Forensia: Free Threat Intelligence Lookup

FORENSIA

Indicator investigation

warming up…

Resolving indicator evidenceacquiring

Loading verdict, provenance, relationships and sightings.

Opening Forensia workspaceacquiring

Loading the current evidence view. Navigation and account controls remain available.

Loading recent evidenceacquiring

Verdict

MENTIONED — 1 report, unverified

What is this: IP observed in Intel Report Ingest.
Should you care: Weak signal — mentioned in 1 report, not corroborated across feeds.
What to do: No action — weak signal.

INCOMPLETELIMITED EVIDENCE COVERAGEDeterministic · stored evidence only

Infrastructure investigation

Invalid address is not public internet infrastructure

Forensia has a warehouse observation, but exposure or network evidence is incomplete. Missing providers must not be interpreted as an all-clear.

Infrastructure role

Observed network host

Role derived only from stored classifications and tags.

Network owner

Unattributed network

Location unavailable

Internet exposure

0 ports · 0 products

Not checked by an exposure provider.

Known CVE associations

Shodan did not complete.

Corpus evidence

1 connectors · 1 citations

14 related infrastructure pivots by shared non-noise tags.

Observation window

2026-08-20 → 2026-08-20

First and last appearance in the local corpus, not global activity dates.

What the evidence supports

Findings stay bounded to named sources and observable infrastructure.

1 finding

14 related infrastructure pivots

MODERATE

Related indicators share specific non-noise tags such as malware family, campaign marker, or infrastructure role.

Deterministic shared-tag comparison

Shared tags support investigation pivots, not common ownership or campaign attribution.

What remains unknown

No exposure provider completed, so open services and CVE associations are unknown.
The current network owner or autonomous system is not established in available metadata.
No completed reputation enrichment is available; provider silence is not an all-clear.
IP addresses can be reassigned or shared, so historical malicious use may not describe the current operator.

What this is

IP indicator: 07:37:

Mentioned in The Hacker News research ingest

Threat detail

Exploitation status and malware-family attribution from stored fields.

exploitation: unknown

related indicators · 14 connectors · 1

Graph preview

Neighborhood topology. Open the graph for interactive pivots.

Open full investigation canvas →

Building relationship previewacquiring

Loading connected indicators, reports and entities.

Continue investigation

High-signal pivots without leaving the thread you started in search.

Related alerts, reports, and entities
Structured pivots from local graph context.
Open in graph
Full investigation canvas with neighbor expansion.