104.16.86.20 Threat Intelligence and Host Information

Jun 24, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.16.86.20 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1005 - Data from Local System, T1012 - Query Registry, T1027 - Obfuscated Files or Information, T1030 - Data Transfer Size Limits, T1031 - Modify Existing Service, T1035 - Service Execution, T1036 - Masquerading, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1043 - Commonly Used Port, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055.012 - Process Hollowing, T1055 - Process Injection, T1056.001 - Keylogging, T1056 - Input Capture, T1057 - Process Discovery, T1059.005 - Visual Basic, T1059.006 - Python, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1070 - Indicator Removal on Host, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1081 - Credentials in Files, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1090 - Proxy, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1105 - Ingress Tool Transfer, T1106 - Native API, T1110.002 - Password Cracking, T1110 - Brute Force, T1111 - Two-Factor Authentication Interception, T1112 - Modify Registry, T1114 - Email Collection, T1119 - Automated Collection, T1122 - Component Object Model Hijacking, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1158 - Hidden Files and Directories, T1173 - Dynamic Data Exchange, T1176 - Browser Extensions, T1179 - Hooking, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1222 - File and Directory Permissions Modification, T1410 - Network Traffic Capture or Redirection, T1423 - Network Service Scanning, T1427 - Attack PC via USB Connection, T1445 - Abuse of iOS Enterprise App Signing Key, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1450 - Exploit SS7 to Track Device Location, T1453 - Abuse Accessibility Features, T1472 - Generate Fraudulent Advertising Revenue, T1485 - Data Destruction, T1491 - Defacement, T1496 - Resource Hijacking, T1497.001 - System Checks, T1497 - Virtualization/Sandbox Evasion, T1518.001 - Security Software Discovery, T1518 - Software Discovery, T1543 - Create or Modify System Process, T1546.015 - Component Object Model Hijacking, T1546 - Event Triggered Execution, T1547.001 - Registry Run Keys / Startup Folder, T1547 - Boot or Logon Autostart Execution, T1552.001 - Credentials In Files, T1552 - Unsecured Credentials, T1555.003 - Credentials from Web Browsers, T1555 - Credentials from Password Stores, T1560 - Archive Collected Data, T1563 - Remote Service Session Hijacking, T1564 - Hide Artifacts, T1566 - Phishing, T1568 - Dynamic Resolution, T1569 - System Services, T1571 - Non-Standard Port, T1573 - Encrypted Channel, T1574 - Hijack Execution Flow, T1583.005 - Botnet, T1588.004 - Digital Certificates, T1588 - Obtain Capabilities, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0009 - Collection, TA0010 - Exfiltration, TA0011 - Command and Control

  • Tags: 100px, 1439px, 1996, 1tzv, 24px, 25px, 5000, 60px, a1ginaprincipal, a9dia, aaaa, accept, accept ch, accept encoding, access denied, access ta0001, acint, activator, active threat, activity, adams co, adblock pro, address, address domain, address first, address google, addtopayload, adload, adobe air, adobe portable, a domains, adversaries, adware, adware affiliate, af81 http, a fleecy, agency, agent, ai, aig, AIG Claims, akamaias, alexa, alexa proxy, alexa top, alf features, algorithm, alina, all octoseek, allow, all scoreblue, all search, already, amazon 02, amazon02, amazonaes, analysis, analyzer paste, analyzer threat, android, andromeda, anonymisation, anonymizer, ansi, antivirus, antivm_network_adapters, antivm_queries_computername, a nxdomain, apache, api blog, appdata, apple, appleaustin, apple engineering, apple ios, apple notepad, apple phone, apple unlocker, application, applicunwnt, april, apt, artemis, as13335, as133618, as13768 aptum, as139021, as14061, as14720 gamma, as15169 google, as16276, as16552 tiggee, as16625 akamai, as19237 omnis, as19527 google, as20068 hawk, as20940, as212913 fop, as22169 omnis, as22489, as22612, as23393, as2914 ntt, as29789, as30148 sucuri, as31898 oracle, as36459, as39122, as396982, as396982 google, as397240, as397241, as40509, as4230 claro, as43350 nforce, as44273 host, as47846, as49453, as54113, as55286, as60558 phoenix, as61969 team, as62597 nsone, as6724 strato, as7018 att, as7922 comcast, as8068, as8075, as autonomous, ascii text, asn15169, asn16276, asn209242, asn4583, asnone, asnone united, assistant, asyncrat, athena, atlas, attack, attacking, attention, august, available from, avast avg, awful, azorult, azorult cnc, azureadmyorg, azure tls, back, backdoor, bambernek, bambernek gen, bambernek simda, banco, bandoo, bank, banker, basic, bayrob, bazaloader, b body, beach research, beginstring, behav, beijing gu, benjamin, best targets, betabot, bill, binary file, bitrat, bitrep, blackhat, blacklist, blacklist http, blacklist https, blacknet rat, blank, blocklist, body, body doctype, body html, body length, boot, bot, botnet campaign, botnet command and control, botnetwork, bradesco, brazil, brazil unknown, brent kimball, brian sabey, browser, c2, C2, camera usage, canada unknown, cannon, cape, catalog tree, cbe cnalphassl, center, centerchecks, certificate, cgb stgreater, channelsurfcli, chat, checked url, checkin, checks_debugger, child teen content illegal, china, china as4134, china education, china telecom, china unicom, Christopher Pool, chrome, chromeua, cins active, ciphersuite, cisco, cisco umbrella, citadel, ck id, class, classic poems, classname, cleaner, click, clickjacking, clipper dos, close, cloudflare, cloudflarenet, cloud host, cname, cnc, cnc feodo, cnc server, cndigicert sha2, cnus, coalition et, cobalt strike, cobaltstrike, code, coinminer, collection, collections, colorado, com laude, command and control, command_and_control, comment, commerce, communicating, comodo rsa, comodo valkyrie, company limited, compiler, computer, conduit, cong ty, connect azurepc, connection, connector, contact, contacted, contacted urls, contact phone, contained, content generating, content length, content reputation, content type, control server, cookie, copy, copyright, core, corruption, country, country unknown, cover up, covid19, crack, create, created, creation date, critical, critical risk, cronup threat, cruise, crypto, csc corporate, cultureneutral, cus cnmicrosoft, cus olet, customer, cve201711882, cve202322518, CVE-2023-4966, cyber attack, cyber crime, cyberlynk, cybersecurity, cyber stalking, cyberstalking, cyber threat, cyberthreat, cyberwar, cymulate, dan.com, dangeroussig, dark consultants, darkgate, data, database, data center, date, date hash, date mon, dat ngoc, dau tu, december, decrypted ssl, deepscan, default, defense evasion, de indicators, delete, delete c, deleted, deleted virustotal graphs, deleting, de page, designer, desktop, de summary, detail domains, detection list, detections file, detections type, device control, dexter, dga, diamondfox, discovery, district, div div, djcodychase.com, dll sideloading, dns, dns lookup, dnspionage, dns records, dns replication, dns resolutions, dnssec, docs pricing, document file, document format, dofoil, domain, domain name, domain related, domain robot, domains, domains show, domain tree, dos com, dos exe, downer, downldr, download, downloader, dridex, driverpack, drivertalent, drmedgeua, dropped, dropped file, dropper, duckdns, dumped_buffer, duo insight, dynadot llc, dynamicloader, dynamics, e1082 impact, e1203 data, e1564 discovery, ecc domain, ecdhersa, ec oid, edgeua, edsaid, el0kpmhlfz, elf collection, email, emails, emailworm, embed, emotet, emotet ip, encdoc, encrypt, encrypt cnr3, engineering, english, enosch, enosch malware, enter, enterprise, enter rexxfield, entries, entrust, erase, error, et, et cins, eternalblue, etpro malware, et tor, et useragents, evasion ob0006, evil, evil c, excel, exe32, executable, execution, exit, expiration, expiration date, expires thu, expirestue, expl, exploit, exploitation, explorer, extraction, facebook, factory, fakealert, fakedout threat, falcon, falcon sandbox, false, favorite, fcc, february, feed, feodo, file, filehashmd5, filehashsha1, filehashsha256, filerepmetagen, files, file samples, files domain, files ip, file size, files location, files matching, files related, filetour, file transfer, file type, final url, financial, find, findwindowa, firehol, first, flex, flow t1574, follow, font format, footer, form, formbook, formbook cnc, for privacy, frames domain, france mail, france unknown, frankfurt, free poems, friendship poems, front, fuery, fullscreen, fusioncore, g2 oglobalsign, game, gamers, gandi sas, gb summary, gecko, general, general full, generator, generic, generic malware, generic windos, genkryptik, gen.o, geotracking, germany, germany unknown, get h2, get http, get na, getprocaddress, github pages, glupteba, gmbh version, gmt content, gmt server, gmt setcookie, gmt united, goldfinder, google, gootloader, graph community, graph summary, greatness, group, gsqueue, gts ca, guard, gui32, gvt, hacked by phone call, hacker, hackers, hacking, hacktool, hallrender, hallrender.com, hash, hashes, hawkeye, header click, header intel, headers, headers date, head title, heat, heaven, heavens, her beam, herself, heur, hidden, hidden users, hide artifacts, high, high level, highly targeted, high process, high security, historical, historical ssl, history, hitmen, homepage, hong kong, host, hosting, hostname, hostnames, hostname server, hosts, html, html info, http, http attacker, http header, httponly, http request, http requests, http response, https://www.tiuli.com/tracks/21/%D7%9E%D7%92-%D7%A8%D7%A1%D7%94-, hybrid, hybrid analysis, icedid, ice fog, icloud, icmp, identifier, ids detections, iframe, ii llc, illegal, illegal practices, incapsula, indicator, indicator facts, indonesia, industry_and_commerce, info, info compiler, info header, information, infrastructure, infy, ingestion time, inject, injection t1055, inmortal, input, installcore, installer, installpack, intel, internal, internapblk4, internet storm, invalid url, iobit, iocs, ioc search, Iowa.gov, ip address, ipasns ip, ip detections, ip information, ip reputation, ip summary, ip tcp, ipv4, ireland unknown, isotope, issuer, issuing ca, it’s back, jackpos, jackson, january, java, javascript, jeffrey reimer pt, jpeg image, js, json data, july, june, junk data, kali, kangen, karma, kb acrotray, kb body, kb file, kb image, kb program, keitaro, key algorithm, key identifier, key info, keylogger, kgs0, khtml, killav, kitty, kls0, known tor, kong asn, kraken, kryptik, kuaizip, language, laplasclipper, latino, latino voices, latv, law, leasewebuklon11, legal, less see, librouter, life, limited, link, linker, linkid252669, links certs, live, llc registry, lmenlo park, local, localappdata, location hong, location united, lockbit, login, logon autostart, loki, london, look, love poems, lowfi, ltd dba, lumma stealer, magniber, magnus, mail collection, mail spammer, main, makop, maliciosa, malicious, malicious site, malicious url, maltiverse, maltiverse safe, maltiverse top, malvertizing, malware, malware generic, malware host, malware scripting, malware site, malware spreader, manjusaka, march, mark, mark brian sabey, markmonitor, masquerading, matches rule, matsnu, mayberry, mb iesettings, mb opera, mb super, media, media center, mediaget, medium, meister, memcommit, memory pattern, message interception, meta, metastealer, meta tags, meterpreter, metro, metro hacker, microsoft azure, microsoftcorpas, microsoft crm, microsoft power, microsoft teams, middle, mike, milemighmedia, million, mimikatz, mirai, misc attack, mitre att, mitre attack, modification, modifies_proxy_wpad, modify system, monitoring, mon jul, moved, mozilla, mr windows, msie, ms visual, ms windows, mtb apr, mtb jul, mtd1, multiple botnetworks, mumblehard, murderers, music, mwin, my boy dan, name, namecheap inc, name md5, name servers, name value, name verdict, nameweb bvba, nanocore, nanocore rat, netgear router, netgear twitter, netherlands, netsky, network, network capture, network_http, network_icmp, network rat, networks, network_smtp, network traffic, neutrino, new ioc, next, nginx, night, nightmare, ninite, nircmd, nivdort, njrat, no data, node tcp, node traffic, no expiration, noname057, noscript, nosy pega, november, nr agent, nreum, nsisinetc, null, number, nxdomain, nymaim, ob0005 defense, ob0007 system, ob0012 hide, object, obz4usfn0 http, oc0008, october, odigicert inc, office, ollydbg, ometa platforms, online, open, opencandy, openioc, optimizer, optin, optout, os2 executable, otx octoseek, outbreak, outlook, overlay, ovh sas, page url, parent parent, passive dns, password, password bypass, paste, patcher, path, pattern match, pcap, pcap frame, pcap processing, pcidump rasman, pdf document, pdf report, pe32, pe32 compiler, pe32 executable, pe32 packer, peedtee, pe resource, persistence, persistence_autorun, phase, phi, phishing, phishingms, phishing site, phishtank, phone hacking, pii, pjp3sltkz, plasma, playgame, please, plugx, png image, poem, poems, poem topics, poetry, pony, Pool’s Closed, poor reputation, porkbun llc, porn, pornhub, pornographers, portugal, possible, possiblecerber, post, post http, potential ip, pragma, premium, presenoker, present mar, privacy inc, probe, problems, processes tree, process t1543, productidis, products id, programfiles, protocol h2, proud evening, proxy, psiusa, ps ord, pte ltd, public key, pulse indicator, pulse pulses, pulse submit, push, pykspa, python, python connection, q0gpyr1balpdgpo, qakbot, qbot, qdkxgr24yz, quasar rat, quasi, query type, raccoon, raccoonstealer, radar ineractive, radar tracking, ramnit, random domains, random hosts, rank, rank value, ransom, ransomexx, ransomware, Ransomware, raspberry robin, rat, recon, record type, record value, redline stealer, redlinestealer, redrum, red team, referrer, referring, refresh, regbinary, regdword, regex, registrar, registrar abuse, registrar url, registrar whois, registry domain, registry expiry, registry keys, regsetvalueexa, regsz, relacionada, relacionada con, related file, related nids, related pulses, relayrouter, relic, remote, remote attacker, remote attacks, remote system, replacement, replication, report, reputation ip, request, requested, resolutions, resource, resource hash, response, response ip, restart, revengeporn, revenge rat, revengerat, reverse dns, review, riskware, roberts, roboto, romantic poems, rostpay, roundup, router login, rufus, runescape, runtime data, russia unknown, sabey, safe browsing, safe site, sale, sample, samplepath, samples, sandbox, san jose, santana, satellite tracking, scan endpoints, scanning host, screenshot, script, script urls, search, search live, sec ch, secure server, security, security tls, seen asn, seen last, segoe ui, september, seraph, server, server ca, servers, service, services, service tool, serving ip, settingswpad, setup, sha1, sha256, sharecare, sharepoint, shell