15.197.212.58 Threat Intelligence and Host Information

Aug 05, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 15.197.212.58 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 56/100

Host and Network Information

  • Mitre ATT&CK IDs: T1036.004 - Masquerade Task or Service, T1071.004 - DNS, T1102 - Web Service, T1105 - Ingress Tool Transfer, T1110.002 - Password Cracking, T1114.001 - Local Email Collection, T1185 - Man in the Browser, T1204.001 - Malicious Link, T1204.002 - Malicious File, T1204.003 - Malicious Image, T1447 - Delete Device Data, T1457 - Malicious Media Content, T1512 - Capture Camera, T1523 - Evade Analysis Environment, T1578.003 - Delete Cloud Instance, T1583.001 - Domains, T1588.001 - Malware, T1610 - Deploy Container

  • Tags: active related, added active, admin city, algorithm, auto-generated security, aws, body length, business, compromised websites, country, cus olet, data, date, dev, dirtsearch, dns, dns resolutions, domain status, emotet, encrypt cnr11, entries, error, false, first, get http, huge domains, indicator role, ip address, kb body, key identifier, known infection source, learn more, malware, malware service, malware sites, mas, media sharing, number, organization, parking crew, postal code, post http, privacy admin, pulses, real estate, redacted for, related pulses, resolved ips, server, sha256, showing, spyware, stateprovince, status code, subject public, title added, ttl value, ua71173394, url http, url https, v3 serial, validity, x509v3 subject

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 11 fba55e417d3332c8674caa13ee8ddfa2b40f85dc9e8da4395f2e9f94e8e8f009 859beb2284f8a0437c68008ab953b6de8668c9bf4c3c68e2c512431c27d18988 1e7e18b492fe93088a92ec55fa8297d9aedee72b8a1e135106f86a73a9b4cc3f b971843d35f10a974a8ff8767ac58ef973928e9d29513fde40c434faafc6e48c f63ca1b08da3828b604ebbd16f954233516ef7afc6a22a5a7e9ac43c00324036 293ec8f362d335e305b9879ad8519dfcb90bc4339acfabb3f49b4f221765d775 5252ba3f1a037dae677eeb5d1b8ec1df1fa8a2e2d62bd1e6b765e432f742d417 a72ac1ad2793acfc78e7b115f9bbba6e5a6404332926b9dbd7efb89b061c376d 5d0cc4516db1bae42cbc4762b488f2f9e6b9abeffd1f5e444639f752c6e3ccbb 88b56c34b93c41f60475bdfcade7f9ac227ed59532cca1df95d685ad15217549

Open Ports Detected

443 80

Map

Whois Information

  • NetRange: 15.196.0.0 - 15.200.255.255
  • CIDR: 15.196.0.0/14, 15.200.0.0/16
  • NetName: AT-88-Z
  • NetHandle: NET-15-196-0-0-1
  • Parent: NET15 (NET-15-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS:
  • Organization: Amazon Technologies Inc. (AT-88-Z)
  • RegDate: 2021-01-28
  • Updated: 2022-04-26
  • Comment: —–BEGIN CERTIFICATE—–MIIDnjCCAoYCCQCMCXLBuibPpjANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdTZWF0dGxlMQwwCgYDVQQKDANBV1MxETAPBgNVBAsMCElkZW50aXR5MRMwEQYDVQQDDApzaWduaW4uYXdzMSwwKgYJKoZIhvcNAQkBFh1hd3MtaWQtc2lnbmluLWNvcmVAYW1hem9uLmNvbTAeFw0yMjA0MjExODEyNDdaFw0yMzA0MjExODEyNDdaMIGQMQswCQYDVQQGEwJVUzELMAkGA1UECAwCV0ExEDAOBgNVBAcMB1NlYXR0bGUxDDAKBgNVBAoMA0FXUzERMA8GA1UECwwISWRlbnRpdHkxEzARBgNVBAMMCnNpZ25pbi5hd3MxLDAqBgkqhkiG9w0BCQEWHWF3cy1pZC1zaWduaW4tY29yZUBhbWF6b24uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2OLoxduBX+OJYYmeN1V9WSrohqUuzLeEsRA5TTgyx9IA2rSh8LyoTXiyrlMJfIGO/OE1VOjLMDUXQVoz/YO/CNIss6Iw/NZtLn14RIW/iQ4rS3O+G/ZF91v9IVdiwtPc59mhZfw/vBm/L7zgWJCEMVg/tM04EHmZEOZuodnrjoyPEPihI8qI+PzSYu3JBsZXat8aC7EPmyEcUVfXXu8dcaHm6REbEuB6WU4vCbe303zy9KoA9xbMebr6Hw9Ao/UTTGhAc1tJQD4HdPZwJmt5RMlyEa3jKyEu+YDZrx8Ci617h4KnB3uzOsmjmtbKrErDiw5bluJrZw7Vp2uzxirolQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDYtJyOoj1fUOYjwLyELQnPAfo06/42rktqMOk+bLGK2BYHQzvxFlyBmNl5FzawvOa/auKySgG5ISO7lu29HUMAhIOkD55JWcZu/jkxFFdccQnoezBbVKyEiOfFQJfAgmrNnHlEL587ROO+L+yfAEnJ7BgyBzzzWbaQZhdJd2zHrhAL1cVvQbdXqVPUnFti7A9DfBJ9rQ4GqyIN963AuOHpiberNJbj1ZqNFx72Y4fHAsBRtMdXkG+pxzPnQt5lurfsSFVnVwDr+/Cm1Rx1EyEwjuXZlem1hQb0olALWKtxbh9pyuP5SP1TdHWyI9EA9Y60dPpqGdL0N5nGmUJ7b2Ka—–END CERTIFICATE—–
  • Ref: https://rdap.arin.net/registry/ip/15.196.0.0
  • OrgName: Amazon Technologies Inc.
  • OrgId: AT-88-Z
  • Address: 410 Terry Ave N.
  • City: Seattle
  • StateProv: WA
  • PostalCode: 98109
  • Country: US
  • RegDate: 2011-12-08
  • Updated: 2024-01-24
  • Comment: All abuse reports MUST include:
  • Comment: * src IP
  • Comment: * dest IP (your IP)
  • Comment: * dest port
  • Comment: * Accurate date/timestamp and timezone of activity
  • Comment: * Intensity/frequency (short log extracts)
  • Comment: * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time.
  • Ref: https://rdap.arin.net/registry/entity/AT-88-Z
  • OrgRoutingHandle: IPROU3-ARIN
  • OrgRoutingName: IP Routing
  • OrgRoutingPhone: +1-206-555-0000
  • OrgRoutingEmail: aws-routing-poc@amazon.com
  • OrgRoutingRef: https://rdap.arin.net/registry/entity/IPROU3-ARIN
  • OrgRoutingHandle: ARMP-ARIN
  • OrgRoutingName: AWS RPKI Management POC
  • OrgRoutingPhone: +1-206-555-0000
  • OrgRoutingEmail: aws-rpki-routing-poc@amazon.com
  • OrgRoutingRef: https://rdap.arin.net/registry/entity/ARMP-ARIN
  • OrgTechHandle: ANO24-ARIN
  • OrgTechName: Amazon EC2 Network Operations
  • OrgTechPhone: +1-206-555-0000
  • OrgTechEmail: amzn-noc-contact@amazon.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/ANO24-ARIN
  • OrgAbuseHandle: AEA8-ARIN
  • OrgAbuseName: Amazon EC2 Abuse
  • OrgAbusePhone: +1-206-555-0000
  • OrgAbuseEmail: trustandsafety@support.aws.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/AEA8-ARIN
  • OrgNOCHandle: AANO1-ARIN
  • OrgNOCName: Amazon AWS Network Operations
  • OrgNOCPhone: +1-206-555-0000
  • OrgNOCEmail: amzn-noc-contact@amazon.com
  • OrgNOCRef: https://rdap.arin.net/registry/entity/AANO1-ARIN
Share on: