104.16.87.20 Threat Intelligence and Host Information

Jun 24, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.16.87.20 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 60/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1005 - Data from Local System, T1012 - Query Registry, T1027 - Obfuscated Files or Information, T1030 - Data Transfer Size Limits, T1031 - Modify Existing Service, T1035 - Service Execution, T1036 - Masquerading, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1043 - Commonly Used Port, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055.012 - Process Hollowing, T1055 - Process Injection, T1056.001 - Keylogging, T1056 - Input Capture, T1057 - Process Discovery, T1059.005 - Visual Basic, T1059.006 - Python, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1070 - Indicator Removal on Host, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1081 - Credentials in Files, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1090 - Proxy, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1105 - Ingress Tool Transfer, T1106 - Native API, T1110.002 - Password Cracking, T1110 - Brute Force, T1111 - Two-Factor Authentication Interception, T1112 - Modify Registry, T1114 - Email Collection, T1119 - Automated Collection, T1122 - Component Object Model Hijacking, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1158 - Hidden Files and Directories, T1173 - Dynamic Data Exchange, T1176 - Browser Extensions, T1179 - Hooking, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1222 - File and Directory Permissions Modification, T1410 - Network Traffic Capture or Redirection, T1423 - Network Service Scanning, T1427 - Attack PC via USB Connection, T1445 - Abuse of iOS Enterprise App Signing Key, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1450 - Exploit SS7 to Track Device Location, T1453 - Abuse Accessibility Features, T1472 - Generate Fraudulent Advertising Revenue, T1485 - Data Destruction, T1491 - Defacement, T1496 - Resource Hijacking, T1497.001 - System Checks, T1497 - Virtualization/Sandbox Evasion, T1518.001 - Security Software Discovery, T1518 - Software Discovery, T1543 - Create or Modify System Process, T1546.015 - Component Object Model Hijacking, T1546 - Event Triggered Execution, T1547.001 - Registry Run Keys / Startup Folder, T1547 - Boot or Logon Autostart Execution, T1552.001 - Credentials In Files, T1552 - Unsecured Credentials, T1555.003 - Credentials from Web Browsers, T1555 - Credentials from Password Stores, T1560 - Archive Collected Data, T1563 - Remote Service Session Hijacking, T1564 - Hide Artifacts, T1566 - Phishing, T1568 - Dynamic Resolution, T1569 - System Services, T1573 - Encrypted Channel, T1574 - Hijack Execution Flow, T1583.005 - Botnet, T1588.004 - Digital Certificates, T1588 - Obtain Capabilities, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0009 - Collection, TA0010 - Exfiltration, TA0011 - Command and Control

  • Tags: 1996, 1tzv, a1ginaprincipal, a9dia, aaaa, accept, accept ch, accept encoding, access denied, access ta0001, acint, activator, active threat, activity, adams co, adblock pro, address, address domain, address first, address google, address range, addtopayload, adload, adobe air, adobe portable, a domains, adversaries, adware, adware affiliate, af81 http, a fleecy, agency, agent, ai, aig, AIG Claims, akamaias, alexa, alexa proxy, alexa top, alf features, algorithm, alina, allocation type, all octoseek, all scoreblue, all search, amazon, amazon 02, amazon02, amazonaes, amazons3 tls, analyzer paste, analyzer threat, android, andromeda, anonymisation, anonymizer, antivirus, antivm_network_adapters, antivm_queries_computername, a nxdomain, apache, api blog, appdata, apple, appleaustin, apple engineering, apple ios, apple notepad, apple phone, apple unlocker, applicunwnt, april, artemis, as13335, as133618, as13768 aptum, as139021, as14061, as14720 gamma, as15169 google, as16276, as16552 tiggee, as16625 akamai, as19237 omnis, as19527 google, as20068 hawk, as20940, as212913 fop, as22169 omnis, as22489, as22612, as23393, as2914 ntt, as29789, as30148 sucuri, as31898 oracle, as36459, as39122, as396982, as396982 google, as397240, as397241, as40509, as4230 claro, as43350 nforce, as44273 host, as47846, as49453, as54113, as55286, as60558 phoenix, as61969 team, as62597 nsone, as6724 strato, as7018 att, as7922 comcast, as8068, as8075, as autonomous, ascii text, asn15169, asn16276, asn209242, asn4583, asnone, asnone united, asyncrat, athena, attack, attacking, attention, august, available from, avast avg, awful, azorult, azorult cnc, azure tls, back, backdoor, bambernek, bambernek gen, bambernek simda, banco, bandoo, bank, banker, basic, bayrob, bazaloader, b body, beach research, beginstring, behav, beijing gu, benjamin, best targets, betabot, binary file, bitrat, bitrep, blackhat, blacklist, blacklist http, blacklist https, blacknet rat, blocklist, body, body doctype, body html, body length, boot, bot, botnet campaign, botnet command and control, botnetwork, bradesco, brazil, brazil unknown, brent kimball, brian sabey, browser, c2, C2, camera usage, canada unknown, cape, catalog tree, cbe cnalphassl, cdn amazon, center, centerchecks, certificate, cgb stgreater, checked url, checkin, checks_debugger, child teen content illegal, china, china as4134, china education, china telecom, china unicom, Christopher Pool, chrome, cidr, cins active, ciphersuite, cisco, cisco umbrella, citadel, ck id, class, classic poems, classname, cleaner, click, clickjacking, clipper dos, close, cloudflare, cloudflarenet, cloudfront, cloud host, cname, cnc, cnc feodo, cnc server, cndigicert sha2, cnus, coalition et, cobalt strike, cobaltstrike, code, coinminer, collection, collections, colorado, com laude, command and control, command_and_control, commerce, communicating, comodo rsa, comodo valkyrie, company limited, compiler, computer, conduit, cong ty, connect azurepc, connection, contact, contacted, contacted urls, contact phone, contained, content generating, content length, content reputation, content type, control server, cookie, copy, copyright, core, corruption, country, country unknown, cover up, covid19, cps https, crack, create, created, creation date, critical, critical risk, cronup threat, crypto, csc corporate, cultureneutral, cus cnmicrosoft, cus olet, customer, cve201711882, cve202322518, CVE-2023-4966, cyber attack, cyber crime, cyberlynk, cybersecurity, cyber stalking, cyberstalking, cyber threat, cyberthreat, cyberwar, cymulate, dan.com, dangeroussig, dark consultants, darkgate, data, database, data center, date, date checked, date hash, date mon, dat ngoc, dau tu, december, deepscan, default, defense evasion, de indicators, delete, delete c, deleted, deleted virustotal graphs, deleting, de page, de summary, detail domains, detection list, detections file, detections type, device control, dexter, dga, diamondfox, digital culture, digital press, discovery, district, div div, djcodychase.com, dll sideloading, dns, dns lookup, dnspionage, dns records, dns replication, dns resolutions, dnssec, docs pricing, document file, document format, dofoil, domain, domain name, domain related, domain robot, domains, domains show, domain tree, dos com, dos exe, downer, downldr, download, downloader, dridex, driverpack, drivertalent, dropped, dropper, duckdns, dumped_buffer, duo insight, dynadot llc, dynamicloader, e1082 impact, e1203 data, e1564 discovery, ecc domain, ecdhersa, ec oid, edsaid, el0kpmhlfz, elf collection, email, emails, emailworm, emotet, emotet ip, encdoc, encrypt, encrypt cnr3, engineering, english, enosch, enosch malware, enter, enter rexxfield, entity amazon4, entries, entrust, erase, error, et, et cins, eternalblue, etpro malware, et tor, et useragents, evasion ob0006, evil, evil c, excel, exe32, executable, execution, exit, expiration, expiration date, expires thu, expirestue, expl, exploit, exploitation, extraction, facebook, factory, fakealert, fakedout threat, falcon, falcon sandbox, fcc, february, feodo, file, filehashmd5, filehashsha1, filehashsha256, filerepmetagen, files, file samples, files domain, files ip, file size, files location, files matching, files related, filetour, file type, final url, financial, find, findwindowa, firehol, first, flag united, flow t1574, follow, font format, footer, form, formbook, formbook cnc, for privacy, frames domain, france mail, france unknown, frankfurt, free poems, friendship poems, fuery, fusioncore, g2 oglobalsign, gamers, gandi sas, gb summary, gecko, general, general full, generator, generic, generic malware, generic windos, genkryptik, gen.o, geotracking, germany, germany unknown, get h2, get http, get na, getprocaddress, github pages, gk4vnlmd3b9, glupteba, gmbh version, gmt content, gmt server, gmt setcookie, gmt united, goldfinder, google, gootloader, graph community, graph summary, greatness, group, gsqueue, gts ca, guard, gui32, gvt, hacked by phone call, hacker, hackers, hacking, hacktool, hallrender, hallrender.com, handle, hash, hashes, hawkeye, header click, header intel, headers, headers date, head title, heaven, heavens, her beam, herself, heur, hidden users, hide artifacts, high, high level, highly targeted, high process, high security, historical, historical ssl, history, hitmen, homepage, hong kong, host, hosting, hostname, hostnames, hostname server, html, html info, http, http attacker, http header, httponly, http request, http requests, http response, hybrid, icedid, ice fog, icloud, icmp, identifier, ids detections, iframe, ii llc, illegal, illegal practices, incapsula, indicator, indicator facts, indonesia, industry_and_commerce, info, info compiler, info header, information, infrastructure, infy, ingestion time, inject, injection t1055, inmortal, installcore, installer, installpack, intel, internal, internapblk4, internet storm, invalid url, iobit, iocs, ioc search, Iowa.gov, ip address, ipasns ip, ip detections, ip information, ip reputation, ip summary, ip tcp, ipv4, ireland unknown, isotope, issuer, issuing ca, it’s back, jackpos, january, java, javascript, jeffrey reimer pt, jpeg image, js, json data, july, june, junk data, kali, kangen, kb acrotray, kb body, kb file, kb image, kb program, keitaro, key algorithm, key identifier, key info, keylogger, kgs0, khtml, killav, kls0, known tor, kong asn, kraken, kryptik, kuaizip, language, laplasclipper, law, leasewebuklon11, legal, less see, librouter, life, limited, link, linker, linkid252669, links certs, llc registry, lmenlo park, local, localappdata, location, location hong, location united, lockbit, login, logon autostart, loki, london, look, love poems, lowfi, ltd dba, lumma stealer, magniber, mail collection, mail spammer, main, makop, maliciosa, malicious, malicious site, malicious url, maltiverse, maltiverse safe, maltiverse top, malvertizing, malware, malware generic, malware host, malware scripting, malware site, malware spreader, manjusaka, march, mark, mark brian sabey, markmonitor, masquerading, matches rule, matsnu, mb iesettings, mb opera, mb super, media, media center, mediaget, medium, memcommit, memory pattern, message interception, meta, metastealer, meta tags, meterpreter, metro, metro hacker, microsoftcorpas, milemighmedia, million, mimikatz, mirai, misc attack, mitre att, mitre attack, modification, modifies_proxy_wpad, modify system, monitoring, mon jul, moved, mozilla, mr windows, msie, ms visual, ms windows, mtb apr, mtb jul, multiple botnetworks, mumblehard, murderers, music, mwin, my boy dan, name, namecheap inc, name md5, name servers, name value, name verdict, nameweb bvba, nanocore, nanocore rat, net18160001, net1832001, netgear router, netgear twitter, netherlands, netsky, network, network capture, network_http, network_icmp, network name, network rat, networks, network_smtp, network traffic, neutrino, new ioc, next, nginx, ninite, nircmd, nivdort, njrat, no data, node tcp, node traffic, no expiration, noname057, nosy pega, november, nr agent, nreum, nsisinetc, null, number, nxdomain, nymaim, ob0005 defense, ob0007 system, ob0012 hide, object, obz4usfn0 http, oc0008, october, odigicert inc, ollydbg, ometa platforms, open, opencandy, openioc, optimizer, os2 executable, otx octoseek, outbreak, outlook, overlay, ovh sas, page url, parent parent, passive dns, password, password bypass, paste, patcher, path, pattern match, pcap, pcidump rasman, pdf document, pdf report, pe32, pe32 compiler, pe32 executable, pe32 packer, pe resource, persistence, persistence_autorun, phase, phi, phishing, phishingms, phishing site, phishtank, phone hacking, pii, pjp3sltkz, plasma, playgame, please, plugx, png image, poem, poems, poem topics, poetry, pony, Pool’s Closed, poor reputation, porkbun llc, porn, pornhub, pornographers, portugal, possible, possiblecerber, post, post http, pragma, presenoker, present feb, present mar, privacy inc, probe, problems, processes tree, process t1543, productidis, products id, protocol h2, proud evening, proxy, psiusa, ps ord, pte ltd, public key, pulse indicator, pulse pulses, pulse submit, push, pykspa, python, python connection, q0gpyr1balpdgpo, qakbot, qbot, qdkxgr24yz, quasar rat, quasi, query type, raccoon, raccoonstealer, radar ineractive, radar tracking, ramnit, random domains, random hosts, rank, rank value, ransom, ransomexx, ransomware, Ransomware, raspberry robin, rat, recon, record type, record value, redirects, redline stealer, redlinestealer, redrum, red team, referrer, referring, refresh, regbinary, regdword, regex, registrar, registrar abuse, registrar url, registrar whois, registry domain, registry expiry, registry keys, regsetvalueexa, regsz, relacionada, relacionada con, related file, related nids, related pulses, relayrouter, relic, remote, remote attacker, remote attacks, remote system, replacement, replication, report, reputation ip, request, requested, resolutions, resource, resource hash, response, response ip, restart, revengeporn, revenge rat, revengerat, reverse dns, review, rich content, riskware, roberts, romantic poems, rostpay, roundup, router login, rufus, runescape, russia unknown, sabey, safe browsing, safe site, sale, sample, samplepath, samples, sandbox, san jose, satellite tracking, scan endpoints, scanning host, screenshot, script, script urls, search, search live, sec ch, secure server, security, security tls, seen asn, seen last, september, seraph, server, server ca, server response, servers, service, services, service tool, serving ip, settingswpad, setup, sha1, sha256, sharecare, shell commands, shelltraywnd, shone pale, show, showing, siblings, siblings domain, sibot, silence, silencing, simda, singlehopllc, site, sites, skynet, skynet bot, slcc2, slingshot, smith, smoke loader, smsspy, smtp_gmail, snatch, sneaky server, soa nxdomain, soc, social engineering, softcnapp, software, spammer, span, spawns, spitmo, spotify artist, spyeye, spyware, sql, sqli dumper, squarespace, ssl cert, ssl certificate, st201601152, stalker, star, startpage, start service, state, status, status code, status hostname, stcalifornia, stealer, steam, steganography, stix, stop service, strings, stus, style, subdomains, subject key, subject public, submission, submitters, sucurisec, summary, summary iocs, suppobox, suspected, suspicious, suspicious c2, svg scalable, swrort, system, systweak, t, t1063, t1189 found, ta0004 process, tag count, tag manager, tags none, target, targeting, tcp traffic, td td, team, team internet, team phishing, teams, teams api, team top, technology, telecom italia, telefonica co, temp, text archiver, than, thebrotherssabey, then brothers sabey, thinclient, thomsonreuters, thou bearest, threat, threat analyzer, threat network, threat report, threat round, threat roundup, threats, threats et, thu apr, tiggre, Timothy Pool, title, title error, tls sni, tlsv1 apr, tmobile, tmobileas21928, t-mobile hacker, tnhh quan, tofsee, tools, topic, topics, tor known, tor relayrouter, torrent trecker, tracker, tracking, traffic, trojan, trojandropper, trojanspy, tsara brashears, ttl value, tucows, tucows domains, tue apr, tulach, twitter, type, type name, ua9385760744, uchealth, umbrella rank, unauthorized, unicode text, union, unique, united, united kingdom, unknown, unknown aaaa, unknown cname, unknown traffic, unlocker, unruy, unsafe, unsigned, updater, url analysis, url collection, url history, url hostname, url http, url https, urls, urls date, urls http, urls https, urls server, urls show, url summary, urls url, ursnif, usd twitter, user, utc google, utc gtmsxrf, utc na, utc submissions, v2 document, v3 serial, validity, value, variables, vawtrak, vector graphics, verdict mobile, verify, vidar, view, virtool, virus network, virut, vs2003, vskimmer, vt graph, wacatac, WannaCry, warbot, waypoint object, webcompanion, Web generator, webico company, web open, webtoolbar, wed sep, westlaw, westlaw njrat, whitelisted, whois record, whois server, whois sslcert, whois whois, wide, win16 ne, win32, win32 dll, win32 exe, win64, windir, windows nt, windows service, wiper, workers compensation, worm, worn, wow64, write, x509v3 key, x8bxe5, xml title, x powered, xrat, x sucuri, xtrat, xtreme, yandex, yara detections, yara rule, yndx, zbot, zeus, zfglddkl58a url, zuorat

  • JARM: 29d3fd00029d29d21c42d43d00041d44609a5a9a88e797f466e878a82e8365

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 3884 dcf9123cd9bcb550f7b25d26af1badad17728fe1eeb06fa42c371d466b740d70 f20a829f59c7178ba1c5e0c19a15a60f440b5aa1bb702157f7ccc56a5d624d6e 03189611b24362c13fb0f731d1ef1bcf12564beb269f3f00e9a73ea58f1f96f1 9791256f0f316b13f0e0cb2d3cf891681457a39a05e9a401e046131d9960277b cb577668797a8a39a33c232e475d21d8b8332016bdbb5912a37c44382486e779 2ec89fffe409457764f729962635405468cc599ec07c5294771acb6eab4663eb 14e9288321ee8f6fd5f275bb8a2a0f095c2a9d6f7fff847ba14ccbdab35fab0b e3d8cac38f193941b1862925198ecf4dfeff3f4ccf43c5e0f3182d656227062f 7b080d3f872f8c3374343b324ba0257fcf0696ad2f0cebeb636c89dc47849bdc a537173de1c6ae7653c13b68da0998effc9db07af274f5b700ff725d40181fc9

Open Ports Detected

2082 2083 2086 2087 443 80 8080 8443 8880

Map

Whois Information

Links to attack logs

anonymous-proxy-ip-list-2023-07-15 anonymous-proxy-ip-list-2023-06-28 anonymous-proxy-ip-list-2025-06-23 ****** anonymous-proxy-ip-list-2023-07-10 anonymous-proxy-ip-list-2025-06-22 anonymous-proxy-ip-list-2023-06-30 anonymous-proxy-ip-list-2023-07-16 anonymous-proxy-ip-list-2023-07-09 anonymous-proxy-ip-list-2023-07-08 anonymous-proxy-ip-list-2023-06-22 anonymous-proxy-ip-list-2023-07-02 ****** anonymous-proxy-ip-list-2023-07-03 ******

Share on: