104.16.19.94 Threat Intelligence and Host Information

Jun 24, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.16.19.94 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Known Malicious Host 🔴 100/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1005 - Data from Local System, T1011 - Exfiltration Over Other Network Medium, T1012 - Query Registry, T1018 - Remote System Discovery, T1027.002 - Software Packing, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1033 - System Owner/User Discovery, T1036 - Masquerading, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1043 - Commonly Used Port, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056.001 - Keylogging, T1056 - Input Capture, T1057 - Process Discovery, T1059.002 - AppleScript, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1070 - Indicator Removal on Host, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1094 - Custom Command and Control Protocol, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1105 - Ingress Tool Transfer, T1106 - Native API, T1107 - File Deletion, T1110.002 - Password Cracking, T1112 - Modify Registry, T1114 - Email Collection, T1119 - Automated Collection, T1129 - Shared Modules, T1132 - Data Encoding, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1158 - Hidden Files and Directories, T1176 - Browser Extensions, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1215 - Kernel Modules and Extensions, T1222 - File and Directory Permissions Modification, T1410 - Network Traffic Capture or Redirection, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1457 - Malicious Media Content, T1485 - Data Destruction, T1491 - Defacement, T1496 - Resource Hijacking, T1497 - Virtualization/Sandbox Evasion, T1498 - Network Denial of Service, T1518 - Software Discovery, T1543 - Create or Modify System Process, T1546 - Event Triggered Execution, T1547 - Boot or Logon Autostart Execution, T1552 - Unsecured Credentials, T1553 - Subvert Trust Controls, T1555 - Credentials from Password Stores, T1560 - Archive Collected Data, T1563 - Remote Service Session Hijacking, T1564 - Hide Artifacts, T1566 - Phishing, T1568 - Dynamic Resolution, T1569 - System Services, T1573 - Encrypted Channel, T1574 - Hijack Execution Flow, T1583.002 - DNS Server, T1583.005 - Botnet, T1583 - Acquire Infrastructure, T1588 - Obtain Capabilities, TA0001 - Initial Access, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0008 - Lateral Movement, TA0009 - Collection, TA0010 - Exfiltration, TA0011 - Command and Control, TA0034 - Impact, TA0037 - Command and Control, TA0040 - Impact

  • Tags: 0 report, 1618380672450, a9rica, aaaa, abuse contact, accept, access ta0001, access ta0006, a claim, active created, active related, activity dns, acurix networks, added active, address, adobe portable, a domains, adversaries, adware, aes128gcm, agent, agent tesla, agenttesla, aig, akamaias, akamaiasn1, alerts, alexa, alexa top, alf features, algorithm, all octoseek, all scoreblue, all search, amazon, amazon 02, amazon02, amazonaes, americachicago, american international, analysis, analysis date, analysis ob0001, analysis ob0002, analyze, analyzer paste, analyzer threat, and china, android, ansi, apache, apple, appleaustin, apple engineering, apple ios, apple notepad, apple phone, apple unlocker, Apple Zero Day, april, apt, a record, artemis, as133618, as133775 xiamen, as15169, as15169 google, as16509, as16625 akamai, as20940, as2914 ntt, as3257 gtt, as3359, as397240, as46606, as54113, as54990, as6185 apple, as62597 nsone, as62729, as6453 tata, as6461 zayo, as714 apple, as7843 charter, as8075, as852, ascii text, asn15169, asn16509, asn20940, asn as45090, asnone, asnone united, asyncrat, attack, august, australia, avast avg, av detections, awful, azorult, azure tls, b2931e3f, b467295d, b535, backdoor, bambernek, bank, banker, basic, b body, b document, beijing baidu, beijing gu, ben c, benjamin, best targets, betabot, bitdefender, bitrat, blackguard, blackhat, blacklist, blacklist http, blacklist https, blocklist, blustealer, bodis, body, body doctype, body length, boot, botnet, botnet campaign, bouvet island, bq feb, brent kimball, brian sabey, briansabey, browsing, bundled, c0014, c2, ca issuers, capture, cargo, catalog tree, centerchecks, cgb stgreater, chaos, china, china telecom, chinese, chrome, ciphersuite, cisco, cisco umbrella, ck id, ck matrix, class, classname, click, clickjacking, clipper dos, close, cloud, cloudflare, cloudflarenet, cname, cnc, cnc feodo, cnc server, cndigicert sha2, coalition et, cobalt strike, Cobalt Strike, code, collection, collections, com laude, command, command and control, command decode, commercial auto, communicating, community https, comodo rsa, comodo valkyrie, company limited, compensation, compiler, computer, comspec, connect azurepc, connection, contact, contacted, contacted circa 10.23.2023-, contacted urls, contact phone, contained, content reputation, contexthub, control ta0011, cookie, copy, copyright, core, country, country name, covid19, cq function, crack, crash, create, create c, created, create new, creation date, crime, critical, critical risk, cronup threat, crossrider, cryp, crypto, csc corporate, cuba, current dns, cus cnmicrosoft, cus cnr3, cyber, cyber attack, cyber crime, cybercrime, cyber criminal, cyber stalking, cyberstalking, cyber threat, cyberthreat, dan.com, dangeroussig, dao360, dapato, dark, dark consultants, darkgate, dark power, data, data center, datacrashpad, date, date hash, date mon, dded active, debug, december, ded active, default, defense, defense evasion, delete, delete c, de page, description, de summary, detection list, detections dns, detections none, detections type, detplock, devils work, digitaloceanasn, discovery, djvu, dll sideloading, dns, dns intel, dnspionage, dns records, dns replication, dns resolutions, dnssec, dock, document, document format, domain, domain http, domain name, domainpath name, domains, domains ii, domain status, dos com, dos exe, downer, downldr, download, downloader, downloadmr, dridex, drivertalent, dropped, dsp1, duckdns, dynamic report, e1082 impact, e1203 data, e1564 discovery, ecc domain, ecdhersa, ecdsa, ec oid, edge, egregor, elqq, email, email document, emails, emotet, emotet ip, encrypt, energy, engineering, enter, enterprise, entries, erase, ermac, error, et, etisalat misr, etpro malware, et tor, evader, evasion ob0006, evasion ta0005, evil, evil c, exe32, executable, execution, exit, expiration, expiration date, expires thu, expirestue, exploitation, exploit domain, export, f20b201c, facebook, factory, fakedout threat, falcon sandbox, false, fast web, february, feodo, file, filehash, filehashmd5, filehashsha1, filehashsha256, files, file samples, file score, files location, files matching, file type, filter https, final url, find, findwindowa, firehol, firehol et, first, flow t1574, font format, footer, form, formbook, for privacy, found, frame, frankfurt, fuery, fusioncore, gamehack, gamers, gecko, general, general full, generator, generic, generic windos, geoip, germany, germany unknown, get http, get na, getprocaddress, get response, ghost, github, gmbh version, gmt cache, gmt content, gmt ifnonematch, gmtn, gmt server, gnu linker, goldfinder, goldmax, google, google safe, gootloader, gopuram, greatness, group, gtmkvjvztk dl, guard, gui32, gvb gelimed, hacker, hackers, hacking tools, hacktool, hallgrand, hallrender, hashes, hashes hashes, header intel, headers, headers date, headers nel, heur, hidden cobra, hide artifacts, high, high level, highly targeted, high process, high security, hijacker, historical ssl, history, history first, history http, hitmen, host, hosting, host interaction, hostname, hostnames, hosts, hstr, html, html document, html info, html internet, http, http attacker, http method, httponly, http redirect, http requests, http response, hunting macro, hybrid, hyperv, iana id, icedid, icloud, icmp, icmp traffic, icons library, identifier, ids detections, iframe, ii llc, illegal, impact ta0040, indicator, indicator role, indonesia, industry_and_commerce, info, info compiler, info header, information, ingestion time, injection, injection t1055, input, installcore, installer, intel, intellectual property theft, internal, iocs, ioc search, ip address, ip check, ip detections, ips collection, ip summary, ip traffic, ipv4, ireland unknown, issuer, issuing ca, it consultant, j490s6lkpppw, january, javascript, jpeg, july, june, kb acrotray, kb body, kb document, keepaliveyes, key algorithm, key identifier, key info, keylogger, khtml, kimsuky, kit exploit, known tor, kraken, kuaizip, language, less, level3, lfqprnkje8dni0, liability, librouter, life, light, limited, link, linker, link library, linux x8664, lmenlo park, local, localappdata, location china, location united, lockbit, log id, login aig, login myaig, logon autostart, lolkek, look, lookup wannacry, lowfi, low software, lscottsdale, ltd dba, mac malware, magniber, mailrubar, mail spammer, main, malicious, malicious file transfers, malicious ids, malicious site, malicious url, maltiverse, malvertizing, malware, malware beacon, malware dns, malware hosting, malware scripting, malware site, malware spreader, malware type, manjusaka, march, mark, mark brian sabey, mark sabey, markus, masquerading, maui ransomware, maxage5184000, maxradlinklen50, mb iesettings, mb opera, mb super, media, media center, medium, memcommit, memory, memory pattern, memory scanning, meta, metasploit, meta tags, metro, metro hacker, mexico, microsoftcorpas, million, mime type, miner, mini, mirai, misc attack, mitre att, mitre attack, model, modified, modify system, module load, monitoring, mon jul, moved, mozilla, mr windows, ms excel, msie, ms visual, ms windows, ms word, mtb may, mtb showing, mtb yara, multiple botnetworks, murderers, mutex, mutexes nothing, my boy dan, name, namecheap, namecheap inc, name md5, name server, name servers, name value, name verdict, nanocore rat, nemucod, netgear router, netgear twitter, network, network capture, network hijacks, network mooooda, network rat, networks, networm, new ioc, next, njrat, no data, node tcp, node traffic, no entries, no expiration, none related, nothing, november, nr agent, nreum, number, nxdomain, ob0005 defense, ob0007 impact, ob0007 system, ob0012 file, ob0012 hide, observed dns, oc0006, oc0006 http, oc0008, october, odigicert inc, olet, ollydbg, ometa platforms, online, open, openioc, optimizer, os2 executable, otx octoseek, overlay, owner exploit, p11642963562, p2404, packing t1045, pagespcscpink2, page url, parent domain, passive dns, password, password bypass, paste, patch, path, pattern, pattern domains, pattern match, pattern urls, pcap, pcap processing, pcidump rasman, pdb path, pdf document, pdf report, pe32, pe32 compiler, pe32 linker, pe32 packer, persistence, pe section, phish, phishing, phishing site, phishtank, physical threat, plasma, playgame, play ransomware, please, pony, porkbun llc, pornhub, pornographers, port, post, post http, powershell, pragma, precondition, prefetch8, premium, presenoker, primary request, privacy, privacy service, probe, problems, processes tree, process oc0003, process t1543, products id, project, property, protocol h2, proton, proxy, psexec, pt mora, pty ltd, public url, pulse pulses, pulses, pulse submit, pulses url, push, qakbot, qbot, quasar, quasar rat, quasi, query, raccoon, rank value, ransom, ransomexx, ransomware, Ransomware, raspberry robin, read c, record type, record value, redirect chain, redirected, redline, redline stealer, redrum, referrer, referring, refresh, regbinary, regdword, region create, region update, registrant name, registrar abuse, registrar url, registrar whois, registry domain, registry expiry, registry keys, regsetvalueexa, related nids, related pulses, related tags, relayrouter, relic, remcos, remote, remote attacker, remote system, replacement, report, report domain, request, request chain, resolutions, resolved ips, resource, resource path, response, response final, restart, revenge rat, reverse dns, review, riskware, role title, root ca, rostpay, roundup, router login, r processes, runescape, runtime data, sabey type, safe site, sale, sality, sample, samplepath, samples, samuel tulach, sandbox, sanitize object, san jose, scan endpoints, scanning host, scheme, script, script urls, search, sector, secure s, security, security tls, self, september, server, server ca, servers, service, services, service tool, serving ip, setup, seznam, sha256, shell code, shell commands, shelltraywnd, show, showing, show technique, siblings, sibot, siendownloader, site, sites, size, skynet, slcc2, snanning_host, snatch, sneaky server, soc, social engineering, softcnapp, song culture, source file, span, spawns, spotify artist, spreadsheet, sqli dumper, ssl certificate, stalker, starizona, startpage, start service, status, status code, stcalifornia, stealer, steganography, stix, stop service, strings, subject key, subject public, submission, submit, submitters, sucurisec, summary, summary iocs, suppobox, suricata, suricata ipv4, susp, suspicious, suspicioussectioname, suspicous ip, swiftwill, swiftwill2, swisyn, system oc0001, systemroot, t1063, t1189 found, ta0004 defense, ta0004 process, ta0007 command, ta0009 command, tag count, tag manager, tags none, target, targeting, team, team malware, team phishing, teams, teams api, team top, technical city, technology, telecom, telecom italia, telefonica co, textarea, thebrotherssabey, then brothers sabey, thinclient, threat, threat analyzer, threat level, threat network, threat roundup, threats, threats et, title, title added, title error, tld count, tls sni, tlsv1, tls web, tmobile, t-mobile hacker, tofsee, tools, tor known, torrent trecker, tor role, tracker, tracking, traffic, tree, trickbot, trojan, trojanclicker, trojan.crypted, trojanspy, trust, tsara brashears, ttl value, tulach, tulach.cc, tulach exploits, twitter, type, type indicator, type mimetype, type name, uk collection, ukraine, umbrella rank, unauthorized, union, united, united kingdom, univjos, unknown, unlocker, unsafe, upatre, url analysis, url data, url history, url http, url https, urls, urlshortner dec, urlshortner sep, urls http, urls https, url summary, urls url, ursnif, usage, usd twitter, user, utc google, utc gtmsxrf, utc http, utc submissions, v3 serial, vadokrist, value, variables, verdict, verdict mobile, verified, verify, vidar, video streaming, view, virtool, visitor object, vmprotect, vs2003, vt graph, vxstream, waltham, WannaCry, web open, webtoolbar, white, whitelisted, whois, whois file, whois lookup, whois lookups, whois record, whois sslcert, whois whois, win16 ne, win32, win324shared, win32 dll, win32 dynamic, win32 exe, win32mediadrug, win32mydoom feb, win32pcmega jan, win32spigot, win32upatre may, win64, windows, windows nt, windows service, wininet c0005, wiper, withheld, workers, workers compensation, worm, wow64, write, write c, x509v3 key, x8bxe5, xor ddos, xorddos, xport, yara detections, yara rule, years ago, youth, zbot, zeus, zusy

  • View other sources: Spamhaus VirusTotal

  • Country:

  • Network:

  • Known APT: 28

  • Noticed: 41 times

  • Protocols Attacked: Anonymous Proxy

  • Countries Attacked: Anguilla, Aruba, Australia, Bahamas, Barbados, Canada, Cayman Islands, Costa Rica, Curaçao, Georgia, Guatemala, Japan, Lithuania, Mexico, Netherlands, Panama, Philippines, Poland, Saint Kitts and Nevis, Saint Martin (French part), Saint Vincent and the Grenadines, Sint Maarten (Dutch part), Tanzania United Republic of, Trinidad and Tobago, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America

  • Passive DNS Results: hlsw08.cn www.whyk.net pkckm3e.cn npjea.cn file.cxs.pw cookdeath.live riverwait.co worklength.us chris.taipei instantever.us tablecro.us vicly.org outway.biz varypart.biz vipuniversal.cf www.xn--tiqx99d.xn–kpry57d xn–tiqx99d.xn–kpry57d img.statically.io tim.gdmhost.ga tim.kiritossh.xyz cdn.imagesimple.co vivo-br.d23.host fontbit.io r.hearty.app c.roodo.com www.b.360kk.top d.nien.com reg.roodo.com friends.roodo.com www2.roodo.com static.roodo.com summer2010.blog.roodo.com reader.roodo.com members.roodo.com summer2008.blog.roodo.com file.roodo.com photos.roodo.com cgi.blog.roodo.com cloudflare.staticallydns.com im.vicly.org ip.hearty.app lionfree.net www.soasurs.com beta.hearty.me vivo.nerdsvpn.online khvs.3cyber.com cdn.3cyber.com 3cyber.com shop.3cyber.com ear-test.3cyber.com victorosx.3cyber.com mirror.3cyber.com mirror-cdn.3cyber.com jmssh.online www.mafengwo.com.tw www.shudo.com.tw www.0dian8.com cdn.chris.taipei nmrih.chris.taipei map.efoood.org frnci.nien.com shop.efoood.org cpanel.lonslai.com www.startupislandtaiwan.net www.startupislandtaiwan.org mail.xn–6m1a86p.com cpanel.xn–6m1a86p.com f.hearty.app box.youthwant.com.tw smtp.roodo.com rd.roodo.com sms.youthwant.com.tw mis.roodo.com live.youthwant.com.tw reader.youthwant.com.tw rcwestwood.blog.youthwant.com.tw boggy321.blog.youthwant.com.tw sengo.blog.youthwant.com.tw dc001352.blog.youthwant.com.tw yanpolly.blog.youthwant.com.tw sidiahmad.blog.youthwant.com.tw xuqofu.blog.youthwant.com.tw minatu.blog.youthwant.com.tw blinge301.blog.youthwant.com.tw fotovin.blog.youthwant.com.tw pure17go.youthwant.com.tw doctors.blog.youthwant.com.tw ywpr.blog.youthwant.com.tw superaaa.blog.youthwant.com.tw duck751111.blog.youthwant.com.tw www.starbugs.com.cn www.knews.com.tw www.pinpin.com.tw test.hearty.me cors.api.hearty.app popo.youthwant.com.tw love1.youthwant.com.tw ad.youthwant.com.tw board.youthwant.com.tw indonesia.obuy.tw my2.youthwant.com.tw d9c76515.youthwant.com.tw www.obuy.tw sh2.obuy.tw cancer.health.youthwant.com.tw myph.youthwant.com.tw sh1.obuy.tw funtime.youthwant.com.tw kids.youthwant.com.tw info.youthwant.com.tw gf.youthwant.com.tw mvsp.youthwant.com.tw enews.youthwant.com.tw health.youthwant.com.tw seal.youthwant.com.tw lottery.youthwant.com.tw clipick.iguang.tw meetgee.youthwant.com.tw rd.youthwant.com.tw jpbuy.iguang.tw campus.youthwant.com.tw sp2.youthwant.com.tw adv.roodo.com search.blog.roodo.com flog.youthwant.com.tw mv.youthwant.com.tw intranet.iguang.tw writer.youthwant.com.tw t.iguang.tw reg3.youthwant.com.tw moblog.roodo.com unboxing.youthwant.com.tw sp8.youthwant.com.tw nicegame.youthwant.com.tw wpl.youthwant.com.tw n.roodo.com magz.roodo.com sp3.youthwant.com.tw sp9.youthwant.com.tw statics.iguang.tw xmlrpc.blog.roodo.com pure17go.iguang.tw 88say.youthwant.com.tw jonescup.roodo.com sp1.youthwant.com.tw roodo.iguang.tw blogreader.youthwant.com.tw diy.youthwant.com.tw reg.youthwant.com.tw play.roodo.com cloudprint.youthwant.com.tw cdn.iguang.tw sp4.youthwant.com.tw reg2.youthwant.com.tw sp7.youthwant.com.tw s.hearty.app i.hearty.app lovetaipei.youthwant.com.tw s3.iguang.tw global.youthwant.com.tw guitarcup.blog.youthwant.com.tw sms.roodo.com cliip.roodo.com 17movie.youthwant.com.tw ironman.youthwant.com.tw sp.youthwant.com.tw ezsafe.youthwant.com.tw www.xn--detrkl13b9sbv53j.org www.nien.co www.hearty.me o.hearty.me adm.blog.roodo.com me.youthwant.com.tw go.jianyuan.art share.youthwant.com.tw go.hj.rs www.iguang.tw my.youthwant.com.tw evt.youthwant.com.tw member.roodo.com exam.youthwant.com.tw s.hearty.eu.org topic.youthwant.com.tw www.jiayi.life www.obuy.co www.youthwant.com www.youthwant.com.tw d.hearty.app www.alice.tw www.xn--6m1a86p.com blog.youthwant.com.tw blog.roodo.com sawallows.blog.youthwant.com.tw cf.cdn.aaronlam.xyz 7nc5dlvy2553c3uc46foi4xjinvybou2.c2gtb7i.1.0.ukhwibi7qimje53kbrnuugefiq.ivwssta.dns0.org www.roodo.com m.hearty.me hj.rs hearty.me cdnjs.cloudflare.com origin-south.zenfoliosite.com origin.zenfoliosite.com

Malware Detected on Host

Count: 11382 558344504d1942badf086ae58d0367b73650163b4a7b03ad5406182a2d844a01 ed089ba426f189d3d66981f369a1206668b7af27a038696369cfe5917c144b5e 0a0440bdaf3e815d9109e7ef7d2dd6aa582149f22a5cf714bc9434cebf764eda 2206dea2338e754f562c63db6b083ca69864099020d8fffcb9214f5db315b5d1 899fe1578685320145edaeb8e5b0808e8b5bcc232dce3d3fa3a7ea1ec3253a37 d6e406049579cbff97ab9e8d3debf3a5b2a4d2afeff84fae5d1b161e36797fc3 60502859c2e554868218392d737d93fc7cfe2eb8de37561ab085cf4e869c69a5 d1a35f74c0f0dc1e8450ef35612def9c0a118a16088e60f4dcbfadb5093b4fb4 d20b97f48b63914a8c03e56ba26b4043e2faae7024b77d060b66eee3e5097f54 321471985541dedd5410aa75a10bfe9256ece1b46eadd2dfc61ae41ee89c2bfc

Open Ports Detected

2052 2053 2082 2083 2086 2087 2095 2096 443 80 8080 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2025-06-23 anonymous-proxy-ip-list-2025-06-22

Share on: