52.22.138.222 Threat Intelligence and Host Information

Jul 15, 2026 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 52.22.138.222 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 57/100

Host and Network Information

  • Mitre ATT&CK IDs: T1012 - Query Registry, T1021 - Remote Services, T1035 - Service Execution, T1046 - Network Service Scanning, T1047 - Windows Management Instrumentation, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1083 - File and Directory Discovery, T1112 - Modify Registry, T1119 - Automated Collection, T1140 - Deobfuscate/Decode Files or Information, T1179 - Hooking, T1181 - Extra Window Memory Injection, T1215 - Kernel Modules and Extensions, T1547 - Boot or Logon Autostart Execution, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0008 - Lateral Movement, TA0009 - Collection, TA0010 - Exfiltration

  • Tags: access type, active, added active, admin city, a domains, adversaries, allocates rwx, antivm network, apanas, ascii text, attack, babylon, bad traffic, body, borland delphi, city, ck id, click, code, com laude, copy, copyright, country, create, createfilew, creation date, crlf line, cve, data, date, dead host, deletes self, delphi generic, desktop, destination, dnssec, domain, email, empty hash, encrypt files, entries, entropy, error, et info, et trojan, evader, execution, exe nolookup, expiration date, false, fbo registrant, filehashmd5, filehashsha1, files, file type, flag, france france, general, generic, genericread, genericwrite, germany germany, get babylon, get reloaded, global, gmt flag, gnu message, hkeyclassesroot, hkeycurrentuser, host, hostile, hostname add, how many, http header, hybrid, icons library, informative, inject, installs, intel, ip address, ipv4, ipv4 add, learn, levelblue, limited dba, link library, llc name, ltd dba, maas, malicious, malware, md5 code, members, mirai, mitre att, modules, money doc, monitor, msie, ms windows, mtb mar, mtb oct, name tactics, network icmp, next, next associated, nomiq, organization, os2 executable, overlay, packer entropy, passive dns, path, pe32, pe32 compiler, pe32 executable, pe features, persistence, pe unknown, png image, policy sslv3, poodle attack, port, postal code, post reloaded, privacy admin, privacy billing, privacy service, privacy tech, proxy wpad, pulse pulses, python, ransom, redacted for, reevil, registry, regopenkeyexa, regopenkeyexw, regsetvalueexw, related pulses, remote, resource name, rgba, role title, russsian data, search, server, service, show, showing, stateprovince, strings, success, super node, suspicious, tags, target, tcp traffic, tools, triton, trojan, type indicator, ukraine ukraine, united, united kingdom, unknown, unknown cname, unknown ns, url http, url https, urls, viet nam, virtualallocex, virustotal, webview, win16 ne, win32, win32 dynamic, win32 exe, windows, windows nt, write, x11 snf

  • View other sources: Spamhaus VirusTotal

  • Country: United States
  • Network:
  • Noticed: 5 times
  • Protocols Attacked: web
  • Countries Attacked: United States of America
  • Passive DNS Results: apigw-global-gsratesheetservice.uat1.greensky.com

Similar IP Addresses Detected

52.22.117.241 52.22.146.95 52.22.60.110 52.22.64.124 52.22.87.224

Map

Whois Information

Links to attack logs

cfglobal-web-bruteforce-ip-list-2026-06-29

Share on: