- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- IP address
- 104.249.10.240
- Version
- v4
- Country
- United Kingdom
- CIDR
- 104.249.10.0/24
- Network range
- 104.249.10.0-104.249.10.255
- ASN
- 214961
- AS owner
- Stellar Group SAS
- Organization
- ORG-SGS38-RIPE/Stellar Group SAS
- Open ports
- 80, 443
- Protocols
- http, https, tcp, tls
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Threat context
Classification includes family self-signed.
Analysis signals
OBSERVEDEngine detections6%
Relationship context9 visible
Threat classificationself-signed
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
4shown
33%
critical
elf
445468 bytes
communicates
Filename
0e547811_mips.elf.bin
Family
mirai
Type
trojan
File type
elf
MIME
application/x-elf
40%
critical
elf
303816 bytes
communicates
Filename
e1df9e90_5bb8qrh.exe.bin
Family
mirai
Type
trojan
File type
elf
MIME
application/x-elf
14%
critical
elf
174480 bytes
communicates
Filename
7797264b_mips.bin
Family
mirai
Type
trojan
File type
elf
MIME
application/x-elf
14%
critical
elf
142560 bytes
communicates
Filename
c3ec68c3_x86_64.bin
Family
mirai
Type
trojan
File type
elf
MIME
application/x-elf
Related URLs
URLs associated with this indicator.
5shown
0%
contains
HTTP status
200
Content length
298124
Content SHA256
0645f12b84d86eda6b12442b2be212959a4d965a3d3aaa24668ac948cedcdaac
First seen
2026-11-15T02:20:31Z
Last seen
2026-11-15T05:03:54Z
5%
low
contains
HTTP status
200
Content length
176008
Content SHA256
cb14ae6db4d157ee97c472efbd826819ebbb4ec8c504ef7e596269eb212fe15f
First seen
2026-11-15T02:32:54Z
Last seen
2026-11-15T05:03:51Z
0%
contains
HTTP status
200
Content length
142560
Content SHA256
c3ec68c3ae7bdc2a48e45d48e6f39c1c8029a944d7b0ee06aae6055ef9073041
First seen
2026-11-15T02:20:25Z
Last seen
2026-11-15T05:03:51Z
5%
low
contains
HTTP status
200
Content length
310312
Content SHA256
0d1822a42002f6dbe6b1f17e456ef316c58b47d0c477970850df400bcdecf6a1
First seen
2026-11-15T02:17:52Z
Last seen
2026-11-15T05:03:51Z
0%
contains
HTTP status
200
Content length
322592
Content SHA256
5415abfa039eb9ada217d62e7f5e22bece28d116069b93686b393c82e1719729
First seen
2026-11-15T02:09:08Z
Last seen
2026-11-15T05:03:51Z
Analysis details
Severity: lowself-signed
Freshness: Fresh · Last seen today.
- Detection rate
- 6%
- Family
- self-signed
- detection
- 6 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- IP address
- 104.249.10.240
- Version
- v4
- Country
- United Kingdom
- CIDR
- 104.249.10.0/24
- Network range
- 104.249.10.0-104.249.10.255
- ASN
- 214961
- AS owner
- Stellar Group SAS
- Organization
- ORG-SGS38-RIPE/Stellar Group SAS
- Open ports
- 80, 443
- Protocols
- http, https, tcp, tls
- First seen
- 2026-04-01T07:53:01Z
- Last seen
- 2026-11-15T12:34:06Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Threat context
Classification includes family self-signed.
Relationship context
9 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
10 timestamped observations are arranged from 2026-04-01 to 2026-11-15. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: family self-signed.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Network profile
summarySelected network intelligence summary.
- CIDR
- 104.249.10.0/24
- Network range
- 104.249.10.0-104.249.10.255
- ASN
- 214961
- AS owner
- Stellar Group SAS
- Organization
- ORG-SGS38-RIPE/Stellar Group SAS
- Country
- United Kingdom
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Service discovery1
- 1 service observations
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- drisneycdn.com
- Issuer
- drisneycdn.com