104.16.87.20 Threat Intelligence and Host Information

Jun 24, 2025 ipinfopage

General

IP Address
104.16.87.20
IPv4 Address
Location
Unknown
Network
AS13335
CLOUDFLARENET
Threat Score
60/100
High Risk
19961tzva1ginaprincipala9diaaaaaacceptacceptch
Attack Intelligence
MITRE ATT&CK Techniques
T1003 - OS Credential Dumping, T1005 - Data from Local System, T1012 - Query Registry, T1027 - Obfuscated Files or Information, T1030 - Data Transfer Size Limits, T1031 - Modify Existing Service, T1035 - Service Execution, T1036 - Masquerading, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1043 - Commonly Used Port, T1045 - Software Packing, T1053 - Scheduled Task/Job, T1055.012 - Process Hollowing, T1055 - Process Injection, T1056.001 - Keylogging, T1056 - Input Capture, T1057 - Process Discovery, T1059.005 - Visual Basic, T1059.006 - Python, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1070 - Indicator Removal on Host, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1081 - Credentials in Files, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1090 - Proxy, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1105 - Ingress Tool Transfer, T1106 - Native API, T1110.002 - Password Cracking, T1110 - Brute Force, T1111 - Two-Factor Authentication Interception, T1112 - Modify Registry, T1114 - Email Collection, T1119 - Automated Collection, T1122 - Component Object Model Hijacking, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1158 - Hidden Files and Directories, T1173 - Dynamic Data Exchange, T1176 - Browser Extensions, T1179 - Hooking, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1222 - File and Directory Permissions Modification, T1410 - Network Traffic Capture or Redirection, T1423 - Network Service Scanning, T1427 - Attack PC via USB Connection, T1445 - Abuse of iOS Enterprise App Signing Key, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1450 - Exploit SS7 to Track Device Location, T1453 - Abuse Accessibility Features, T1472 - Generate Fraudulent Advertising Revenue, T1485 - Data Destruction, T1491 - Defacement, T1496 - Resource Hijacking, T1497.001 - System Checks, T1497 - Virtualization/Sandbox Evasion, T1518.001 - Security Software Discovery, T1518 - Software Discovery, T1543 - Create or Modify System Process, T1546.015 - Component Object Model Hijacking, T1546 - Event Triggered Execution, T1547.001 - Registry Run Keys / Startup Folder, T1547 - Boot or Logon Autostart Execution, T1552.001 - Credentials In Files, T1552 - Unsecured Credentials, T1555.003 - Credentials from Web Browsers, T1555 - Credentials from Password Stores, T1560 - Archive Collected Data, T1563 - Remote Service Session Hijacking, T1564 - Hide Artifacts, T1566 - Phishing, T1568 - Dynamic Resolution, T1569 - System Services, T1573 - Encrypted Channel, T1574 - Hijack Execution Flow, T1583.005 - Botnet, T1588.004 - Digital Certificates, T1588 - Obtain Capabilities, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0009 - Collection, TA0010 - Exfiltration, TA0011 - Command and Control
Open Ports Detected
2082
Geographic Location
Country
Unknown
City
Unknown
Region
Unknown
Coordinates
0.0000, 0.0000

Geographic coordinates not available for this IP.

Network Information
ASN
AS13335
Organization
CLOUDFLARENET
Network
AS13335 CLOUDFLARENET
WHOIS Information
NetRange
104.16.0.0 - 104.31.255.255
CIDR
104.16.0.0/12
NetName
CLOUDFLARENET
NetHandle
NET-104-16-0-0-1
Parent
NET104 (NET-104-0-0-0-0)
NetType
Direct Allocation
OriginAS
AS13335
Organization
Cloudflare, Inc. (CLOUD14)
RegDate
2010-07-09
Updated
2024-11-25
Comment
Geofeed: https://api.cloudflare.com/local-ip-ranges.csv
Ref
https://rdap.arin.net/registry/entity/CLOUD14
OrgName
Cloudflare, Inc.
OrgId
CLOUD14
Address
101 Townsend Street
City
San Francisco
StateProv
CA
PostalCode
94107
Country
US
OrgTechHandle
ADMIN2521-ARIN
OrgTechName
Admin
OrgTechPhone
+1-650-319-8930
OrgTechEmail
rir@cloudflare.com
OrgTechRef
https://rdap.arin.net/registry/entity/ADMIN2521-ARIN

Malware Detected on Host

Count: 3884 dcf9123cd9bcb550f7b25d26af1badad17728fe1eeb06fa42c371d466b740d70 f20a829f59c7178ba1c5e0c19a15a60f440b5aa1bb702157f7ccc56a5d624d6e 03189611b24362c13fb0f731d1ef1bcf12564beb269f3f00e9a73ea58f1f96f1 9791256f0f316b13f0e0cb2d3cf891681457a39a05e9a401e046131d9960277b cb577668797a8a39a33c232e475d21d8b8332016bdbb5912a37c44382486e779 2ec89fffe409457764f729962635405468cc599ec07c5294771acb6eab4663eb 14e9288321ee8f6fd5f275bb8a2a0f095c2a9d6f7fff847ba14ccbdab35fab0b e3d8cac38f193941b1862925198ecf4dfeff3f4ccf43c5e0f3182d656227062f 7b080d3f872f8c3374343b324ba0257fcf0696ad2f0cebeb636c89dc47849bdc a537173de1c6ae7653c13b68da0998effc9db07af274f5b700ff725d40181fc9

Disclaimer
This page contains threat intelligence information for the IPv4 address 104.16.87.20 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.