RDAPNetwork 197879 (179.184.0.0/14), BR; TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao.
- Org
- TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao
- Range
- 179.184.0.0/14
- Country
- BR
- Network
- 197879
Verdict
MALICIOUSHigh confidence
2Supporting signals
2Independent sources
2Recent observations
92 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- ABUSEIPDB_HIGH_CONFIDENCE AbuseIPDB abuse confidence score is 75% or higher.
- VT_MODERATE_DETECTION_RATIO 10-29% of VirusTotal vendors flag the indicator.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 179.185.18.67
- ASN
- AS18881
- Holder
- AS18881 - TELEFONICA BRASIL S.A
- Country
- Brazil (BR)
- Network
- 197879
- Prefix
- 179.185.16.0/22
- ISP
- TELEFÔNICA BRASIL S.A
- Usage
- Fixed Line ISP
- Open ports
- 22, 23
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-24 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 AbuseIPDB | 100% abuse confidence from 318 reporters, newest today; brute-force, email spam, SSH. | 100% | 0 days recent | Strong |
 VirusTotal | 9/89 vendors (10.1%) flag it: moderate multi-vendor detection, well short of a majority. | 9/89 | 4 days recent | Moderate |
| RDAP | Network 197879 (179.184.0.0/14), BR; TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao. | — | — | Context |
 RIPEstat | Announced in 179.185.16.0/22 by AS18881 (AS18881 - TELEFONICA BRASIL S.A). | — | — | Context |
 Shodan | Open ports 22, 23, 46 CVEs listed. | — | — | Context |
 AlienVault OTX | Referenced in 50 community pulses, which are unverified. | — | — | Neutral |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list · failed: GreyNoise
Analyst summary
Consistent with engineMalicious, high confidence. 100% abuse confidence from 318 reporters, newest today; brute-force, email spam, SSH. Independent sources corroborate it.
Why the evidence points to malicious
- [AbuseIPDB] 100% abuse confidence from 318 reporters, newest today; brute-force, email spam, SSH.
- [VirusTotal] 9/89 vendors (10.1%) flag it: moderate multi-vendor detection, well short of a majority.
Lookups failed for GreyNoise: no information either way.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
All evidence
12 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| AbuseIPDB | 100% abuse confidence from 318 reporters, newest today; brute-force, email spam, SSH. | 100% | 0 days recent | Strong |
| VirusTotal | 9/89 vendors (10.1%) flag it: moderate multi-vendor detection, well short of a majority. | 9/89 | 4 days recent | Moderate |
| RDAP | Network 197879 (179.184.0.0/14), BR; TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao. | — | — | Context |
| RIPEstat | Announced in 179.185.16.0/22 by AS18881 (AS18881 - TELEFONICA BRASIL S.A). | — | — | Context |
| Shodan | Open ports 22, 23, 46 CVEs listed. | — | — | Context |
| AlienVault OTX | Referenced in 50 community pulses, which are unverified. | — | — | Neutral |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- ABUSEIPDB_HIGH_CONFIDENCEAbuseIPDB abuse confidence score is 75% or higher.
- VT_MODERATE_DETECTION_RATIO10-29% of VirusTotal vendors flag the indicator.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- MULTIPLE_CORROBORATING_SOURCESTwo or more independent source families agree.
Analyst summary
Consistent with engineMalicious, high confidence. 100% abuse confidence from 318 reporters, newest today; brute-force, email spam, SSH. Independent sources corroborate it.
Why the evidence points to malicious
- [AbuseIPDB] 100% abuse confidence from 318 reporters, newest today; brute-force, email spam, SSH.
- [VirusTotal] 9/89 vendors (10.1%) flag it: moderate multi-vendor detection, well short of a majority.
Lookups failed for GreyNoise: no information either way.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 179.185.18.67
- ASN
- AS18881
- Holder
- AS18881 - TELEFONICA BRASIL S.A
- Country
- Brazil (BR)
- Network
- 197879
- Prefix
- 179.185.16.0/22
- ISP
- TELEFÔNICA BRASIL S.A
- Usage
- Fixed Line ISP
- Open ports
- 22, 23
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-24 (0 days before)
By source
RDAPRIPEstatAnnounced in 179.185.16.0/22 by AS18881 (AS18881 - TELEFONICA BRASIL S.A).
- ASN
- 18881
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNot collected for this investigation. Re-run to add it.
Evidence timeline
- 2026-09-20VirusTotal: 9/89 vendors (10.1%) flag it: moderate multi-vendor detection, well short of a majority
- 2026-09-24AbuseIPDB: 100% abuse confidence from 318 reporters, newest today
- 2026-09-24Investigated
Run history
2 collections of this indicator- 2026-09-26MALICIOUS82Live lookupsOpen · newest
- 2026-09-24MALICIOUS92Live lookupsShown
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 179.185.18.67 in the last 30 days.
- pivotPassive DNS: domains that resolved to 179.185.18.67.
- blockBlock 179.185.18.67 at the perimeter.
- enrichCheck other addresses in 179.185.16.0/22 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).