104.237.252.14
Classification: Suspicious
104.237.252.14 is a suspicious IP address in Philadelphia, US. 53 sightings from 3 threat sources (Loki Password Stealer (PWS), VPN), last seen 2026-10-11.
Current activity
- VPN node — Provides anonymization that can hide an attacker.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2026-04-19 00:27:51 | 2026-10-11 23:57:30 | anonymization vpn | |
| Loki Password Stealer (PWS) | ThreatFox Abuse.ch | 2024-03-05 12:17:03 | 2024-03-07 11:19:31 | malicious-activity | |
| Mail Spammer | Abuseat.org | 2024-03-05 12:17:05 | 2024-03-05 12:17:05 |
Tags
infostealer lokibot stealer port:80 burkina loki lokipwsWhois information
- AS name
- AS16628 DedFiberCo
- AS registry
- arin
- AS date
- 2014-12-03 00:00:00
- AS CIDR
- 104.237.252.0/24
- CIDR
- 104.237.224.0/19
- Registrant
- DedFiberCo
- Address
- 913 N Market Street Suit 200
- City
- Philadelphia
- State
- PA
- Postal code
- 19032
- Country
- US — United States 🇺🇸
- Contact email
- [email protected]
- First indexed
- 2024-03-05 12:17:03
- Last updated
- 2026-10-11 23:57:31