IPMediumSignal 7/100
128.63.2.53
Location
United StatesSierra Vista, Arizona
ASN
AS13
USAISC
First Seen
Aug 26, 2020
Last Seen
Apr 18, 2026
Found in 7 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
7%
Signal Score
7 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Network Information
CountryUnited States
United StatesRegionSierra Vista, Arizona
ASNAS13
OrganizationUSAISC
IP Category
⟲
Proxy
Proxy server
Feed Intelligence Summary
7 reports7% confidence
7
Source reports
7%
Confidence score
Category tags
aaaaabn timestampacceptaccept encodingaccess windowsaccount securityactive scanactive scanningaddressaddress domainadult content hostingakamai rankalertsalfperall ipv4all scoreblueamericaamerica asnamerica flaganalysis dateanalysis ob0001analysis ob0002analyzer pasteandroidapacheappleapple iosas autonomousascii textashburnasnoneasnone relatedattackauthentihashav detectionsavast avgavg clamavazerbaijan asnbackdoorbad reputationbae systemsbaidubccwpberbewblacklist httpsblog vonbodybody htmlborpa loadingbotnetbotnet activitybrand abusebrian sabeybrute forcec2ca issuersca1 odigicertcache controlcallscamaro dragoncanadacanada unknowncapacapecape sandboxcapture t1056catalog treecdn77 datch uacheckincheckschecks systemchromeciscocisco devicecisco umbrellacitycivil servicesck idck matrixck techniquesclickclick-based attackcloud infrastructurecloudfront xcnamecnccodecode executioncode injectioncode overlapcommandcommand & controlcommand and controlcommand decodecommand executioncommunication protocolcompromised communicationcomspeccontactcontacted hostscontentcontent lengthcontent typecontrol attcontrol ob0004control ta0011cookiecopycopy md5copy sha1copy sha256corporate lawcount blacklistcountrycountry ngcreation datecredential accesscredential harvestingcredential stuffingcredential theftcrlf linecrouching yeticryptercsc corporatecycbotdata accessdata copyingdata encryptiondata exfiltrationdata store exposuredata transferdata uploaddclocaldd f1ddosddos attacksddos capabilityde ffdefense evasiondeletedelete cdeleted cdelphidennis schrderdennis schroderdenver communitiesdetection listdevelopment attdevice managementdiscovery t1018discovery t1082displaynamedistributed attacksdiv divdns attackdnssecdockdomaindomainsdownloaderdropperdrwebdworddynamicdynamic loaderdynamicloaderdyndns domaine0 eeecc ca2ecc ca3ed f6elementemailsencryptencryptionenomenterprise networkingenterprise securityentriesepubermacerrorerror auget infoet smtpet useragentseuropeeurope/asiaevasion b0003evasion t1497evasion ta0005excelexe uploadexecutable fileexfiltrationexisting pulseexpirationexpiration dateexploitexploitation activityextensionsstrextortionextri includedf0001 upxfailedfakeavfalse informationfe b9feebs worm infectionfilefilesfiles deletedfiles domainfiles droppedfiles ipfiles locationfiles matchingfiles relatedfiles showfinancefindfind suxxesteufinding notesfireeyeflagflag unitedfor privacyformatformbook cncfoundfound titlefoundryframe srcfraudfull namefull urlg2 tlsgeckogeneric httpgermany asnget httpgmtngo httpgooglegoogle phishgoogle safegovernment technologyguardhasheshashes c2aeheader targethello2malwarehelloworldheurhighhistorical sslhitmenhosthostilehostinghostnamehostname addhostname analysishostname enumerationhstrhtml applicationhttphttp attackhttp postshttp scannerhttps domainhunting servicehwp supporthybridicmp trafficidentity & access exploitationids detectionsieedge chrome1iframeinc cusindicatorinfo compilerinformation gatheringinformation technologyinfostealerinfrastructure acquisitionreconnaissanceingress tool transferinitial accessinjection activityinput validation bypassinsertinstallintelintellectual property lawinternet of thingsiociocsiot