104.149.133.98 Threat Intelligence and Host Information

May 11, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.149.133.98 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 75/100

Host and Network Information

Mitre ATT&CK IDs: T1012 - Query Registry, T1018 - Remote System Discovery, T1027.002 - Software Packing, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1033 - System Owner/User Discovery, T1040 - Network Sniffing, T1043 - Commonly Used Port, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1055 - Process Injection, T1056 - Input Capture, T1057 - Process Discovery, T1059.002 - AppleScript, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1071 - Application Layer Protocol, T1094 - Custom Command and Control Protocol, T1105 - Ingress Tool Transfer, T1107 - File Deletion, T1112 - Modify Registry, T1129 - Shared Modules, T1132 - Data Encoding, T1140 - Deobfuscate/Decode Files or Information, T1176 - Browser Extensions, T1215 - Kernel Modules and Extensions, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1457 - Malicious Media Content, T1491 - Defacement, T1497 - Virtualization/Sandbox Evasion, T1563 - Remote Service Session Hijacking, T1583.005 - Botnet, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0009 - Collection, TA0011 - Command and Control, TA0034 - Impact, TA0040 - Impact
Tags: aaaa, activity dns, acurix networks, address, akamaias, alerts, algorithm, all octoseek, all search, amazonaes, analysis date, analyze, apple ios, apple phone, april, as133618, as133775 xiamen, as15169 google, as16625 akamai, as20940, as2914 ntt, as3257 gtt, as397240, as46606, as54113, as54990, as6185 apple, as62597 nsone, as62729, as6453 tata, as6461 zayo, as714 apple, as7843 charter, asnone, august, avast avg, av detections, awful, awsau, awsbah, backdoor, beijing baidu, ben c, bodis, body, body length, bouvet island, bq feb, brian sabey, bruteforce, capture, chaos, chrome, ck id, ck matrix, class, click, cloudflarenet, cname, cobalt strike, code, collection, com laude, command, command decode, communicating, compiler, contact, contacted, contacted urls, cookie, copy, core, create c, created, creation date, critical risk, cryp, crypto, csc corporate, cus cnr3, cyber criminal, cyber security, dark power, date, date hash, debug, december, default, delete c, digital ocean, digitaloceanasn, dns intel, dns replication, dns resolutions, dnssec, document, domain, domain http, domains, domains ii, downloadmr, dropped, egregor, email, email document, emails, emotet, encrypt, entries, etisalat misr, execution, expiration date, exploit domain, false, february, filehash, files, file type, final url, find, first, formbook, for privacy, found, gamehack, gecko, general, germany unknown, get response, gmt cache, gnu linker, goldfinder, goldmax, group, gvb gelimed, hacking tools, hacktool, hallrender, hashes, hashes hashes, headers, hidden cobra, high, highly targeted, historical ssl, host interaction, hostname, hostnames, http, http method, http requests, http response, hunting macro, hybrid, icedid, icmp traffic, icons library, ids detections, info header, injection, installer, intel, intellectual property theft, internal, ioc, iocs, ip address, ips collection, ip traffic, ipv4, ireland unknown, it consultant, j490s6lkpppw, january, jpeg, june, kb body, key algorithm, key identifier, key info, khtml, kimsuky, kit exploit, lfqprnkje8dni0, link library, local, location united, lookup wannacry, lowfi, low software, ltd dba, mailrubar, malicious, malicious file transfers, malware, malware beacon, malware dns, malware hosting, march, maui ransomware, mb super, media center, memory, memory pattern, memory scanning, meta, metro, mirai, mitre att, mitre attack, moved, mozilla, msie, ms windows, ms word, mtb may, mtb showing, mutex, namecheap, namecheap inc, name md5, name server, name servers, nanocore rat, network, network hijacks, next, Nextray, njrat, none related, number, nxdomain, observed dns, october, olet, open, optimizer, os2 executable, otx octoseek, overlay, owner exploit, packing t1045, parent domain, passive dns, paste, pattern, pattern domains, pattern urls, pdb path, pe32, pe32 linker, pe section, phishing, playgame, play ransomware, powershell, precondition, premium, privacy, privacy service, probe, problems, psexec, pt mora, pty ltd, pulse pulses, pulse submit, push, qakbot, qbot, query, ransom, ransomexx, ransomware, read c, record type, record value, redline stealer, referrer, region create, region update, registrant name, registrar abuse, regsetvalueexa, related pulses, request, resolutions, rostpay, roundup, r processes, sabey type, sality, samplepath, samples, scan endpoints, scheme, search, self, september, server, servers, service, serving ip, sha256, shell code, shell commands, show, showing, siblings, sibot, sip, skynet, slcc2, snatch, source file, ssl certificate, startpage, status, status code, strings, subject public, submitters, summary iocs, suricata ipv4, susp, suspicious, suspicous ip, tags none, target, targeting, technical city, threat, threat analyzer, threat network, threat roundup, threats, tracker, tree, trojan, trojanclicker, tsara brashears, ttl value, tulach, twitter, type name, uk collection, united, united kingdom, univjos, unknown, unlocker, url analysis, url http, url https, urls, urlshortner dec, urlshortner sep, urls http, urls https, urls url, ursnif, utc submissions, v3 serial, virtool, vultr, webtoolbar, whitelisted, whois file, whois lookup, whois record, whois sslcert, whois whois, win16 ne, win32, win32 dynamic, win32mydoom feb, win32pcmega jan, win32upatre may, win64, windows nt, withheld, worm, write, write c, xor ddos, xorddos, yara detections, youth
View other sources: Spamhaus VirusTotal
Contained within other IP sets: stopforumspam_180d, stopforumspam_30d, stopforumspam_365d, stopforumspam_7d, stopforumspam_90d, stopforumspam

