Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

MENTIONED — 3 reports, unverified

What is this: IP observed in Blocklist.De. This is a Tor exit node — traffic leaving it is anonymised.
Should you care: Reports against a Tor exit attribute to the exit, not to the person behind it — thousands of unrelated users share this address. Weak signal — mentioned in 3 reports, not corroborated across feeds.
What to do: No action — weak signal.

INVESTIGATEMODERATE EVIDENCE COVERAGEDeterministic · stored evidence only

Infrastructure investigation

Scanning or attack infrastructure requires investigation

The warehouse identifies this host as brute_force. It has 0 observed open ports, 0 reported CVE associations, and 1079 weighted citations. Treat the classification as infrastructure evidence; it does not identify the current operator.

Infrastructure role

Scanning or attack infrastructure

Role derived only from stored classifications and tags.

Network owner

Unattributed network

Netherlands (Kingdom of the)

Internet exposure

0 ports · 0 products

Not checked by an exposure provider.

Known CVE associations

Shodan did not complete.

Corpus evidence

3 connectors · 1079 citations

14 related infrastructure pivots by shared non-noise tags.

Observation window

2026-07-15 → 2026-09-05

First and last appearance in the local corpus, not global activity dates.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

2 findings

Scanning or attack infrastructure

MODERATE

Stored source metadata classifies this address as scanning or attack infrastructure.

brute_force · 0 stored observations

The label characterizes observed infrastructure; it does not prove who currently controls the IP.

14 related infrastructure pivots

MODERATE

Related indicators share specific non-noise tags such as malware family, campaign marker, or infrastructure role.

Deterministic shared-tag comparison

Shared tags support investigation pivots, not common ownership or campaign attribution.

What remains unknown

No exposure provider completed, so open services and CVE associations are unknown.
The current network owner or autonomous system is not established in available metadata.
No completed reputation enrichment is available; provider silence is not an all-clear.
IP addresses can be reassigned or shared, so historical malicious use may not describe the current operator.

What this is

IP indicator: 192.42.116.100

related indicators · 14

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.