Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

KNOWN MALWARE — Redtail

What is this: Malware ip — Redtail.
Should you care: Yes — Redtail is known-malicious, attributed by name.
What to do: Block it.

INVESTIGATEMODERATE EVIDENCE COVERAGEDeterministic · stored evidence only

Infrastructure investigation

Malware delivery infrastructure requires investigation

The warehouse identifies this host as RedTail. It has 0 observed open ports, 0 reported CVE associations, and 120 weighted citations. Treat the classification as infrastructure evidence; it does not identify the current operator.

Infrastructure role

Malware delivery infrastructure

Indicator that identifies a malware distribution server (payload delivery)

Network owner

Unattributed network

Andorra

Internet exposure

0 ports · 0 products

Not checked by an exposure provider.

Known CVE associations

Shodan did not complete.

Corpus evidence

2 connectors · 120 citations

14 related infrastructure pivots by shared non-noise tags.

Observation window

2026-07-01 → 2026-09-05

First and last appearance in the local corpus, not global activity dates.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

2 findings

RedTail

MODERATE

Indicator that identifies a malware distribution server (payload delivery)

brute_force · 0 stored observations

The label characterizes observed infrastructure; it does not prove who currently controls the IP.

14 related infrastructure pivots

MODERATE

Related indicators share specific non-noise tags such as malware family, campaign marker, or infrastructure role.

Deterministic shared-tag comparison

Shared tags support investigation pivots, not common ownership or campaign attribution.

What remains unknown

No exposure provider completed, so open services and CVE associations are unknown.
The current network owner or autonomous system is not established in available metadata.
No completed reputation enrichment is available; provider silence is not an all-clear.
IP addresses can be reassigned or shared, so historical malicious use may not describe the current operator.

What this is

IP indicator: 45.148.10.119

related indicators · 14

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.