Internet-wide scanning behaviour, command-and-control indicator matches, Tor exit status and the services Shodan has observed on one IPv4 address.
Listed as a known command-and-control indicator (malware_download). This is not background noise — treat traffic to or from it as an incident lead.
Shodan has no record for this host. Its scanners saw nothing listening, or have not visited recently — that is not the same as nothing being exposed.
Scanning behaviour from the GreyNoise Community API. Indicators from abuse.ch Feodo, C2IntelFeeds, URLhaus and ThreatFox, mirrored nightly. Tor exit list from the Tor Project, refreshed every six hours. Open services from Shodan InternetDB, refreshed daily. We never connect to the address itself.