Domain > icanhazip.com

More information on this domain is in AlienVault OTX

Is this malicious?

Most users have voted this as MALICIOUS

Reports

Files that talk to icanhazip.com

MD5	A/V
826286f4a4b4a488abb6ed83409a5097	[Trojan.Upatre] [Simda.TKP] [Trojan-Downloader.Win32.Upatre.mld] [PE:Malware.Obscure!1.9C59] [Troj/Wonton-RA] [Trojan.Upatre.702] [W32/Trojan3.PLD] [TR/Yarwi.A.831] [Trojan:Win32/Bulta!rfn] [Trojan/Win32.Upatre] [Downloader-FATU!826286F4A4B4] [W32/Kryptik.DHIG!tr] [Crypt4.ZYA]
e34d6d33f1196ad9539b92090688d160
64bbad8b24ce5e09dae19d7746963246
215da96e53b39699ff4152593eb872aa
f92d16302bb35016049c859af2e24c3c
12232cc38a9eb66b09548534e52d17a8
be6bd9a1d1f2936f3ccdb2eeba28e1c1
00fd29c9dcf57c78ee776b2b76fbf8d2
d429b11731898bc0226464a1382a71d7	[Troj/Dyreza-ET] [VirTool:Win32/Obfuscator.AMJ] [W32/Waski.KI!tr]
a42c3679f391c20238f24f8647fb7eff
95ac31c40a32a6a44f84a6b77dd76332	[Upatre-FAAR!95AC31C40A32] [Kryptik.CFCF] [Virus.Win32.Heur.c]
6289d7079d489e416fdc4633a6dc51c3
b2853010fa7ee2e6057d5c7e89ed4e60	[Trojan.Win32.A.Lydra.1623552[h]]
10dc90d9477b5fbd25d37eefd254570b
c5e4cbb5d1ec1ee5f28a1cdf5b8a92c9
bc7bb730e98fcde7044251784e0d8ceb	[Trojan-Downloader/W32.Upatre.35840.B] [TrojanDownloader.Upatre.r4] [Trojan.Upatre] [Win32.Malware!Drop] [Trojan/Downloader.Waski.a] [Trojan.Win32.Upatre.drhpcv] [Downloader.Upatre] [Kryptik.CLASS] [TROJ_UPATRE.DMI] [Trojan-Downloader.Win32.Upatre.ivy] [Win32.Trojan.Fakedoc.Auto] [Troj/Bredo-APK] [TrojWare.Win32.TrojanDownloader.Upatre.A] [Trojan.DownLoader13.9507] [Downloader-FASG!BC7BB730E98F] [TR/Yarwi.B.2] [Trojan[Downloader]/Win32.Upatre] [Trojan:Win32/Bagsu!rfn] [Trojan.Win32.S.Downloader.35840.AY[h]] [Trojan/Win32.Upatre] [Trojan.Win32.Waski.A] [Win32/TrojanDownloader.Waski.A] [Evilware.Outbreak] [W32/Waski.A!tr] [Win32.Outbreak]
6eb48ac6a562d6cf467e19409ed0b248
c36dc7ea9adf3312804d4f42c5296bf3
35d0d8c328cf1eddcd6b07c3a0ebc668
43bdb0c1d44d7976db44a5906871ebde	[Upatre-FACA!BC7BB730E98F] [Trojan.Upatre] [Downloader.Upatre] [Zip.Suspect.ExecutableFax-zippwd-1] [Trojan-Downloader.Win32.Upatre.ivy] [Trojan.Win32.S.Downloader.35840.AY[h]] [Win32.Trojan.Fakedoc.Auto] [Mal/BredoZp-B] [Trojan.DownLoader13.9507] [Win32.Malware!Drop] [TROJ_UPATRE.DMI] [TR/Yarwi.B.2] [Trojan[Downloader]/Win32.Upatre] [Trojan.Win32.Upatre.ivy] [Win32/TrojanDownloader.Waski.A] [Trojan-Downloader.Win32.Upatre] [W32/Waski.A!tr] [Trojan-Downloader:W32/Kavala.B] [Win32.Outbreak]

Whois

Property	Value
Email	C725CE904662444E8F24840674AF5768.PROTECT@WHOISGUARD.COM
NameServer	DNS2.STABLETRANSIT.COM
Created	2009-07-31 00:00:00
Changed	2014-07-01 00:00:00
Expires	2015-07-31 00:00:00
Registrar	ENOM, INC.

DNS Resolutions

Date	IP Address
0000-00-00	23.253.254.67 (ClassC)
0000-00-00	23.253.218.205 (ClassC)
2013-06-26	198.101.241.44 (ClassC)
2013-06-26	216.69.252.107 (ClassC)
2013-07-29	162.209.15.246 (ClassC)
2013-10-28	216.69.252.100 (ClassC)
2013-10-29	216.69.252.101 (ClassC)
2014-07-19	23.253.218.205 (ClassC)
2014-10-01	104.130.129.139 (ClassC)
2014-10-02	104.130.2.77 (ClassC)
2014-10-08	119.9.94.185 (ClassC)
2014-10-08	23.253.206.237 (ClassC)
2014-10-08	104.130.141.155 (ClassC)
2014-10-08	119.9.25.54 (ClassC)
2014-10-08	162.242.252.170 (ClassC)
2014-10-19	104.130.141.155 (ClassC)
2014-10-31	23.253.206.237 (ClassC)
2015-04-22	166.78.246.145 (ClassC)
2015-04-27	104.130.28.231 (ClassC)
2015-05-19	23.253.254.67 (ClassC)
2015-05-19	166.78.246.145 (ClassC)
2015-05-19	104.130.28.231 (ClassC)
2015-05-20	64.182.208.183 (ClassC)
2015-07-15	104.238.136.31 (ClassC)
2015-07-15	104.238.141.75 (ClassC)
2015-08-01	104.238.145.30 (ClassC)
2015-10-27	64.182.208.184 (ClassC)
2015-10-27	64.182.208.185 (ClassC)
2016-01-14	104.238.162.182 (ClassC)
2016-01-15	45.32.200.23 (ClassC)
2016-02-21	64.182.208.181 (ClassC)
2016-04-08	104.130.140.62 (ClassC)
2016-04-09	104.130.230.155 (ClassC)
2016-04-09	104.130.65.73 (ClassC)
2016-04-20	64.182.208.182 (ClassC)
2016-08-01	45.63.62.235 (ClassC)
2016-08-02	104.156.226.90 (ClassC)
2016-12-08	45.76.25.15 (ClassC)
2017-04-24	107.191.44.218 (ClassC)
2017-04-24	45.76.24.96 (ClassC)
2017-10-17	45.63.77.134 (ClassC)
2017-10-17	66.70.178.65 (ClassC)
2017-11-15	45.76.59.118 (ClassC)
2017-11-15	45.76.18.223 (ClassC)
2018-05-28	198.61.150.28 (ClassC)
2018-05-29	144.202.71.30 (ClassC)
2018-05-29	45.63.64.111 (ClassC)
2018-08-13	149.28.118.221 (ClassC)
2018-08-13	45.32.193.226 (ClassC)
2018-08-17	69.162.69.149 (ClassC)
2018-08-17	69.162.69.150 (ClassC)
2018-08-18	69.162.69.148 (ClassC)
2018-08-18	69.162.69.147 (ClassC)
2019-03-20	147.75.40.2 (ClassC)
2019-03-29	147.75.96.57 (ClassC)
2019-03-29	147.75.89.25 (ClassC)
2019-03-29	147.75.92.157 (ClassC)
2019-03-31	95.216.173.234 (ClassC)
2019-03-31	116.203.128.34 (ClassC)
2019-03-31	159.69.191.144 (ClassC)
2019-03-31	116.203.143.189 (ClassC)
2019-03-31	88.99.80.146 (ClassC)
2019-05-09	139.178.68.38 (ClassC)
2019-05-09	139.178.82.59 (ClassC)
2019-11-12	104.20.17.242 (ClassC)
2020-03-14	104.20.16.242 (ClassC)
2020-04-18	104.22.19.188 (ClassC)
2020-04-27	46.4.63.102 (ClassC)
2020-04-27	188.40.60.252 (ClassC)
2020-06-23	116.202.244.153 (ClassC)
2020-08-26	116.202.55.106 (ClassC)
2020-08-31	116.203.119.16 (ClassC)
2020-12-30	147.75.47.199 (ClassC)
2021-02-16	136.144.56.255 (ClassC)
2021-02-25	172.67.9.138 (ClassC)
2021-05-02	104.22.18.188 (ClassC)
2021-06-07	104.18.6.156 (ClassC)
2021-07-27	104.18.7.156 (ClassC)
2022-11-07	11.23.33.44 (ClassC)
2024-02-12	104.18.115.97 (ClassC)
2024-02-23	104.18.114.97 (ClassC)
2025-05-05	104.16.185.241 (ClassC)
2025-05-12	104.16.184.241 (ClassC)

Subdomains

Date	Domain	IP
4.icanhazip.com	2023-12-23	104.18.115.97
ipv4.icanhazip.com	2014-04-14	23.253.218.205
www.icanhazip.com	2024-01-16	104.18.114.97

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]