commands, shelltraywnd, shone pale, show, showing, siblings, siblings domain, sibot, silence, silencing, simda, singlehopllc, site, sites, skynet, skynet bot, slcc2, slingshot, smith, smoke loader, smsspy, smtp_gmail, snatch, sneaky server, snull, soa nxdomain, soc, social engineering, softcnapp, software, soldier, spacer, spammer, span, spark, spawns, spitmo, spotify artist, spyeye, spyware, sql, sqli dumper, squarespace, ssl cert, ssl certificate, st201601152, stalker, star, startpage, start service, state, status, status code, status hostname, stcalifornia, stealer, steam, steganography, stix, stop service, story, strings, stus, style, subdomains, subject key, subject public, submission, submit, submitters, sucurisec, summary, summary iocs, suppobox, suspected, suspicious, suspicious c2, svg scalable, swrort, system, systweak, t, t1063, t1189 found, ta0004 process, tag count, tag manager, tags none, target, targeting, tcp traffic, td td, team, team internet, team phishing, teams, teams api, team top, technology, telecom italia, telefonica co, temp, test, text archiver, than, thebrotherssabey, then brothers sabey, thinclient, this, thomsonreuters, thou bearest, threat, threat analyzer, threat network, threat report, threat round, threat roundup, threats, threats et, thu apr, tiggre, Timothy Pool, tiny, title, title error, tls sni, tlsv1 apr, tmobile, tmobileas21928, t-mobile hacker, tnhh quan, tofsee, tools, topic, topics, tor known, tor relayrouter, torrent trecker, tracker, tracking, traffic, trident, trojan, trojandropper, trojanspy, true, tsara brashears, ttl value, tucows, tucows domains, tue apr, tulach, twitter, type, type name, uchealth, umbrella rank, unauthorized, unicode, unicode text, union, united, united kingdom, unknown, unknown traffic, unlocker, unruy, unsafe, unsigned, updater, url analysis, url collection, url history, url http, url https, urls, urls date, urls http, urls https, url summary, urls url, ursnif, usd twitter, user, utc google, utc gtmsxrf, utc submissions, v2 document, v3 serial, validity, value, variables, vawtrak, vector graphics, verdict mobile, verify, vidar, view, virtool, virus network, virut, visible, void, vs2003, vskimmer, vt graph, vxstream, wacatac, wallpaper, WannaCry, warbot, waypoint object, weakmap, webcompanion, Web generator, webico company, web open, webtoolbar, webview, wed sep, westlaw, westlaw njrat, whitelisted, whois record, whois sslcert, whois whois, wide, wilstaging02, win16 ne, win32, win32 dll, win32 exe, win64, windir, windows nt, windows service, wiper, workers compensation, worm, worn, wow64, write, x509v3 key, x8bxe5, xml title, x powered, xrat, x sucuri, xtrat, xtreme, yandex, yara detections, yara rule, yndx, youth, zbot, zeus, zfglddkl58a url, zuorat

  • JARM: 29d3fd00029d29d21c42d43d00041d44609a5a9a88e797f466e878a82e8365

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 3880 4b8705afe9f4382196ec20166cae39afba332e5211f92c193739ab14aec78c01 dfe4866f59c3a8fdc58a8d79c9b3bb7b3bb718387e6d47b2f69fccb4dccd0c60 9512fab03f8d078cb69a34b4cf99e2cf052189ff74b55dbb2d178024e8a3cf8e b59f075dd2a78ea9faab51f956e54c3777d7aa45ee246c46d31e88a66899e61a 85b642aeaad6e1cf9bb69ba2b6beaca600433c4d4f4aa8571cfb00cfeb62fb8c 3cc5497036d46f28b5f1a463f57beee950326c74d1b284ac88a206d0a6eacae2 363a78304e851531b5ca30f2c49e24f7dea341d13d0c20ee1d01d05b937318e2 5a91e3ccba84a18bbb0d98476c151505498fa48a287a3d532faa18cd7d75d49b c9494c2e95d89a3944c27b7b063f4cb020df604829225be808afa11020a9d793 03bcbc29e669dbec57a3db372e403e449d9de691ff3a4d34e9d8f09fdf9a0a40

Open Ports Detected

2052 2053 2082 2083 2086 2087 443 8080 8443 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2025-06-23 anonymous-proxy-ip-list-2025-06-22

Share on: