The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.
Loki botnet controller located at 104.21.31.159 on port 80 (using HTTP POST):
hXXp://arinzeproducts.xyz/five/fre.php
$ dig +short arinzeproducts.xyz
104.21.31.159