104.19.159.224 Threat Intelligence and Host Information

Jun 24, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.19.159.224 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 54/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1012 - Query Registry, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1089 - Disabling Security Tools, T1106 - Native API, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1133 - External Remote Services, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1428 - Exploit Enterprise Resources, T1485 - Data Destruction, T1564 - Hide Artifacts, T1566 - Phishing, T1573 - Encrypted Channel

  • Tags: 443 ma2592000, aaaa, accept, access, access ta0001, access ta0006, activity, activity mirai, address, address domain, a domains, adversaries, adware malware, ag alberto, ag ingo, air force, alerts, all quiet, all scoreblue, all search, analyzer paste, andariel, android, anomalous file, a nxdomain, apple, april, as12337 noris, as133618, as14061, as15169 google, as15598, as16276, as16552 tiggee, as16625 akamai, as174 cogent, as19024, as1921, as20940, as21342, as24940 hetzner, as29789, as32787 akamai, as32934, as35994 akamai, as397241, as40021 contabo, as44273 host, as45430, as47846, as49505, as51167 contabo, as62597 nsone, as63949 linode, as714 apple, as8068, as8075, as8560, as8972 host, as9009 m247, asn as15598, asnone dns, asnone germany, asnone related, asnone united, austria, av detections, avg clamav, backdoor, binbusybox, bios, bits, body, brazil, brian sabey, browsing, cachecontrol, cape, catalog tree, certificate, charter communications, checkin, china unknown, chrome, clickable urls, cname, cnapple public, cnc beacon, code, command, connection, contacted, content type, control ta0011, cookie, copy, copyright, cp bus, creates, creation date, cryp, cur cono, cve201717215, cyber folks, cyber warfare, czechia unknown, data redacted, date, date hash, date tue, ddos, default, defense evasion, delete, delete c, delete shadows, delphi, demonbot, denvecolorado, denver, denver colorado, detected m1, discovery e1082, div div, dns query, docguard, dock, domain, domain name, download, dynamicloader, e1203 data, e1564 hidden, echo request, ee edcje4j, ekyxe, emails, emails info, encrypt, entries, eofae, error, etpro malware, evasion ob0006, execution, expiration date, expires thu, exploit, exploitation, exploit none, externalport, fakedout threat, federation asn, filehash, files, file samples, files domain, files ip, file size, files location, files matching, file type, fin ivdo, flag united, format, for privacy, found, france unknown, gafgyt, germany, germany mail, germany unknown, gmt cache, gmt content, gmt contenttype, gmt setcookie, gmt vary, google safe, grum, guard, hash avast, hashes cape, helloworld, hichina, hide artifacts, high, high assurance, hitmen, holidaycheck ag, home network, honduras, hosting, hostmaster, hostname, http, http headers, http host, http request, huawei hg532, huawei remote, icmp traffic, ids detections, immobilien ag, impact ob0008, impact ta0040, inbound, indonesia, install, installcore, instrumentation, internalport, iocs, ios, ip address, ip check, ip country, ip traffic, ipv4, ireland, ireland unknown, issuing ca, javascript, june, kraupa, kryptikxp, kurt walther, labs pulses, licess, lnmp, lnmp a, location united, look, lredmond, m1, magic pdf, mail spammer, main, malware, malware traffic, malware worm, masquerade, media center, medium, memcommit, memory pattern, memreserve, meta, method status, mexico, miniigd upnp, mirai, mirai variant, mitm, mitre att, module load, moved, msdefender apr, msie, msms57295540, ms windows, mtb apr, mtb aug, name servers, networks, next, nids, nondns, nxdomain, ob0005 defense, odigicert inc, onelouder, onl our, open, otx scoreblue, overview ip, oxypumper, packing t1045, passive dns, pattern domains, payload hello, pdb path, pdf document, pdf execution, pe32, pedraz, pe resource, persistence, phy samo, .pl, please, poland, poland unknown, porn, pornhub.software, port, possible, post, powershell, process32nextw, project pi, pulse pulses, pulses, pulse submit, puma se, push, quantum fiber, ransom, read c, realtek sdk, record type, record value, recycle bin, redacted for, regbinary, regdword, registrar, regsetvalueexa, related nids, related pulses, resolverror, reverse dns, rpcs, rsa ca, rsa tls, russia as49505, sabey, sameorigin, samples, sandbox, scan endpoints, script domains, script urls, search, serce internetu, server, server ca, server error, servers, sha256, shell, show, showing, sinkhole cookie, slcc2, slovakia, soap command, spammer, spectrum, ssdeep, ssl certificate, status, stream, stwashington, subdomains, susp, suspicious, sweep, swipper, t1036, t1045, t1047, t1129, t1189 found, tcp syn, thailand, timo salzsieder, title, tofsee, tools, total, tptjsw, trid adobe, trojan, trojandropper, trojan features, trojanspy, tsara brashears, ttl value, tulach, type get, united, united kingdom, unknown, updated date, url analysis, url hostname, url http, urls, urls http, urls https, useragent, users, value snkz, vhash, vietnam, virtool, virus, virustotal, whitelisted, whitesky, whois, win32, win64, windows, windows nt, world, wow64, write, write c, wsasend, x cache, xe e, xport, yara detections, yara rule, yomi hunter, zenbox

  • JARM: 27d40d40d29d40d1dc27d40d27d40df2873da73201e55849c575b77c7df30a

  • View other sources: Spamhaus VirusTotal

  • Country:
  • Network:
  • Noticed: 2 times
  • Protocols Attacked: Anonymous Proxy
  • Countries Attacked: Australia, Belgium, Brazil, Chile, Germany, Guatemala, Hungary, Ireland, Japan, Kenya, Mexico, Morocco, Netherlands, Peru, Poland, Russian Federation, Singapore, Slovakia, Spain, Taiwan, United Kingdom of Great Britain and Northern Ireland, United States of America
  • Passive DNS Results: pp.webcompanion.com cdn.webcompanion.com partners.webcompanion.com webcompanion.com rt.webcompanion.com

Malware Detected on Host

Count: 29 73a9cb24de5574579581c876b7963b8c3211ebd8d5885e70ae186cca06ea82dc 95522d973ba3c36b71844d6306aa60b1e2cf2c207553330bc1bc23d2cbfcaf0b bb4963620bdc4c91cfc188398a6a0be5037dd432dd399c417ed3a4ddf680d2ab 663a90c9d22808f9e4111cdb6103a7ba4e6a6092279902a71a731e232fefba49 b1dea7130e62988c0faad3bb502944fc7b02141d1c12a3c37a38280f7910a370 e9041060641f660a99ab8cae451e2a29e7f6e26adabf554f5472119c01ea5757 88f1e4f819905a4d714e76fc1cafae72a079c417b1446aebbebab57c705b33c1 a9d60b76cdfc11c1da463fe8228a3e20b47f334f810ee7753b079e82851f1a18 084e1ca2f4aee95e3431e9c012caddfd3452957ff4850cfa1aa22de38f6190c2 84704ec436b508a126a21ba7e207b3aaa7e4673bd04751b1ca854d6f5648989c

Open Ports Detected

2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2025-06-23 anonymous-proxy-ip-list-2025-06-22

Share on: