104.21.87.105 Threat Intelligence and Host Information

General

This page contains threat intelligence information for the IPv4 address 104.21.87.105 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

🟠 Elevated — 57/100

Host and Network Information

• View other sources: Spamhaus VirusTotal Shodan AbuseIPDB
• Noticed: 5 times
• Protocols Attacked: SSH
• Countries Attacked: United States of America
• Open Ports: 2053, 2082, 2083, 2086, 2087, 2095, 2096, 443, 80, 8080, 8443, 8880
• Tor Node: No

Tags

• address range
• adversaries
• aids
• alexa
• allocation type
• anonymizer
• apnic
• apple
• ascii text
• asn as49505
• asn as714
• assigned pi
• australia
• avast avg
• backdoor
• blacklist
• cidr
• cisco umbrella
• ck id
• ck matrix
• click
• coinminer
• command
• content length
• creation date
• cyber threat
• date
• daum
• dead host
• defense evasion
• delete c
• destination
• displayname
• dns resolutions
• domain secure
• domains top
• dynamicloader
• dzan
• emails
• encrypt
• entity ipripe
• entries
• error
• execution
• external
• federation flag
• files
• files domain
• files location
• files related
• flag
• flag united
• found
• general
• gmt content
• grum
• handle
• high
• historical ssl
• hostile
• hostname
• http
• hybrid
• informative
• injector
• ios
• ipad
• ip address
• iphone
• ipv4
• ipv4 add
• judi
• learn
• less whois
• level
• local
• location united
• look
• malicious site
• malware
• malware site
• medium
• miner
• miny
• misa
• mitre att
• moved
• mtb oct
• name servers
• name tactics
• network name
• next
• none google
• null
• ogoogle trust
• orc5
• passive dns
• path
• pattern match
• pe resource
• phishing
• phishing site
• port
• powershell
• pulse pulses
• pulses none
• push
• referrer
• refresh
• registrar
• related nids
• related tags
• resolutions
• restart
• rhur3d
• safe browsing
• search
• show process
• show technique
• site
• site ca0x1ex17r
• span
• spawns
• ssl certificate
• status
• stream
• strings
• sumo
• suppobox
• suspicious
• t1480 execution
• team
• title
• tofsee
• tools
• trojan
• trojandropper
• type
• ubuntu
• unique tlds
• united
• unknown
• unknown ns
• url add
• urls
• verify
• whois record
• whois server
• win64
• windows
• windows nt
• write
• zerossl ecc

MITRE ATT&CK TTPs

• T1003.008 - /etc/passwd and /etc/shadow
• T1027 - Obfuscated Files or Information
• T1041 - Exfiltration Over C2 Channel
• T1055 - Process Injection
• T1056 - Input Capture
• T1057 - Process Discovery
• T1060 - Registry Run Keys / Startup Folder
• T1068 - Exploitation for Privilege Escalation
• T1071 - Application Layer Protocol
• T1105 - Ingress Tool Transfer
• T1113 - Screen Capture
• T1119 - Automated Collection
• T1155 - AppleScript
• T1176 - Browser Extensions
• T1210 - Exploitation of Remote Services
• T1449 - Exploit SS7 to Redirect Phone Calls/SMS
• T1480 - Execution Guardrails
• T1498 - Network Denial of Service
• T1553 - Subvert Trust Controls
• T1562 - Impair Defenses
• T1566 - Phishing
• TA0011 - Command and Control

Passive DNS

• leaseline-lincolnshire.co.uk

Whois Information