204.13.164.118 - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned 204.13.164.118 and returned a unknown verdict (score 6). The page resolved to 204.13.164.118 on Riseup Networks in US. 1 domain and 1 IP were contacted. 3 malware samples communicate with this URL (Ulise, Konus). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://204.13.164.118/tor/server/fp/4abab61b3ae41addb4fa18daf4ff445f7cfa68b6 - Domain: 204.13.164.118 · IP: 204.13.164.118 · AS16652 · US
- HTTP status: 200 · text/plain
- Scan tier: fast · observed 2026-08-22 03:52:52 UTC
Malware communicating with this URL (3)
These samples were observed contacting or being served from 204.13.164.118. Each links to its full analysis.
- Ulise - contacted ·
650fea17d9b35bac50bffb51e47882dd· first seen 2026-08-22 - Konus - contacted ·
896b808f62304a15f51aa65536f94e80· first seen 2026-08-20 - Ulise - contacted ·
ecd9c5ba7f3ad3bca0be6a7ef4b64eb6· first seen 2026-08-20
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Served over plaintext HTTP
Contacted infrastructure
- 204.13.164.118 - AS16652 Riseup Networks (United States)
Observed indicators
- 204.13.164.118
- 204.13.164.118
- http://204.13.164.118/tor/server/fp/4abab61b3ae41addb4fa18daf4ff445f7cfa68b6
Other scans of 204.13.164.118 (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/b028707969d8ed84e6dea597a884f78aad471971 - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/f92126c01db0e00e2c46d512345dc3a3adbe95c2 - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/9cf906c179a29a1beb1e04dc201252d1bffece3d - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/9cf224ca8a67aa4eb4f1f4cf2dd8a8b216a399bc - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/9cd27f3cb8e44e1f54fa907b0d271b5a9d22f252 - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/d856977c28257ec70df937b2cb06e8ac98940613 - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/d856155f4a1dccb37a5ea5301eb78579ea26f756 - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/9cd27f3cb8e44e1f54fa907b0d271b5a9d22f252 - 23 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/832635ddb34b38270a3d5920c5d429bd9b0ecccf - 22 Aug 2026 - unknown ·
http://204.13.164.118/tor/server/fp/776542d611661d6fe3839fe2d7afb92a435c5d81
Questions about 204.13.164.118
- Is 204.13.164.118 safe?
- The scan of 204.13.164.118 on 22 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with 204.13.164.118?
- 3 analysed samples communicate with this URL, including Ulise, Konus.
- How was 204.13.164.118 checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of 204.13.164.118
Scanned on MalwareAnalyzer by Cyble · Open interactive scan