104.21.14.224 Threat Intelligence and Host Information

Jan 20, 2026 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.21.14.224 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 57/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003.008 - /etc/passwd and /etc/shadow, T1005 - Data from Local System, T1012 - Query Registry, T1018 - Remote System Discovery, T1027.002 - Software Packing, T1027 - Obfuscated Files or Information, T1029 - Scheduled Transfer, T1033 - System Owner/User Discovery, T1035 - Service Execution, T1043 - Commonly Used Port, T1056.001 - Keylogging, T1057 - Process Discovery, T1059.002 - AppleScript, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1065 - Uncommonly Used Port, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.002 - File Transfer Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1088 - Bypass User Account Control, T1094 - Custom Command and Control Protocol, T1095 - Non-Application Layer Protocol, T1105 - Ingress Tool Transfer, T1110.002 - Password Cracking, T1112 - Modify Registry, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1176 - Browser Extensions, T1179 - Hooking, T1183 - Image File Execution Options Injection, T1215 - Kernel Modules and Extensions, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1457 - Malicious Media Content, T1491 - Defacement, T1497 - Virtualization/Sandbox Evasion, T1583.005 - Botnet, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0009 - Collection, TA0011 - Command and Control

  • Tags: 443 ma2592000, aaaa, access, active threats, address, adload, a domains, adult content, adware, adwind, agency, agent, agent tesla, aig.com, aig.rastreator.mx, alerts, alexa, alexa top, all octoseek, all search, amadey, amazon02, amazonaes, analysis date, android, apple, apple ios, apple phone, apple private, april, artemis, artro, as13789, as14061, as15169 google, as16276, as16625 akamai, as206834 team, as20940, as22075, as2914 ntt, as3209 vodafone, as3257 gtt, as397240, as46606, as54113, as54990, as6185 apple, as61969 team, as62597 nsone, as62729, as63949 linode, as6453 tata, as6461 zayo, as714 apple, as7843 charter, as797 att, as8075, ascii text, asp.net, asyncrat, august, australia, author, available from, av detections, awful, azorult, backdoor, bandit stealer, bank, banker, bankerx, b body, bing ads, blacklist, blacklist https, body, body length, bot networks, bouvet island, brashears, brian, brian sabey, caddywiper, canada unknown, charles, chrome, cisco umbrella, citadel, ck id, ck matrix, class, cleaner, click, cloudflarenet, cname, cobalt strike, code, collections, com laude, communicating, compiler, conduit, conhost, contact, contacted, contacted urls, contact phone, contentencoding, content type, copy, copyright c, core, corp, covid19, cpm fun, cpm network, crack, created, creation date, critical, crypt, crypto, csc corporate, cyber crime, cyber criminal, cyberstalking, cyber threat, cyber warfare, cymulate, dark, data collection, date, date hash, date sat, december, decode, defence, defense, denied trackers, detection list, detections type, disability, djvu, dns, dnspionage, dns replication, dnssec, document, document file, domain, domains, domains domain, domains ii, domain status, downldr, download, downloader, dropped, dropper, dtamlb, dynadot, dynamicloader, elderly, email, emotet, encrypt, engineering, entries, error, etpro malware, exe32, execution, expiration date, expiressat, exploit, express, facebook, fakealert, february, filehash, filehashsha256, files, filetour, file type, final url, first, flubot, formbook, for privacy, found, france unknown, fraud, fraud services, fusioncore, gandcrab, gandcrab dns, gandi sas, general, generator, generic, generic malware, germany, germany unknown, getcursor getdc, gmt contenttype, gmt server, goldfinder, goldmax, gone, google, google safe, graph community, greatcall, gvb gelimed, hacktool, hallrender, hashes, hashes hashes, hasty hacker, head body, header intel, headers, headers date, headers nel, health phone, heur, highly targeted, historical ssl, home pg, hostname, hostnames, html info, http, http response, hybrid, ids detections, iframe, info, info compiler, installcore, installer, installing, intel, intellectual property theft, internet domain, iocs, ios, ip address, ip addresses, ip summary, ip sun, ipv4, ireland unknown, j490s6lkpppw, january, japan, javascript, jpeg, june, kb body, keylogger, killav, length, lfqprnkje8dni0, link library, list, lively, local, localappdata, location united, lockbit, logistics, lokibot, lolkek, lookup, ltd dba, m, macho restore, macintosh disk, main, malicious, malicious file transfers, malicious site, malvertizing, malware, malware site, malware stealer trojan evader, march, markmonitor, masquerade, maui ransomware, maxage31536000, maze, mb super, meta, meta name, metro, Miles IT, million, milton keynes, miner, mitre, mk14, modified, monitoring, month ago, months ago, moved, msclkidn, msie, ms visual, ms windows, ms word, name, namecheap inc, name md5, name server, name servers, name verdict, nanocore, network, new relic, next, nimda, nircmd, njrat, nokoyawa, noname057, none related, north wales, nr-data.net, nymaim, october, open, opencandy, optimizer, origin1, otx octoseek, packed, parent domain, passive dns, password, paste, patcher, path, pe32 compiler, pe32 executable, pe resource, phishing, phishing site, pornography, postal code, post root, powershell, prefetch1, prefetch8, premium, presenoker, privacy invasion, privacy tech, privateloader, privilege escalation, probe, problems, processes tree, products id, pulse pulses, pulse submit, qakbot, qbot, quasar, query, raccoon, ransom, ransomexx, ransomware, rebel ltd, record type, record value, redacted for, redirector, redline, redline stealer, referrer, registrant fax, registrar abuse, reimer, relacionada, related pulses, relic, remote attacks, report spam, resolutions, riskware, river.rocks, root ca, round, rsa sha256, runtime process, sabey, safebae, safe site, sality, sample, sample path, samplepath, samples, sat dec, sat jun, scan endpoints, scheme, script, search, self, september, seraph, server, servers, service, service bs, serving ip, sha1, sha256, shell code, shell commands, show, showing, show process, siblings, siblings domain, sibot, sides with, site, size, smlb, snatch, specialist, spyware, ssl certificate, startpage, status, status code, stealer, strings, submitters, summary, summary iocs, sun jan, suppobox, swisscom root, switch dns, swrort, t1140, tag manager, tags, tags none, target, targeting, team, temp, text, threat, threat network, threat report, threat roundup, tiggre, title, title access, title charles, tmobile metro, tofsee, tracker, tracking, trojan, trojanx, true defense, trust, tsara, tsara brashears, ttl value, tue nov, tulach, t whois, twitter, type, type data, type name, unicode text, united, united kingdom, unknown, unlocker, unruy, unsafe, upd4, url analysis, url collection, url http, url https, urls, urls http, urls https, url summary, urls url, ursnif, use collection, utc google, utc submissions, utmsourcemailer, v2 document, vawtrak, ver2, ver33, vidar, vids1, view charles, virtool, vs2013, vs2013 upd4, wacatac, webcompanion, web gateway, westlaw, whitelisted, whois record, whois whois, win16 ne, win32, win32 dynamic, win32 exe, win32mydoom feb, win32upatre jan, win64, windir, wiza meta, worm, write, writes a pe file header to disc, xamzexpires600, xrat, xtrat, yara detections, zpevdo

  • View other sources: Spamhaus VirusTotal

  • Country:
  • Network:
  • Noticed: 28 times
  • Protocols Attacked: SSH
  • Countries Attacked: Canada, United States of America
  • Passive DNS Results: masky.com.tr idolawede2.live leslis.fapianjigg.workers.dev mediamotion-ag.de softdealpoint.qpon primeadvan.live pitirpiti.click quietsatellite.site frankwu.dpdns.org www.0box15.top wqsljx.cn www.five88.lat kmwll.com movies2k.lol xhxm8888.com vayaworkforce.co wilitepy.pro flagman-casino-gold3.ru voteformaria.org 9356888.com xn–o80bo9mepcuwt8qfs6g.com www.pro-technique-chauffage.com www.1xbet-d3avb.buzz incrediblysekf.com tureeff.org stage.engenloop.com plinkogamestrikes.space eyrdhet-111.mjgyvf.workers.dev wyzkj.com thudile.rest thermalmanagementexpo.com kaleidoscopevacations.xyz jayatogelwdboost.online reluxaripylon.com mogacon.com getejn.com b610500.com e-zpassny.fessvgej.cc carnalteasehub.mom s3solutions.io bdkkozmetik.com.tr skistuffdepot.com blackinvestigaciones.com 135913.xyz plex.kyanvde.be www.brandpower.cc exojisi.info hokbetvictoryx.online gadsnpiao.cyou thoughtstreampress.lat www.rame4dreal.life hitclub.futbol 46p2.cn s887x9yjx76pz1p.xyz corgiland.lol atralinesa.com hang-da.cn nusantara222hoki.online nhsiphilippines.com www.nhsiphilippines.com drive.dl.yizhan.wiki markstein-publishing.de douban3.top download.referencely.online gameclickhivex.shop www.howedid.net tertiaryponder.cn theconciergecollective.com.au www.serialturkone.online pingforge.info figurefandom.com whitening-matsuno-shika.com trypestymarketing.com zenithorbit-hub.buzz mobiverywork.cc clickatip.co.uk atomics.icu demoazuroai.com ecentimedev.newsavour.com ecentimedev1.newsavour.com selimpasaxxbayan.xyz 7q6bwd.shop gododdscasino.uk www.aprende-facil.es 8p5pql.cfd yizhan.wiki kisskhtv.de onexbet-somalia.com promptss.wenturc.com prompts.wenturc.com prompt.wenturc.com ganaapuestasonline.com 55llz.com mansftul.top www.ev1jjex.cn www.paxolindra.com b2bapi-weber-test.winshop.cloud radarr.stuhrasferg.dk 1xbet-d3avb.buzz md4722.cc www.yaleprjov.xyz jpwcare.top appbombax.online www.booking.confirmation-id79527.com www.ceadooba.biz.id 0box15.top babage.net seal.ceadooba.biz.id gemini.fapianjigg.workers.dev con-ti-go.org sandwich.ceadooba.biz.id wellingtonfencebuilders.co.nz send.wellingtonfencebuilders.co.nz tarquanakaz.store tamarindiesw.shop docs.clenergyess.com www.sofabet2.com theabsentmindedprofessor.blog bread.ceadooba.biz.id five88.lat betriot2.gr www.betriot2.gr talisman.guru www.modezelle.fr www.experteamsolutions.com www.ferhatlaryurdu.com nylovau4.pro cloudflare.ddns.us au2point.dk tempocc.my ertr5jnhmj.gomusic.tk n8n.optimaze-ai.com saas-b2b.site alumetalec.com weeswelkomindesport.nl yoaa.top sjlxhj.cn lotussignalpro.digital tilranovex.click jackielee.cn www.ahjiushuzhipin.com ahjiushuzhipin.com boxathlon.net www.chickroads.org patternturboh-orizon.digital www.krepresentatives.store go.infinitywealthway.com brandpower.cc www.capitalpolskaplatform.com 92pixels.com laviniculture.com ibc588mulai.com elisacorreani.shop zhengxinkc.com the-garden-flat.com.es j88dota.com rocklanddigitalmore.com sports-bike.net luyuxi.dpdns.org subcentrezx.com h940.top howedid.net jlqtsg.com jamiehousden.com ip.jamiehousden.com idesignblog.com kosseaniw.com www.rajankundra.shop schedule-perfectsnacks.com saki89q.com xn–eetu14fslrvua.shop sum.posta.no netwin-casino.info easypurchasesm.com lerstrategicmarketing.com quiz24.online bubblypawsfranchising.com vetnpetdirects.com readbassegroup.com celeryparcelscissors.com primex.click lectroom.com amgwvip80.com slotgampangmenang88.online www.elisacorreani.shop paxolindra.com 8th.1e9.us naomiharrington.fuchsiaaudre.workers.dev hallegriffin.fuchsiaaudre.workers.dev rmnai.com betnano-girisi.org cfggoodson.cfd sixfd.fapianjigg.workers.dev yaleprjov.xyz giris-officialssll.vip fraga-ar3.com socialcore9zt1.com speed.kyanvde.be cld-conseilfiscal.com thegioivps.com 9ggt123.com cdn.commercestack.org dgcxx3.com sofabet2.com rusunklik.com aerialb.beer cdn.xsinficdn07.sa.com meetivp-analysis.co www.erynopi.com steep-sun-6a43.1m1mdowvnfbs7aezrdb.workers.dev surveyinitiative.it.com bahis-siteleri.co.uk yqph.net.cn bestchikenroad.com amirabbas.amirabbasu3efi802.workers.dev www.referencely.online capitalpolskaplatform.com hmth88.com www.mustika234.com 0oijhbg.gomusic.tk samimart.com gdssl.sfm735920.workers.dev wenhuamiankong.com oaklanthub.shop 222betone.com fileeasetax.com 58winag.com galactichaven.site www.popwelding.com ads8raja01.shop zthdwealth.com dryindustrialdue.pro krepresentatives.store chickroads.org chicken-road-game-de.life drayriaddons.com loadingdocksystem.com nourishhavenco.com proxyscraper.io visitvirtualjkv.com cysntv.buzz www.nutmegindiancafe.com www.pagamentodigitalvero.com.br www.zkbubbles.xyz zkbubbles.xyz glimvalor.com youtyre.com.ua kzatmprmworld.online weareleadzoom.live sunkissedrecipes.com nativehousing.org manfred-buchner.de slot666-pgslot.vip nbzmf.cyou vless088.top hellmannsonline.shop topikberita.com bitwarden.s3solutions.io www.spineandjoint.center emiratesinvest.com tk.fapianjigg.workers.dev www.delamandus.es onyxchicago.com www.onyxchicago.com parking-pcncr.top momentum-multiplier.net cindydieli.shop galeriagrozy.pl coinstrike.mobi terries.org ever.in.net eldorado-casino-zcp.top tuketimsiz.com.tr www.vegaforce.site yatirimcilarkulubu.world dacusfu.irish www.clenergyess.com nitratenorgenovelle.blog yourccomm.com intbnsd.com zskjw.net freequestaimarketing.com nunflix.li www.vegascassinobet.com popwelding.com cdcd77hhg.gomusic.tk dr54trbr.gomusic.tk dev.kyanvde.be revnuengine.info aa52f.com experteamsolutions.com round-tree-15df.zhumingwu.workers.dev discounthappiestfast.lat securetravelroots.live xn—–llcsdqdl5ahc2hqb.xn–p1ai 007jlking.com osertemp.info vkmty.info www.mind633.com d8977.top liquidstoneconcretedesigns.com jihoda.site ai.cabnetworks.ca solarbrightlights.shop 8m2600.cc maxinlighting.com serialturkone.online aduontario.com api-kvety-sk.winshop.cloud xbg23456.sbs m.greencsoft.com www.greencsoft.com nexoraagencia.online bokepstw.net senseonassess.com mustika234.com mjmstr.com ig27.com start.kyanvde.be maruay88s.bet wsc-money-test.winshop.cloud wsc-weber-mlyn.winshop.cloud kinddrift.life 03xz.primex.click spineandjoint.center dgfym.top lightheartedlove.com mailgxp.com betpky.com jwtreeservices.co.uk um.goodfortomorrow.xyz detect.caredigital.team speedtest.cabnetworks.ca tarjelibre.shop genuscxcil.ru.com g2labs.io www.newsavour.com 79b98a0f7-099e7f7-8142b-51b38712f-e0e59aea52.erynopi.com yx1662.com jt-legend.xyz ocujwzu.cn scabicideos.com reattractionur.info acscreativehub.com m4luckywin.com password.jamiehousden.com engeenergy.cc opabecu.top hawickme.site efexolih.link subur88wap.life masterareaslotsrtp.makeup www.idatarecovery.cc b63d00-1ba1d95-5b5e78229-f63159-2131aed.erynopi.com erynopi.com cathode861.erynopi.com 280986.cc api-harfasport-test-oauth.winshop.cloud 6806xpj.com gunceladresim-fixbet.com mastimandi.org ctqisansixe.vip 3345tgn.gomusic.tk healthful.my.id hello.taoyanghahahaha.workers.dev salitorydad.salitorydad.com xinzhaofightertank.com nexoroinvestfunding.info fitnessascend.site crtrh65h.gomusic.tk yadamoda.ru www.239ventures.com ibrohim.id yxtad.com zephyronix.pro vegaforce.site lainea.com u8elh.com trycoramai.co smartdosetech.info airbilla.space theiv.ca 969b-8.com www.tianshuai.com.cn tianshuai.com.cn maxwdaniel.shop k12kh.com www.superfunded.com sale.decathlonss.top prs.sxzz.dev rootfunny.store bandarliga-89z7.site enjoyingsafety.pics landesd.com eljardintequilabar.com bdwfepxrigjciv.cc touchdownwheels.ru mind633.com fondital.strategiainformatica.com old.chilternccl.co.uk webolutionswave.com neospincasino-aus.com ricobetgame.com ppnilangsa.org github.wenturc.com casinoblog577.site headaileaderproject.net dc7588.com donasi.sakuyatim.com www.armazemseuluiz.com.br yaaramart.com inupigi.top pagamentodigitalvero.com.br api-pitbull-test.winshop.cloud soilplantgen.com 6clubgames.org worker-muddy-rain-26df.fapianjigg.workers.dev fy2-worker-by.lakeland-thiele.workers.dev collaborativeweek.it nrdsw.cn bruins.casa aceofspadesgathering.com elitefanmodels.eu bknpm.biz vraqvxeopk.cn hk-canto.com 2024-new-vless.fapianjigg.workers.dev rosawardle.shop zjms.net www.dyseatoleh.com myroyalchef.com yes2winjoin.com avcactuation.com www.saigonshophousevietnamerestaurant.site wlink.brandnext.net hkzeoqifuk.vip lawz-w-help.boats swimmingforheartloverss.com cdn.gloopup.net 1982betcs.com tryfounderledsales.com 369jr.cn overego.net amigadev.net uqilcy.top bzjin.info mastersessays.com www.mastersessays.com velocrianto.com m5630.cn p3globalservices.com gborg.co.uk www.gborg.co.uk grahamandsitarz.com ousterline.com deputatza.casa riseorchestraus.shop qqqjogo2.com rame4dreal.life thrku-bet.com www.thrku-bet.com h9187.com t-progz.com sterftemonitor.nl imepina.top saigonshophousevietnamerestaurant.site debarrical.center ecolux-laundry.com 454392.cc bluesunshirts.com capital-top-cashprimeedge.sbs airbusaircraft.net crewbloomcareers.click lamielroyale.com reachgrid.com www.novex1.shop rapidneobark.space conglistri.com arbproai.com umni.si passiveincometips.co.uk 86xbd.com superdiscountsnet.org plotrivan.eu 5656.a13859616101.workers.dev draadrianasales.com.br wjankuy.info requests.stuhrasferg.dk yixingcaster.cn www.averyna.vip 67uhvf.gomusic.tk flexivoranova.buzz api.rockinglife.org olmirenqathu.com jp-en.fapianjigg.workers.dev wandering-boat-4786.area-102.workers.dev limnobiologicalnz.com growntreeshot.com worker-noisy-cake-940c.pizzabooms.workers.dev 74bet-gg.com

Malware Detected on Host

Count: 2 6064c379e72e815bb393be822baebdaca764c1bb1b5de4efc540b2ce47ca9682 e87a40660405c98c084d9f720bba9a8bc9c0de1cae4a17541f854a17012378f7

Open Ports Detected

2052 2053 2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

Share on: