Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

KNOWN MALWARE — Mirai

What is this: Malware ip — Mirai.
Should you care: Yes — Mirai is known-malicious, attributed by name.
What to do: Block it.

INVESTIGATEMODERATE EVIDENCE COVERAGEDeterministic · stored evidence only

Infrastructure investigation

Mirai command-and-control infrastructure

The warehouse identifies this host as Mirai. It has 0 observed open ports, 0 reported CVE associations, and 39 weighted citations. Treat the classification as infrastructure evidence; it does not identify the current operator.

Infrastructure role

Command-and-control infrastructure

Indicator that identifies a botnet command&control server (C&C)

Network owner

Unattributed network

France

Internet exposure

0 ports · 0 products

Not checked by an exposure provider.

Known CVE associations

Shodan did not complete.

Corpus evidence

4 connectors · 39 citations

14 related infrastructure pivots by shared non-noise tags.

Observation window

2026-07-07 → 2026-09-05

First and last appearance in the local corpus, not global activity dates.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

2 findings

Mirai

MODERATE

Indicator that identifies a botnet command&control server (C&C)

malicious_host · 0 stored observations

The label characterizes observed infrastructure; it does not prove who currently controls the IP.

14 related infrastructure pivots

MODERATE

Related indicators share specific non-noise tags such as malware family, campaign marker, or infrastructure role.

Deterministic shared-tag comparison

Shared tags support investigation pivots, not common ownership or campaign attribution.

What remains unknown

No exposure provider completed, so open services and CVE associations are unknown.
The current network owner or autonomous system is not established in available metadata.
No completed reputation enrichment is available; provider silence is not an all-clear.
IP addresses can be reassigned or shared, so historical malicious use may not describe the current operator.

What this is

IP indicator: 45.90.163.37

related indicators · 14

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.