Hosted at Amazon AWS (cloud).
- ASN kind
- cloud
- ASN operator
- Amazon AWS
Verdict
SUSPICIOUSMedium confidence
1Supporting signals
1Independent sources
1Recent observations
44 / 100Threat score
Why the engine decided this
Deterministic engine · activity moderate- THREATFOX_MATCH ThreatFox lists the indicator as an IOC.
Key indicators
- IP address
- 34.237.159.252
- ASN
- AS14618
- Holder
- AMAZON-AES - Amazon.com, Inc.
- Network
- AT-88-Z
- Prefix
- 34.224.0.0/12
- Open ports
- 80
- Tor exit
- No
- Domains on IP
- 1
- First seen
- 2026-10-02 (0 days before · ThreatFox)
- Last seen
- 2026-10-02 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
 ThreatFox | Listed as botnet_cc for Unknown malware at 50% confidence, today. | 50% | 0 days recent | Moderate |
 AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
| IOCSCAPE knowledge base | Hosted at Amazon AWS (cloud). | — | — | Context |
 RDAP | Network AT-88-Z (NET-34-192-0-0-1), country unknown; Amazon Technologies Inc.. | — | — | Context |
 RIPEstat | Announced in 34.224.0.0/12 by AS14618 (AMAZON-AES - Amazon.com, Inc.). | — | — | Context |
 Shodan | Open ports 80. | — | — | Context |
| Reverse DNS (ip.thc.org) | 1 domain(s) point at this IP in ip.thc.org's DNS index. | — | — | Context |
 VirusTotal | Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration. | 1/91 | 54 days aging | Neutral |
Coverage · checked, no record: GreyNoise, AbuseIPDB, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, VPN ranges, CrowdSec, Spamhaus DROP, DShield · failed: none
Analyst summary
Consistent with engineThis IP is suspicious (medium confidence). Listed as botnet_cc for Unknown malware at 50% confidence, today.
Why the evidence points to suspicious
- [ThreatFox] Listed as botnet_cc for Unknown malware at 50% confidence, today.
Only one source family reports malicious activity.
Evidence pointing the other way
- [AlienVault OTX] Marked as a known false positive or whitelisted.
Attribution
Links the indicator to Unknown malware activity, hosted at Amazon AWS; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
18 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| ThreatFox | Listed as botnet_cc for Unknown malware at 50% confidence, today. | 50% | 0 days recent | Moderate |
| AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
| IOCSCAPE knowledge base | Hosted at Amazon AWS (cloud). | — | — | Context |
| RDAP | Network AT-88-Z (NET-34-192-0-0-1), country unknown; Amazon Technologies Inc.. | — | — | Context |
| RIPEstat | Announced in 34.224.0.0/12 by AS14618 (AMAZON-AES - Amazon.com, Inc.). | — | — | Context |
| Shodan | Open ports 80. | — | — | Context |
| Reverse DNS (ip.thc.org) | 1 domain(s) point at this IP in ip.thc.org's DNS index. | — | — | Context |
| VirusTotal | Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration. | 1/91 | 54 days aging | Neutral |
 GreyNoise | No record. | — | — | No record |
 AbuseIPDB | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| VPN ranges | No record. | — | — | No record |
 CrowdSec | No record. | — | — | No record |
 Spamhaus DROP | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- KNOWN_CLOUD_PROVIDERIP belongs to a major cloud provider; addresses are shared over time between customers.
- THREATFOX_MATCHThreatFox lists the indicator as an IOC.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineThis IP is suspicious (medium confidence). Listed as botnet_cc for Unknown malware at 50% confidence, today.
Why the evidence points to suspicious
- [ThreatFox] Listed as botnet_cc for Unknown malware at 50% confidence, today.
Only one source family reports malicious activity.
Evidence pointing the other way
- [AlienVault OTX] Marked as a known false positive or whitelisted.
Attribution
Links the indicator to Unknown malware activity, hosted at Amazon AWS; this does not identify a specific threat actor or implicate the hosting provider.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 34.237.159.252
- ASN
- AS14618
- Holder
- AMAZON-AES - Amazon.com, Inc.
- Network
- AT-88-Z
- Prefix
- 34.224.0.0/12
- Open ports
- 80
- Tor exit
- No
- Domains on IP
- 1
- First seen
- 2026-10-02 (0 days before · ThreatFox)
- Last seen
- 2026-10-02 (0 days before)
Domains on this IP
1 domain point here.
- ec2-34-237-159-252.compute-1.amazonaws.com
From ip.thc.org's index of DNS records.
By source
RDAPNetwork AT-88-Z (NET-34-192-0-0-1), country unknown; Amazon Technologies Inc..
- Org
- Amazon Technologies Inc.
- Range
- NET-34-192-0-0-1
- Network
- AT-88-Z
RIPEstatAnnounced in 34.224.0.0/12 by AS14618 (AMAZON-AES - Amazon.com, Inc.).
- ASN
- 14618
- Holder
- AMAZON-AES - Amazon.com, Inc.
- Prefix
- 34.224.0.0/12
ShodanOpen ports 80.
- Tags
- cloud
- Ports
- 80
- Vulns
- 0
- Hostnames
- ec2-34-237-159-252.compute-1.amazonaws.com
1 domain(s) point at this IP in ip.thc.org's DNS index.
- Domains
- 1
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
KNOWN_CLOUD_PROVIDER IP belongs to a major cloud provider; addresses are shared over time between customers.
Attribution
Links the indicator to Unknown malware activity, hosted at Amazon AWS; this does not identify a specific threat actor or implicate the hosting provider.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-08-09VirusTotal: Only 1/91 vendors (1.1%) flag it: an isolated detection, not corroboration
- 2026-10-02ThreatFox: Listed as botnet_cc for Unknown malware at 50% confidence, today
- 2026-10-02Investigated
Recommended next steps
- huntSearch firewall, proxy and EDR logs for connections to 34.237.159.252:11116 in the last 30 days.
- pivotPassive DNS: domains that resolved to 34.237.159.252.
Pivot to other tools
Opens the indicator in the source's own site (new tab).