104.21.28.230 Threat Intelligence and Host Information

Jan 19, 2026 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.21.28.230 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

  • Mitre ATT&CK IDs: T1012 - Query Registry, T1027 - Obfuscated Files or Information, T1041 - Exfiltration Over C2 Channel, T1043 - Commonly Used Port, T1055 - Process Injection, T1056.001 - Keylogging, T1059 - Command and Scripting Interpreter, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1105 - Ingress Tool Transfer, T1112 - Modify Registry, T1114 - Email Collection, T1140 - Deobfuscate/Decode Files or Information, T1176 - Browser Extensions, T1179 - Hooking, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1496 - Resource Hijacking, T1497 - Virtualization/Sandbox Evasion, T1583.005 - Botnet

  • Tags: 114.114.114.114, aacr, abuse, accept, acint, adaptivebee, address, adload, adult content, adware, agent, agent tesla, agenttesla, akamaias, akamaiasn1, alexa, alexa top, amazon02, amazonaes, amazon aws, analysis, android, andromeda, appdata, apple, appleaustin, apple engineering, apple ios, apple private, apple unlocker, april, artemis, as15169, as16509, as20940, as3359, as8075, as852, ascii text, astaroth, attack, attacker, attorney, august, authentihash, ave maria, azorult, back, bambernek, bandoo, bank, banker, banking, b body, behav, beijing gu, benjamin, betabot, binder, blackhat, blackievirus.com, blacklist, blacklist http, bladabindi, body, body length, boost mobile, br, bradesco, brian sabey, brontok, c2, C2, cgb stgreater, changelog, chase personal, child pornographer, children, china cobalt, cisco umbrella, citadel, ck id, ck matrix, class, cleaner, click, cloudflare, cloudflarenet, cloud xcitium, cnc, CNC, cnc feodo, cnc server, cobalt strike, collections, colorado, com laude, command and control, comment, communicating, company limited, compiler, computer, conduit, contacted, contacted urls, contenttype, control server, copy, core, covid19, covid19 scam, crack, critical, critical risk, crypt, csc corporate, cuba, cutwail, cyber crime, cybercrime, cyber harassment, cyber security, cyber stalking, cyberstalking, cyber threat, cyberthreat, daisy, daisy coleman, dark power, data, data center, data collection, date, death threats, defacement, delivery status, delphi, detection list, detections type, detplock, dev, developer, direct, dns, dnspionage, dns poisoning, dns replication, domain, domains, domaiq, downer, downldr, download, download csv, downloader, download json, driver pro, dropped, dropped files, dropper, duckdns, ecc domain, ec oid, elf collection, email, email delivery, email fwd, emotet, engineering, entity, error, et, et tor, execution, exploit, facebook, fakealert, falcon sandbox, fareit, file, files, file size, filetour, file type, final url, first, floxif, footer, form, formbook, fraud service, friendly, function, fusioncore, gc, gc abuse, general, generator, generic, generic malware, genkryptik, geoip, ghost, ghost rat, googl2, google, google llc, google update, gopher, greatness, hacker, hackers, hacktool, hallrender, hall render denver, header, heodo, heur, hidden privacy, historical ssl, history first, hostname, hostnames, hotmail, hsbc, http, http header, http response, hybrid, icloud, icmp, iframe, ii llc, illegal, indicator, indonesia, injector, inmortal, installcore, installer, installpack, intel, iobit, ip address, iphone unlocker, ip summary, ipv4, january, javascript, jfif standard, jpeg image, json sample, june, kb file, key algorithm, keybase, keygen, key info, keylogger, kgs0, kiannas law, kls0, known tor, kovter, kryptik, kyriazhs1975, law, layer, legal, level3, limited, local, localappdata, lockbit, ltd dba, magic pe32, magniber, main, malicious, malicious site, malicious url, maltiverse, malvertizing, malware, malware host, malware hosting, malware scripting, malware site, malware spreader, march, mark brian sabey, masquerading, matsnu, md5 code, media, mediamagnet, meta, meterpreter, metro hacker, metro t-mobile, mexico, microsoftcorpas, mile high media, million, mimikatz, miner, mini, mirai, missouri, mitre att, mitre attack, monitoring, msil, ms windows, multiple botnetworks, name, namecheap inc, name verdict, nanocore, nanocore rat, net34, net340000, nethandle, netrange, network, network rat, networm, nexus, nircmd, njrat, noname057, notification, number, nymaim, occamy, october, open, opencandy, optimizer pro, orgid, orkut, os2 executable, outbreak, password, patcher, path, pattern match, paypal, pe resource, phishing, phishing chase, phishing google, phishing site, phishtank, phpsessid, please, pony, porkbun llc, pornhub, pornographers, prefetch8, presenoker, probe, problems, programfiles, proton, psexec, public url, pyinstaller, pykspa, radamant, radar ineractive, ramnit, ransomware, redline, redline stealer, referrer, relic, remcos, remote, remote attacker, replacement, report, resolutions, response final, revenge rat, revil, riskware, rms, runescape, runtime process, sabey, sabey data centers, safebae, safebae.org, safe site, sality, sample, samples, scanning host, script, secrisk, sections, server ca, service, services, service tool, serving ip, setup sha256, seznam, sha1, sha256, shell, show, show technique, simda, site, size, smokeloader, sneaky server, soc, soc http, soc https, social engineering, sodinokibi, sophos sophos, spammer, span, spyware, squirrelwaffle, ssdeep, ssl certificate, stalker, startpage, status code, stealer, steam, steam route, strike, strings, subject public, submission, sucurisec, summary, suppobox, swrort, systweak, tcp traffic, team, team phishing, teams, telecom, telecom italia, telefonica, telefonica co, temp, text, text ip, thebrotherssabey, then brothers sabey, threat network, threat report, threat roundup, threats et, threats https, tiggre, tinba, t-mobile, tmobile, t-mobile hacker, tofsee, tool, torrent trecker, tracker, tracker malware, tracking, trid windows, trojan, trojanspy, trojanx, TrojanX, tsara brashears, tulach, tulach.cc, twitter, type data, type name, UAlberta, ukraine, unauthorized, unicode text, united, unknown, unruy, unsafe, url https, urls, url summary, urls url, utc http, utc submissions, v3 serial, vawtrak, verdict cloud, vhash, vidar, view, virustotal, virut, wacatac, webshell, webtoolbar, whois lookup, whois record, whois sslcert, whois whois, wife happy, win32, win32 exe, win64, windows nt, worm, xcitium verdict, xtrat, yixun, youth, zbot, zeus, zpevdo

  • View other sources: Spamhaus VirusTotal

  • Country:
  • Network:
  • Noticed: 34 times
  • Protocols Attacked: SSH
  • Countries Attacked: Anguilla, Aruba, Australia, Bahamas, Barbados, Canada, Cayman Islands, Costa Rica, Curaçao, Georgia, Guatemala, Japan, Mexico, Netherlands, Panama, Philippines, Poland, Saint Kitts and Nevis, Saint Martin (French part), Saint Vincent and the Grenadines, Sint Maarten (Dutch part), Tanzania United Republic of, Trinidad and Tobago, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America

Malware Detected on Host

Count: 1 ecabd730e19181ac3413152e83884f1bcb50cc71be4fcce7cfc39643cdaad7de

Open Ports Detected

2052 2053 2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

Share on: