104.21.96.1
Classification: Whitelisted
104.21.96.1 is a whitelisted (trusted) IP address. Reported by 2 threat sources, last seen 2026-09-03. Network: AS13335 Cloudflare, Inc..
Current activity
- Content Delivery Network — Belongs to a CDN with many allocated resources.
- Hosting provider — Shared hosting infrastructure.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Matched whitelist source: Cloudflare | Maltiverse | 2026-07-19 17:17:25 | 2026-09-03 01:09:46 | benign | |
| Unknown RAT | ThreatFox Abuse.ch | 2025-05-24 08:17:06 | 2025-05-26 07:21:15 | malicious-activity | |
| Loki Password Stealer (PWS) | ThreatFox Abuse.ch | 2025-01-31 07:17:20 | 2025-01-31 07:17:20 | malicious-activity |
Tags
infostealer lokibot stealer port:80 burkina loki lokipws c2 connectwise screenconnect port:8443Whois information
- AS name
- AS13335 Cloudflare, Inc.
- AS registry
- arin
- AS date
- 2014-03-28 00:00:00
- AS CIDR
- 104.21.96.0/20
- CIDR
- 104.16.0.0/12
- Registrant
- Cloudflare, Inc.
- Address
- 101 Townsend Street
- City
- San Francisco
- State
- CA
- Postal code
- 94102
- Country
- US — United States 🇺🇸
- Contact email
- [email protected], [email protected], [email protected]
- First indexed
- 2025-01-31 07:17:20
- Last updated
- 2026-09-03 01:09:46