34.204.119.63📋 Copy

# IP Intelligence Briefing: 34.204.119.63/32

## Executive Summary

IP 34.204.119.63 presents a High Risk classification (score: 85) with critical threat indicators despite being hosted on Amazon Web Services infrastructure. The IP demonstrates malicious campaign associations and threat feed listings, warranting defensive scrutiny.

## Infrastructure Profile

The IP resolved to Amazon Technologies Inc. (ASN: 14618, organization: Amazon Technologies Inc.) with geolocation data indicating Waterloo, Ontario, Canada. The infrastructure operates as a web server within the Amazon Web Services network. DNS records associate the address with multiple hostnames, including ec2-34-204-119-63.compute-1.amazonaws.com and several skyjack.com domain variants.

## Threat Indicators

The IP exhibited critical risk classification on Pulsedive. Threat intelligence feeds identified the address in Feodo Tracker and Cridex IPs datasets. Campaign correlation matched the IP to Dridex and QakBot malware operations. Blacklist enumeration showed zero listings despite the elevated risk profile. The control plane demonstrated valid RPKI status and stable routing (AS Path: 1403 16509 14618).

## Network Services

Active services included HTTP (port 80), HTTPS (port 443), and SSH (port 22). The SSH banner identified OpenSSH version 7.4p1. TLS certificate analysis showed a self-signed certificate issued by LOCAL INC. in Waterloo, Ontario.

## Historical Signals

Observation history captured 100 signal instances. ASN resolution data alternated between AS14618 (Amazon-AES) and AS16509 (Amazon-02), both registered to Amazon.com, Inc. Geographic signals consistently reported US origin. The IP did not demonstrate persistent malicious behavior over the observation period.

## Network Neighborhood

The /24 subnet (34.204.119.0/24) showed an abuse density rating of 1 with mostly clean classification. Risk distribution across sibling IPs showed no high-risk neighbors. One active sibling IP registered threat indicators. The subnet contained 246 total IP addresses with 245 siblings.

## Recommended Actions

SOC analysts should monitor the IP for outbound connections related to Dridex and QakBot campaign indicators. The SSH port (22) presents an unusual exposure for web hosting infrastructure and warrants investigation. Firewall rules should consider blocking inbound SSH traffic to the address while allowing HTTPS web traffic. The IP's critical Pulsedive risk score and threat feed presence justify elevated monitoring despite the AWS infrastructure association.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.