Country: United States
Network:
Noticed: 50 times
Protocols Attacked: sip
Countries Attacked: Australia, Bahrain, Canada, Czechia, Denmark, Estonia, France, Germany, Latvia, Lithuania, Norway, Poland, Romania, Turkey, Ukraine, United Kingdom, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: kj.xity.vip api2.prevola.io mainnet.funcoin.io server201.hostingduty.com

Map

Whois Information

NetRange: 104.149.0.0 - 104.149.255.255
CIDR: 104.149.0.0/16
NetName: AMAZO-4
NetHandle: NET-104-149-0-0-1
Parent: NET104 (NET-104-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Amazon.com, Inc. (AMAZO-4)
RegDate: 2023-12-06
Updated: 2023-12-06
Ref: https://rdap.arin.net/registry/ip/104.149.0.0
OrgName: Amazon.com, Inc.
OrgId: AMAZO-4
Address: Amazon Web Services, Inc.
Address: P.O. Box 81226
City: Seattle
StateProv: WA
PostalCode: 98108-1226
Country: US
RegDate: 2005-09-29
Updated: 2022-09-30
Comment: For details of this service please see
Comment: http://ec2.amazonaws.com
Ref: https://rdap.arin.net/registry/entity/AMAZO-4
OrgNOCHandle: AANO1-ARIN
OrgNOCName: Amazon AWS Network Operations
OrgNOCPhone: +1-206-555-0000
OrgNOCEmail: amzn-noc-contact@amazon.com
OrgNOCRef: https://rdap.arin.net/registry/entity/AANO1-ARIN
OrgTechHandle: ANO24-ARIN
OrgTechName: Amazon EC2 Network Operations
OrgTechPhone: +1-206-555-0000
OrgTechEmail: amzn-noc-contact@amazon.com
OrgTechRef: https://rdap.arin.net/registry/entity/ANO24-ARIN
OrgRoutingHandle: ARMP-ARIN
OrgRoutingName: AWS RPKI Management POC
OrgRoutingPhone: +1-206-555-0000
OrgRoutingEmail: aws-rpki-routing-poc@amazon.com
OrgRoutingRef: https://rdap.arin.net/registry/entity/ARMP-ARIN
OrgAbuseHandle: AEA8-ARIN
OrgAbuseName: Amazon EC2 Abuse
OrgAbusePhone: +1-206-555-0000
OrgAbuseEmail: trustandsafety@support.aws.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/AEA8-ARIN
OrgRoutingHandle: IPROU3-ARIN
OrgRoutingName: IP Routing
OrgRoutingPhone: +1-206-555-0000
OrgRoutingEmail: aws-routing-poc@amazon.com
OrgRoutingRef: https://rdap.arin.net/registry/entity/IPROU3-ARIN

Links to attack logs

Share on: