RDAPNetwork 197879 (179.184.0.0/14), BR; TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao.
- Org
- TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao
- Range
- 179.184.0.0/14
- Country
- BR
- Network
- 197879
Verdict
MALICIOUSMedium confidence
2Supporting signals
2Independent sources
2Recent observations
82 / 100Threat score
Why the engine decided this
Deterministic engine · activity high- ABUSEIPDB_HIGH_CONFIDENCE AbuseIPDB abuse confidence score is 75% or higher.
- RECENT_MALICIOUS_ACTIVITY Strongest malicious evidence is 30 days old or less.
Key indicators
- IP address
- 179.185.18.67
- ASN
- AS18881
- Holder
- AS18881 - TELEFONICA BRASIL S.A
- Country
- Brazil (BR)
- Network
- 197879
- Prefix
- 179.185.16.0/22
- ISP
- TELEFÔNICA BRASIL S.A
- Usage
- Fixed Line ISP
- Open ports
- 22, 23
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-26 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 AbuseIPDB | 100% abuse confidence from 324 reporters, newest today; brute-force, email spam, SSH. | 100% | 0 days recent | Strong |
 VirusTotal | 9/91 vendors (9.9%) flag it: a low detection ratio. | 9/91 | 0 days recent | Suspicious |
| RDAP | Network 197879 (179.184.0.0/14), BR; TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao. | — | — | Context |
 RIPEstat | Announced in 179.185.16.0/22 by AS18881 (AS18881 - TELEFONICA BRASIL S.A). | — | — | Context |
 Shodan | Open ports 22, 23, 46 CVEs listed. | — | — | Context |
 AlienVault OTX | Referenced in 50 community pulses, which are unverified. | — | — | Neutral |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list · failed: GreyNoise
Analyst summary
Consistent with engineMalicious, medium confidence. 100% abuse confidence from 324 reporters, newest today; brute-force, email spam, SSH. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [AbuseIPDB] 100% abuse confidence from 324 reporters, newest today; brute-force, email spam, SSH.
- [VirusTotal] 9/91 vendors (9.9%) flag it: a low detection ratio.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
All evidence
12 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| AbuseIPDB | 100% abuse confidence from 324 reporters, newest today; brute-force, email spam, SSH. | 100% | 0 days recent | Strong |
| VirusTotal | 9/91 vendors (9.9%) flag it: a low detection ratio. | 9/91 | 0 days recent | Suspicious |
| RDAP | Network 197879 (179.184.0.0/14), BR; TELEFÔNICA BRASIL S.A, CSIRT TELEFONICA BR, GVT Operacao. | — | — | Context |
| RIPEstat | Announced in 179.185.16.0/22 by AS18881 (AS18881 - TELEFONICA BRASIL S.A). | — | — | Context |
| Shodan | Open ports 22, 23, 46 CVEs listed. | — | — | Context |
| AlienVault OTX | Referenced in 50 community pulses, which are unverified. | — | — | Neutral |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- ABUSEIPDB_HIGH_CONFIDENCEAbuseIPDB abuse confidence score is 75% or higher.
- RECENT_MALICIOUS_ACTIVITYStrongest malicious evidence is 30 days old or less.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineMalicious, medium confidence. 100% abuse confidence from 324 reporters, newest today; brute-force, email spam, SSH. It rests on one source family, so confidence is medium.
Why the evidence points to malicious
- [AbuseIPDB] 100% abuse confidence from 324 reporters, newest today; brute-force, email spam, SSH.
- [VirusTotal] 9/91 vendors (9.9%) flag it: a low detection ratio.
Lookups failed for GreyNoise: no information either way. Only one source family reports malicious activity.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 179.185.18.67
- ASN
- AS18881
- Holder
- AS18881 - TELEFONICA BRASIL S.A
- Country
- Brazil (BR)
- Network
- 197879
- Prefix
- 179.185.16.0/22
- ISP
- TELEFÔNICA BRASIL S.A
- Usage
- Fixed Line ISP
- Open ports
- 22, 23
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-26 (0 days before)
By source
RDAPRIPEstatAnnounced in 179.185.16.0/22 by AS18881 (AS18881 - TELEFONICA BRASIL S.A).
- ASN
- 18881
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context only- Automated ScannerThreat actor · AlienVault OTX · Direct
ATT&CK techniques reported
Evidence timeline
- 2026-09-26AbuseIPDB: 100% abuse confidence from 324 reporters, newest today
- 2026-09-26VirusTotal: 9/91 vendors (9.9%) flag it: a low detection ratio
- 2026-09-26Investigated
Run history
2 collections of this indicator- 2026-09-26MALICIOUS82Live lookupsShown
- 2026-09-24MALICIOUS92Live lookupsOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 179.185.18.67 in the last 30 days.
- pivotPassive DNS: domains that resolved to 179.185.18.67.
- blockBlock 179.185.18.67 at the perimeter.
- enrichCheck other addresses in 179.185.16.0/22 against threat feeds.
Pivot to other tools
Opens the indicator in the source's own site (new tab).