IP address on record
ip, shown defanged for safety: 115 dot 92 dot 4 dot 123
Ownership assessment
The owner of this site is a victim.
This is a real website belonging to a real person or business. Somebody broke into it and used it to serve part of a ClickFix campaign. The owner is not the attacker and, in most cases we see, had no idea it had happened. Read every dated observation on this page as a statement about what was on the server that day — not about who runs it.
Blocking
Do not block the address itself. That penalises its owner for someone else’s intrusion, and the injected content is usually removed within days. Block the specific URL if you must block anything.
If this is your site, tell us — we suppress or correct a listing on evidence, and we do not require a lawyer to be involved.
Campaigns referencing this address
Where this came from
Reported by Proofpoint on 2025-04-16
Around the World in 90 Days: State-Sponsored Actors Try ClickFix
Recorded as ip, shown defanged for safety: 115 dot 92 dot 4 dot 123 · Payload host · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this address. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the address is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Block at the narrowest scope you have — the reported URL, not the address — for the reason given above. If you saw traffic to it, treat the originating host as having reached content from a ClickFix campaign and work through the response steps for Windows or macOS.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “115[.]92[.]4[.]123”, indicator ID ddd8e741-c3d2-44d6-bc57-1d598cc5c454, retrieved 2026-08-07.
https://clickfixreport.com/ips/115.92.4.123
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.