IP address on record
ip, shown defanged for safety: 18 dot 116 dot 63 dot 61
Ownership assessment
Shared infrastructure.
Many unrelated parties use this address at the same time — hosting, a reverse proxy, a CDN edge. The link between it and the campaign is real, but it is weak: it records that campaign traffic passed through here, not that whoever operates it is involved.
Blocking
Treat this as a hunting lead rather than a block. A block at this level has a high chance of collateral damage against unrelated services.
Campaigns referencing this address
Where this came from
Reported by Unit 42, Palo Alto Networks on 2025-05-06
Lampion Is Back With ClickFix Lures
Recorded as ip, shown defanged for safety: 18 dot 116 dot 63 dot 61 · Command and control · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this address. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the address is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Use this to pivot rather than to block: look for other campaign infrastructure that shares it, and judge anything you find on its own evidence.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “18[.]116[.]63[.]61”, indicator ID 71b89d98-f8cf-4f71-8857-250a356f6dde, retrieved 2026-08-07.
https://clickfixreport.com/ips/18.116.63.61
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.