botnetiot securityiot/ics attackipv4ipv4 addirc botirc pingirc pongirc serverireland unknownissuer wr3issuing cait infrastructureitre attjapan unknownjsonkeyskhtmlkiller geckokittenkvt49llaw practicelearnlegallegal consultinglegal researchlegal sectorlegal serviceslegal technologylesslevel domainlex namelitespeed xloaderidlocallog idlooklowfilsan franciscomachine intelmacrosmagic pe32malicious activitymalicious linksmalicious proxymalicious softwaremalicious urlmalwaremalware activity detectedmalware analysismalware beaconmalware distributionmarkmonitormarkmonitor incmatches rulemd5mediummemory injectionmemory patternmessagemetameta httpmeta namemetadata analysismicrosoft stuffmicrosoft wormmiraimirai botnetmitre attmobilemobile securitymobile threatmodelmodule loadmovedmoviems windowsmsdefender augmsiemydoom worm infectionname davidname servername serversname tacticsnamed pipenetworknetwork communicationnetwork infrastructurenetwork probingnetwork scanningneuenew pulsenextnext associatednext httpnidsnjratnmclfl1 httpsno datanone googlenorth americanortonob0006 softwareok acceptomainopenoperating systemoperating system securityos2 executableotx telemetryoverview dnsoverview ipp2p distributionpackerpacking f0001packing t1045paid parkingparking crewparking crewsparking logicpassive dnspatch managementpathpath traversalpattern matchpcappdf librarype filepe resourcepe sectionpeexephishingphishing attackphone interceptionpluginspng imagepointpolitical influenceportpost httppragmapreconditionpresentpresent aprpresent augpresent decpresent febpresent janpresent julpresent junpresent marpresent novpresent octpresent sepprobeproblemprocessprocess detailsprocess injectionproxproxypublic administrationpublic infrastructurepublic policypulsepulse pulsespulse submitpulsespulses nonepushpwsquad9 blockedrankransomransomwarereadread creadsreconnaissancerecord valueredacted forreferrefreshregistry changesregistry keysregistry runregulatory agenciesregulatory compliancerelated nidsrelated pulsesrelated tagsremote accessremote access trojanremote servicesremote systemremoves headersrequestrequests domainresearchedrestartresults julresults junreverse dnsreview datargbarich perndcharrndhexrobots contentrsa sha256rsa tlsruntimeruntime modulesrussiasafe browsingsafebaesamplessamsungsc datascams & fraudscan endpointsscans showscriptscript domainsscript generalscript scriptscript urlsscriptssearchsearchmeupseard typeself-replicationserverserver attackserver responseserversserviceshell commandsshowshow processshow techniqueshowingsitesite topsocial engineeringsocial media securitysoftware developmentsoftware exploitationsoftware vulnerabilitiesspainspamspanspawnsssdeepssl certificatessl protocolstart folderstatusstcastealsstreamstringssubmit urlsugges datasuricata ipv4suspsystemsystem disruptiont1005t1012t1021t1021.001t1023t1027t1030t1031t1041t1043t1045t1047t1053t1055t1057t1059t1059.001t1060t1063t1064t1069t1069.001t1071t1071.001t1078t1082t1083t1105t1112t1113t1119t1129t1133t1140t1143t1179t1179 hookingt1190t1203t1204t1204.001t1204.002t1210t1480t1486t1490t1496t1499.001t1499.002t1499.003t1518t1547t1553t1565t1566t1566.001t1566.002t1566.003t1567.001t1568t1583t1583.005t1584t1587.001t1589t1589.001t1590t1590.001t1592t1595t1595.001t1595.002t1595.003t1598ta0006 inputta0009 commandtag counttagsthird-party riskthreatthreat actorthreat networkthreat roundupthreat sniperthreatstitletld aggregationtld counttldns-benigntls snitofseetoolstop destinationtop sourcetor nodetotaltracker radartrellixtrid upxtrojantrojan featurestrojan malwaretrojanclickertrojandroppertrojanspytsara brashearstulach topictwittertyp indicalontypetype indicatortypesumbrella rankunicodeunitedunited kingdomunited statesunknown nsunknown soaunknown xnupatreupx packedupx softwareurlsurls httpsurls showus a83f81100usa windowsuseruser executionutc entryvaryvercelverdictverified-benignverifyvhashvirtoolvirusvirustotal apivitrovps reversevt ransomwarevtapivulnerability scanweb application attackweb application exploitationweb securityweb serverweb trafficwhois registrarwin16 newin32 exewin32 malwarewin32sality febwin32spigot julwin32upatre julwin32upatre junwindirwindowswindows androidwindows malwarewindows ntwormwritewrite cx poweredx requestxserverxxx adultyara detectionsyara ruleyodazenbox
Activity Timeline
Apr 18Apr 18
Threat Activity Heatmap
· Peak: 2026-04-18LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreLow Risk
7
SIGNAL
Signal Score
7%
Confidence
7
Reports
First seenAug 26, 2020
Last seenApr 18, 2026
GeolocationUS
CountryUnited States
LocationSierra Vista, Arizona
ASNAS13
OrgUSAISC
Coords37.7510, -97.8220
Proxy
VirusTotal
Not checked
WHOIS
- raw
- NetRange: 128.63.0.0 - 128.63.255.255 CIDR: 128.63.0.0/16 NetName: ARL-SUBNET NetHandle: NET-128-63-0-0-1 Parent: NET128 (NET-128-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Headquarters, USAISC (HEADQU-3) RegDate: 1985-03-12 Updated: 2021-12-14 Ref: https://rdap.arin.net/registry/ip/128.63.0.0 OrgName: Headquarters, USAISC OrgId: HEADQU-3 Address: NETC-ANC CONUS TNOSC City: Fort Huachuca StateProv: AZ PostalCode: 85613 Country: US RegDate: 1990-03-26 Updated: 2025-03-13 Ref: https://rdap.arin.net/registry/entity/HEADQU-3 OrgTechHandle: REGIS10-ARIN OrgTechName: Registration OrgTechPhone: +1-844-347-2457 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/REGIS10-ARIN OrgAbuseHandle: REGIS10-ARIN OrgAbuseName: Registration OrgAbusePhone: +1-844-347-2457 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/REGIS10-ARIN
- references
- trojan.vtflooder/vflooder FileHash-SHA256 e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4, Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection, Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound, Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data, Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly, https://fixupx.com/Yoda4ever/status/1819058165264404527, Malicious IP: 1.3.6.1 ASNone Generic.Malware has also been named in ransomware and other highly malicious attacks., http://borpatoken.com/ borpatoken.com, Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm, This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter, For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter., analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443, X Vercel Servers, FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db, FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c, FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae, Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick, apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com, Vtapi: scanter.comwww.twitter.comx.com, IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message, IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain, Crypt3.BWVY: FileHash-SHA256 9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249, Crypt3.BWVY: FileHash-SHA1 4c60cf6b7e2981f1c05c5a34f880c6020923014c, Crypt3.BWVY: FileHash-MD5 947f28c8ab697548aca370c080187e6e, http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT-file_sharing&policy=Z2xvYmFsLWN1c3RvbS00N2Y0NzlkYy1kNmVlLTQ3MjMtOTljMy1jODhmODk4YTJjNDQ=;&view=NDdmNDc5ZGMtZDZlZS00NzIzLTk5YzMtYzg4Zjg5OGEyYzQ0;&originalUrl=aHR0cDovL3Bhbi5iYWlkdS5jb20v, http://cybertran.baidu.com/download#pan
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 5 years ago · Last seen 2 months ago
Appeared in 7 threat reports