.com visitparamountplus.com westshorebsth.com wisehotel.net ynccard.com robloxscam.com specialtyoptumrx.com marriottform.com aifreegames.com mandarinwoksandiego.com tendermeet.com squareburgersjobs.com burstoral.com activateapple.com bodjean.com citysurplushomecenter.com cvsmychart.com dofusports.com healthybenefitspkus.com homechec.com indpiresleep.com hungryroute.com localcouselingagency.com loca18training.com loveshriner.org moviejoys.net mygetpic.com myuhcmeducare.com naplescoinandjewelry.com odomyinfo.com paneraworkday.com pinkysmassage.co.uk promotions.claims quartsize.co.uk shareicloud.com semooutfitters.com slopeunblockedd.com springheadfunerals.co.uk toonmic.com trystlink.com warrentyonline.co.uk wwfhelp.org theessentialbuds.com sendfilestotv.com abbottbenefitscenter.com avav654.com triplexvape.com cartoonsofthe90s.com reversenumber.us ablackeeb.com bbc.football bbbt1.com bharathinfo.com pressedfur.com cbxfmarketplace.com dandansom.com genesi.tv inventionofmother.com pizzamaria.co printul.com rustykegtavern.com juliadominicanhairsalon.com jcpennysharethejoy.com macyswimeshop.com massagebae.com mixtules.com myequfax.com captial.one notexistsingdomain.com cnatravelconvention.com d9customerfirst.com everydaysapartysuperstore.com adventusmarketing.com toptoffice.us amazingquotes.co coloradocattery.com airforceemail.co annazoons.com allabouttheherbs.co.uk asallanent.com anonymousrgv.com andesexpedition.co.uk belinery.com animenonton.net anotherdogday.com apexaerialssouthern.co.uk annsummersonline.co.uk aperturesolutions.co.uk believecoaching.co.uk balarys.com aysamb.com barrychicha.com barzacondesa.com befabulousdaily.us brisbaneoutreachchurch.com bellagao.com berindaje.com birchleystewart.co.uk blackwatersolutions.co.uk blackpooltravel.co.uk bestfaresdeals.com chattrust.co.uk ccband.co.uk bloomcareltd.co.uk botanicany.com bitzeen.com bruciesmegabingo.com boora.co.uk bythtools.com brookdaleprinting.co.uk bookroomsdirect.co.uk bootcave.com freezedryeraccessories.com brutecases.com caledoniandeathwatchnetwork.co.uk cambriafarm.co.uk sillimotor.co cheapflicksonline.com chinhchem.com explpremiumaudit.com lemonaidehealth.com andreswineandcheese.com appliancerecyclersofidaho.com apprrtesting.com asiancuisineml.com balenceofnature.com blackmarketdocs.com duckincarwash.com fetlice.com healthlybenefitsplus.com hongkongchippy.co.uk ilinoisairteam.net immunetti.com ioshave.com littlesichuanrestaurant.co.uk masalabazaarhalalmeat.com myuhcmedicaire.com ownersonmobile.com puskarheatingandair.com protempworks.com recoverig.com robloxscrips.com school.shoes soldhealth.com theseaglasscafe.com tudorcarsblackpool.co.uk walloon-lake.com wewillrocknow.com wuxingbodyworkspa.com mytrustbenefits.com mynordicktrack.com bonifiedmasks.com avantiscredit.co.uk eagislabs.com daileyharvest.com dapayments.com edlemanfinancialengines.com fortntite.com franandcojewerly.com haruwatch.com insectframe.co.uk lillicloth.com lovesbenifits.com moddriod.com mikestonecard.com mycinchhomeservices.com myexperion.com mysunova.com mysvantcard.com mywilliamsburgdental.com newrezmyloancare.com oginject.com petcoapp.com playnumbots.com romapass.com thesushihouseventura.com trackingpb.com watchfrndlytv.com yesbackstage.com www.talktoslantfoods.com beijingpalacetakeaway.co.uk rosiestamales.com peacotv.com brightspringshealth.com chinesetakeawaybr.co.uk expedianidworks.com hdcutssalon.com healthtybenefitsplus.com heydudesusa.com mezcalanursery.com myrewardscardstatus.com ordermarkspizzeria.com plagarismdetector.net profeehost.com secretsofthephoenixslot.co.uk tmemags.com tonysitaliantakeaway.co.uk uslgtvlink.com yourstlcourts.org ynhhf.org ashtonprestigecars.co.uk aspirecreditcatd.com x.mochiads.com abdigateaccess.net livefeet.fun anuncionow.com airlines-flights.com ardisshow.com ascurgentcare.com experianworksid.com blue-chew.com caribbeancuisineaz.com carsofcharminster.co.uk centerhillbaptist.org databankmix.com frigidareapplianceparts.com echovcard.com enchantedfloristpetal.com enjoyablecafes.space finwistsolutions.com gefocenow.com hopeforourtime.com forynite.com forinite.com skipdagames.com harlemwinespirits.com ipayissues.com hockessinliquor.com inspirsleep.com joesrvs.com love2shopreward.co.uk majorieseduction.store naturalwellnesscenterllc.com metropolissalonspa.com myallsaverconnect.com mykellyjob.com myuhemedicare.com niclinic.co.uk onlineaccountfilling.com photos-px.co.uk peackcock.com sercankaradeniz.com pshychefashion.com securedspend.com teamstreamster.com thebakersbench.com woodsidemotorinn1.com vamanagedcare.com aspirecrefitcard.com app-tweak.net asianmassagebonitasprings.com fornite.download goldbuster.co.uk hinsense-usa.com kcwomensclinicgroup.com myhucmedicare.com onlyfane.com pirew.me psncard.me theusreviews.com bysf.run xreslover.com wwwaspirecreditcard.com z-lib.com cignahealthspringsotc.com lisaspreciouspuppies.com mandsandpeoplesystem.co.uk activelivessurvey.org.uk bynmellonim.com hackandliverygeneralstore.com lynbrookfivecornersfitness.com maidincookware.com myfamilymyflorida.com netspendallacess.com openjoinmyquiz.com obtius.com paperworkfedex.com phasemoon.com quickbookslonline.com roft.lol smerkonish.com soanx.com unbiest.co.uk zbloanadministration.com adtinstall.com berniespretzels.com dianafletes.com datrisubs-orders.com fornitw.com garcticphone.com gogettest.com hmomax.com insticart.com installturboxtax.com jerkmake.com kekema.net krogersmastercard.com asiaadvisortravel.com rusekaterina.com baykorans.com 7caitop.com noithatgomanhhung.com www.pumpcontrolwater.com www.alfabuilding-dz.com zenpureholding.com weonline88.com pumpcontrolwater.com ffyour-kikifw.com xoandongho.com puravidasbracelet.com cybernater.net www.abilityadvantagethehartford.com globaloperatortour.com noonootv.com maxdomen.club yalacdd.org cocosbeachclubcancun.com aarppremium.com accountintuit.com accessfmolhs.org amityvilleheartcenter.com airpod.pro charlestonswapmeetlv.com countylinecountrymercantile.com cyberbackgoundchecks.com desertautocenter.com desktopmessenger.co foxnatio.com expremiumaudit.com gppvined.com jogar.click marylandlaserweightloss.com mikeymarino21.com pjscoinserie.com sayyestohometest.org spirallbetty.com streams2watch.live sweetbitchwine.com swainfarmsoutfitting.com timberlineskishop.com trsrecoveryservice.com ufreegams.com uscreativecdn.com villageblooms.co.uk xrymka.com dancingfingermassage.online jenniekayne.com fulgentgenetic.com xforexsignalss.com uhretiree.com sfrontlinedoctors.org greatharwoodbathroomsandkitchens.co.uk tkennedychimneyservices.co.uk bayoaksonsiestakey.com examplemc.net davidmartinworld.com browardmotorsportcycling.com unsolvedcaseflies.com intergratedgenetics.com palmettostatearmroy.com myhartbenefits.com ospflowers.com petchipregistry.co.uk emissaccess.co.uk myinprsretirment.org mydutchess.com sexualhealthhub.co.uk akwedguide.com epicgamew.com linkversite.com westboroughpethospital.net epicgammes.com steamunblocked.net milesstoneapply.com dcanva.com honneywellhome.com shipmsd.com helloandroids.xyz truckdispatchlearn.com beijinggarden.co.uk epiccames.com pmomaturitycube.org wellcaew.com humanapromptpa.com valuefurniturewarehouse.org tintshopomaha.com woew.shop london-breastscreening.org livestreameast.com paramountnetwok.com rockstarrkennel.com wilsonsmeathouseinc.com kandcjewellers.co.uk eipicgames.com naturalcomfortfootweartoo.com beanery-washington.com itweakos.store walgreenseens.com forfnite.com elitekittenz.co.uk myisovled.com instappliances.com hoyerstreeservices.com americasfrontlinedrs.org apollogrouptv.com camviewmygeeni.com gravitysaving.com myquestcovid19.com cfnarrebatecenter.com inspiresleeo.com wiki-calender.com 2frumble.com acedemicworks.com onlineaviva.co.uk woolwichintermediaries.co.uk prestigesalvage.co.uk flemmingmethod.com fivenightsat-candys.com

Malware Detected on Host

Count: 438 b8cd02cf96d88e654803b947da0181eb0ddc2bc85c7ab86242126e03f2e36086 cfcf9fe463b3cea4bd7e3becda7541cdc6f777618e905a2fb359a964a3e48659 90a578a63dce86cabb5a1cbb6433f2dd44e5d95340fdd0e6586ad175ca176207 bc48e22c9d085ec5f317d30daa2a16314893e5edee50dc7789579a423a3cd6c5 87bfe05fdac72b059aa58c54c96c838a2f7efb0a7de4f4b8718e53362e069d23 6d49f028546e0e78b5364a57852b3a724b04a57748f997661d730cee3acc84ef 490f91e5403fafdc43211229b35acd7b85f0e1a3ad9416779aaec7053aff8d4b 7d033877ad959ee1549b4564e493cced1c9b85bfbcb645af5a57f2af7c5c3c6a 956a3871b4684848f2ff70e0e73cbce6c0cef0f43c07389b6cb20f01425804b6 dfc8a2180f8b7681b96c40b1b0676b038285ccf7b8de83abcfd61c7f88cd1c6e

Open Ports Detected

443 53 80 8080

Map

Whois Information

• inetnum: 5.79.64.0 - 5.79.127.255
• netname: NL-LEASEWEB-20120614
• country: NL
• org: ORG-OB3-RIPE
• admin-c: lswn1-RIPE
• tech-c: lswn1-RIPE
• status: ALLOCATED PA
• mnt-by: RIPE-NCC-HM-MNT
• mnt-by: LEASEWEB-NL-MNT
• mnt-lower: LEASEWEB-NL-MNT
• mnt-domains: LEASEWEB-NL-MNT
• mnt-routes: LEASEWEB-NL-MNT
• created: 2012-06-14T07:52:30Z
• last-modified: 2017-11-16T10:10:08Z
• organisation: ORG-OB3-RIPE
• org-name: LeaseWeb Netherlands B.V.
• country: NL
• org-type: LIR
• address: Postbus 93054
• address: 1090BB
• address: Amsterdam
• address: NETHERLANDS
• phone: +31203162880
• fax-no: +31203162890
• admin-c: lswn1-RIPE
• abuse-c: LWAD-RIPE
• mnt-ref: RIPE-NCC-HM-MNT
• mnt-ref: LEASEWEB-NL-MNT
• mnt-by: RIPE-NCC-HM-MNT
• mnt-by: LEASEWEB-NL-MNT
• created: 2004-04-17T11:42:05Z
• last-modified: 2020-12-16T12:49:01Z
• role: Leaseweb NL NOC
• address: Hessenbergweg 95, 1101 CX. Amsterdam
• admin-c: SPW1-RIPE
• nic-hdl: lswn1-RIPE
• mnt-by: LEASEWEB-NL-MNT
• created: 2017-11-16T10:05:00Z
• last-modified: 2022-07-05T12:59:36Z
• route: 5.79.64.0/18
• descr: LEASEWEB
• origin: AS60781
• mnt-by: LEASEWEB-NL-MNT
• created: 2014-03-10T12:46:38Z
• last-modified: 2015-09-30T23:00:01Z

Links to attack logs

****** ****** ******