104.21.25.22 Threat Intelligence and Host Information

Dec 10, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 104.21.25.22 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 55/100

Host and Network Information

Mitre ATT&CK IDs: T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1057 - Process Discovery, T1059 - Command and Scripting Interpreter, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1105 - Ingress Tool Transfer, T1106 - Native API, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1546 - Event Triggered Execution
Tags: address, all octoseek, analyze, ascii text, august, auto-generated security, body length, bundled, cfqirgdhj5, cfqirgdhj5 http, cfqirgdhj5 url, ck id, code, communicating, contact, contacted, contacted urls, dropped, execution, factory, february, feeds ioc, file, final url, formbook, getprocaddress, gmt connection, gopher, headers date, historical ssl, hostnames, http, http response, hybrid, iocs, ioc search, july, kb body, localappdata, malware, mitre att, new ioc, njrat, obz4usfn0, obz4usfn0 http, obz4usfn0 url, passive dns, paste, path, post, putty, ransomware, referrer, resolutions, sample, scan endpoints, screenshot, serving ip, sfqh4dt74w0 url, sha256, show technique, ssl certificate, status code, teams api, temp, threat, threat analyzer, threat roundup, ukhdaauqaaaaaac, unique, urls, urls https, vj87, whois record, whois ssl, whois whois, windir
View other sources: Spamhaus VirusTotal
Contained within other IP sets: coinbl_hosts

Country:
Network:
Noticed: 8 times
Protocols Attacked: Anonymous Proxy
Countries Attacked: Japan
Passive DNS Results: booststudentsplus.co ragkbuang.tk cybersagpro.com mectx.com theamalfihotel.co.za fjslkvgbmg.site superbaketrust.shop bjkifz.shop basesphereusa.co imgz.pro cursor.linux-do.workers.dev rajajudislot-login.com www.simplexshop.ch spinsamba.fr operator-dev.carrotspot.io tracemode.com.cn oaacf.cn yhgg3.cc sso-dev.carrotspot.io f8bet80-m.com thejoineryshop.london webhook-dev.carrotspot.io comfyene.com ones.todopi.com human-resources-service-dev.carrotspot.io afinilstore.su arteslube.com api.arraysyams.org tracing.carrotspot.io clevelandcounty.info executivestays.nz felnaxo.top badak177og.space bet795bet.com easymove.lol loker.wldnasyrf.site defufbtufi.sa.com partner-stage.carrotspot.io animalautumneg.online www.fhladder.cloud fhladder.cloud yqdb.com.cn harmonizeinteriors.sbs 7jogosplataforma.sa.com qris-nobu.wldnasyrf.site styxghar.world gemmadash.xyz optionicon.com vodka-95.lat maventechview.com ckcbetao.com www.everlastingunitybeauty.xyz shpower-18.space casinomaniaitalia.net ivuvhq.info chicken-game.asia markienstat.com hls-rest.com kbet-plataforma.com www.nonteh.com ppp.ioetapp.us.kg online.erreforged.com 824811.xyz herobaru.lol nonteh.com www.capoeiracbv.se altesse4d-9.lat autostack.dev frosty.freemannick.us.kg ferbamshicacoyomud.online maildev.carrotspot.io justliftstudios.com www.justliftstudios.com onomping.com gameofthronescharacters.cc www.rewardconnected.co.uk rewardconnected.co.uk crimsonagility2.live ekomomu.top s21.zurvan-25x-00.top mainway.fun swrrussclxjr.cc hb63.cn cashaud.store supertotobets.org truthandjustice.com.au firmament-hold.com telearuiam.com www.shcofbuckhead.com gameclickertop.info locksmithlilburn.us wordpressemailoffice.info jiliaaabu.com rai-news-2025.info web.dzszhsq.com rmxpe.com ohphpq1s.22jsq.cc acrossboundaries.support rumboalbien.com beymenbet.com landoftheporing.com leadwithheartshop.com dikointe.de product-service-dev.carrotspot.io nymcu-usa.com www.nymcu-usa.com centerforboerneliv.dk quantumnest.biz.id codeinc.eu blogvacances.com phoenixind.co.uk wortebwr.info ehost.cam thechristmashunt.com agatss.com 63php777.com fantasy4.co.uk lambmc.pl besthbt.top kgn777k.com lzjwb.cn 333boi.icu northcountryfunds.com www.northcountryfunds.com mintleadsupdate.com omifb.link zhonghua.donglian01.workers.dev ksapi.xyz raisewithgilwellsercurities.com bobexpress.co.za tipperarytour.com chat.todopi.com estacao.arabesque.vc rrrm9login.com readdiscovernow.com clarityincrafting.store selinaexclusive.com luck44th.com 9xt0upm.top 939375.com cvo55555.com entervape.com wnoqtb.wiki ceriautama.site kopichetah.shop tuzlaescort.elitescorthatun.net pineperch.pro pinup-bonus.org holgersenbilsyn.dk orientapparel.org 9w9c.com.cn d7958.top q0spi.online api.aplikaceprava.cz 99442132.com www.99442132.com m.99442132.com www.newhavencarolina.com pulinsenjc.com blseiss.com admbakal.ru lieprodprices.xyz notesabroad.blog baja69link.com numeropg8.com kinanthiflorist.com uxiyini.top emmenia.site verdewheels.com 180ug.com snippetly.nl bluntis.site roaming.com mannaolasz.hu sathu.vip arable.beer 2288277.com koketka-boutique.ru newhavencarolina.com djbetoi.com 868brlogin.com infgfhky.pics sergioproff.club getrecharmscaling.com ukmac.info ydamen.cn blackmur.space codisevand.es www.sailormoonaddiction.com sailormoonaddiction.com atm2win.info pp365-8.com hello-world-shiny-star-9b2e.koxohem932.workers.dev bienestartotaly.com zeus016.club zupanijakarlovacka.eu.com byi56.party olo4dv.lat fusionlocumtenens.com fpqcolors.top onixon.net xuzhihealing.com www.zlc001.com zlc001.com d7v.merairloc.com vanaartstudio.com swap50x-proair.com orivonza.com godaiviet.com alvancedportfolio.top dc8388.com pulpmould.com.cn performance.carrotspot.io www.bigestshop.site corida.click retoneyoudg.xyz www.coodub.com coodub.com zoomorphys.cloud mintedblend.co.uk rapid-venture.com chickenroad-cz.site resourcebold.com ju88xx.com marcocantu.it osp7islandsig.online dotsperiod.com aminolife.ru oeffentlicuphess.com kwork.ru.com feltrivan.eu sepakgoal.xyz 0755qingxi.cn shopcz.online academy.iacodelabs.com.br healthysquid.com 5567betk.com daribong.co.kr 98stock.cn valerithosuno.sbs colindaleskiphire.org.uk miyue1432.cc xalaflix.lifestyle is-mega.gay www.creativestocksa.online improvingcompetera.com url-hub.sbs bellagionailsandspahartselle.com newomegaflow.com lschgjggs.com nmwty8fcos.vip deucedrop.com better-wise.com datplot.com ksd-defender.pro psufuci.info api-performance.carrotspot.io www.softassteel.com lisinopril.gb.net udafedo.top shiftplatform.sbs nathankaffes-portfolio.com lztor.com highflybett.net longzhian.com organization-service-dev.carrotspot.io external-qa.carrotspot.io creativestocksa.online balonynadprahou.cz fdsnkj.com robdrives.com bo.ccpay8.cc workorder-app.mindloops.io visclmh.site lqhrx.cn theshoulderofmuttoninn.co.uk hizophpxlgbhg.shop kenstrat.com www.kenstrat.com dev.carrotspot.io ma.maroc-sahifa.info bc-game-bonus-code.com garvara.shop ddeea.com metabahislink.com vvvm9-win.com linkloginsotgacor.org blackmirrorclub.xyz lerosairedesarmeespop.shop arts-kassa.live quran.yaqiin.org szofwk.top toru.id olxrep-uah.startrek-f75.workers.dev short.lnk8.co overvuehq.com beautysalonengelmann.de www.swaggerhaircut.com zubiron.top www.biaxyzoqi.xyz china-ictc.com doutorvaluation.com.br sarl-quentel.fr luveq.com www.luveq.com www.svoemmebassin.dk teamfusionline.shop gsfubang.com semanggiyuk.site www.axignfootwearava.shop kkhlman.xyz palmcode.online yukatalism.com estasfetapost.xyz www.fk77.cyou www.mynextstep.shop mymichelinjourney.net grnvioo.online www.nadegeallesinaz.shop nadegeallesinaz.shop zzbjsf.top ofiseda.top kjfg1v.cn shirbt2025-hrjbnbrbn.ru.com trix-62.fun www.mishrasclinics.in williammo-on.timothypollock1988.workers.dev moyvrtq.lat kera368.info www.i9papelariafofa.com.br www.dayan-print.co.il motorbekassarmi.my.id valueorientedweddings.beauty rsuwa.cn www.site-oficial-curso-completo.com simplewellnesscircle.run graficamatipe.net argentinaw.cn strautmann.us pandamhesiya.daftarmenu.xyz quicktrail.site gayporno4free.com whlsys.com getlackh.shop liangqiqipai.net celestebranch.shop sfractionalout.com www.nexobet-88.info aurevionteklo.sbs farabeautylounge.com foodzo.in iser.co nexobet-88.info kryzanex.com justinvallandingham.com gzcdyx.com fresnobusinessads.com www-paliypal-portfoilio.pro trostrudconstruction.com sdsjsh.cn qdmanruinuo.cn iph-track.tools maipor.cat 8opp6pdyfrsvnt.xyz rhaoacabvcyxb.shop reviewphim.store slywhale.pro rimouskihyundai.com atomystore.shop areariservata-lng.com canvstore.com wukongjitu77.com nryyzlsxamvb.cc i9papelariafofa.com.br lgcaps.shop maroc-sahifa.info h1.dinamisgame.biz.id pagbet.it.com payment.ccpay8.cc standrewshamperco.com r7games.ru dinamisgame.biz.id www.dinamisgame.biz.id puunkaatokarkkila.fi hubfqr.info bloxuh-feed.icu onetreehillfans.com yizhudl.com www.pharmavisionlabs.com milandbay.com uzycy-yly.store bibekshresthaphotography.com temegramg.com tmtsv7.com ilbet.uno fk77.cyou bsnmedicalgraphics.com e200mpromo.guru matsuno-co.com outboundemal.us dayan-print.co.il fitfeed.org zabezpeczonapaczka.icu www.exchangeglobal.net ldug.vip freevideopokergames.com rivenfighterassassin.com prof-cps.ru in-telli-hub.com great-event.live waxyamwil.top goztepeescort.elitescorthatun.net jackzzi.com l2742.vip futurearclith.online god-ofcoins.com performheavilyquickthe-file.top gamecoc5.vip crt4q5.schuh-widemann.de 2jzrfe.schuh-widemann.de pv1qa8.schuh-widemann.de 0kzdn9.schuh-widemann.de vdi2qo.schuh-widemann.de mp1fhu.schuh-widemann.de jldqf1.schuh-widemann.de qe3i2c.schuh-widemann.de fvhbn8.schuh-widemann.de a4z2jp.schuh-widemann.de 82nisv.schuh-widemann.de f8idok.schuh-widemann.de 3ei9xv.schuh-widemann.de vmyi2p.schuh-widemann.de d46pqw.schuh-widemann.de n7g3sm.schuh-widemann.de df8uze.schuh-widemann.de 8brcdo.schuh-widemann.de qa2d1r.schuh-widemann.de daricq.schuh-widemann.de 7vtd5o.schuh-widemann.de pfdwio.schuh-widemann.de nzto7d.schuh-widemann.de bsx7gt.schuh-widemann.de oxr3zy.schuh-widemann.de jmozu9.schuh-widemann.de 86xzh4.schuh-widemann.de y6tlhg.schuh-widemann.de jh67rx.schuh-widemann.de t1j84p.schuh-widemann.de 7016sm.schuh-widemann.de 04duc1.schuh-widemann.de ngaw14.schuh-widemann.de jb26zr.schuh-widemann.de ajpnkc.schuh-widemann.de mqwoxh.schuh-widemann.de w0jor5.schuh-widemann.de anfu10.schuh-widemann.de j2wpvg.schuh-widemann.de v3puqi.schuh-widemann.de 7fy0ws.schuh-widemann.de mftd6h.schuh-widemann.de 8hydaf.schuh-widemann.de gcb3k2.schuh-widemann.de ang80x.schuh-widemann.de mq873u.schuh-widemann.de fcxkv6.schuh-widemann.de hi0pbf.schuh-widemann.de kovzm8.schuh-widemann.de ird7px.schuh-widemann.de f07qvp.schuh-widemann.de xtm3ln.schuh-widemann.de 7pl3xg.schuh-widemann.de q54gmf.schuh-widemann.de 90k4md.schuh-widemann.de pkuh6l.schuh-widemann.de z7dt89.schuh-widemann.de c7vlex.schuh-widemann.de wc6mun.schuh-widemann.de x6f8hq.schuh-widemann.de td8pen.schuh-widemann.de unt8my.schuh-widemann.de 07l2y1.schuh-widemann.de i3b682.schuh-widemann.de s30796.schuh-widemann.de sey8uz.schuh-widemann.de 3rysmh.schuh-widemann.de m0gcl2.schuh-widemann.de u1yg5h.schuh-widemann.de ziuh31.schuh-widemann.de pru6b9.schuh-widemann.de qtsgfa.schuh-widemann.de in58te.schuh-widemann.de vajz2b.schuh-widemann.de k0f1t8.schuh-widemann.de 038zd7.schuh-widemann.de rkilhm.schuh-widemann.de 8zcyq3.schuh-widemann.de 7px5gr.schuh-widemann.de a52bm6.schuh-widemann.de rpdn05.schuh-widemann.de se8lr1.schuh-widemann.de

Open Ports Detected

2052 2053 2082 2083 2086 2087 2095 2096 443 80 8080 8443 8880

Map

Whois Information

NetRange: 104.16.0.0 - 104.31.255.255
CIDR: 104.16.0.0/12
NetName: CLOUDFLARENET
NetHandle: NET-104-16-0-0-1
Parent: NET104 (NET-104-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Cloudflare, Inc. (CLOUD14)
RegDate: 2014-03-28
Updated: 2024-09-04
Comment: All Cloudflare abuse reporting can be done via https://www.cloudflare.com/abuse
Comment: Geofeed: https://api.cloudflare.com/local-ip-ranges.csv
Ref: https://rdap.arin.net/registry/ip/104.16.0.0
OrgName: Cloudflare, Inc.
OrgId: CLOUD14
Address: 101 Townsend Street
City: San Francisco
StateProv: CA
PostalCode: 94107
Country: US
RegDate: 2010-07-09
Updated: 2024-11-25
Ref: https://rdap.arin.net/registry/entity/CLOUD14
OrgAbuseHandle: ABUSE2916-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-650-319-8930
OrgAbuseEmail: abuse@cloudflare.com
OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2916-ARIN
OrgNOCHandle: CLOUD146-ARIN
OrgNOCName: Cloudflare-NOC
OrgNOCPhone: +1-650-319-8930
OrgNOCEmail: noc@cloudflare.com
OrgNOCRef: https://rdap.arin.net/registry/entity/CLOUD146-ARIN
OrgRoutingHandle: CLOUD146-ARIN
OrgRoutingName: Cloudflare-NOC
OrgRoutingPhone: +1-650-319-8930
OrgRoutingEmail: noc@cloudflare.com
OrgRoutingRef: https://rdap.arin.net/registry/entity/CLOUD146-ARIN
OrgTechHandle: ADMIN2521-ARIN
OrgTechName: Admin
OrgTechPhone: +1-650-319-8930
OrgTechEmail: rir@cloudflare.com
OrgTechRef: https://rdap.arin.net/registry/entity/ADMIN2521-ARIN
RAbuseHandle: ABUSE2916-ARIN
RAbuseName: Abuse
RAbusePhone: +1-650-319-8930
RAbuseEmail: abuse@cloudflare.com
RAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2916-ARIN
RNOCHandle: NOC11962-ARIN
RNOCName: NOC
RNOCPhone: +1-650-319-8930
RNOCEmail: noc@cloudflare.com
RNOCRef: https://rdap.arin.net/registry/entity/NOC11962-ARIN
RTechHandle: ADMIN2521-ARIN
RTechName: Admin
RTechPhone: +1-650-319-8930
RTechEmail: rir@cloudflare.com
RTechRef: https://rdap.arin.net/registry/entity/ADMIN2521-ARIN

Links to attack logs

Share on: