- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- IP address
- 104.21.55.221
- Version
- v4
- Country
- United States
- City
- San Francisco
- Region
- CA
- CIDR
- 104.21.0.0/17
- Network range
- 104.16.0.0-104.31.255.255
- ASN
- 13335
- AS owner
- Cloudflare, Inc.
- ISP
- Cloudflare, Inc.
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Relationship context
5 related indicators are shown across 1 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections6%
Relationship context5 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
0%
zip
1259 bytes
communicates
Filename
CUMESVFOOOPLCZYUI.zip
File type
zip
MIME
application/zip
Size
1259
SHA1
b3759aa387aad45933528ceba2c47e99950b8a8d
27%
high
pdf
135814 bytes
communicates
Filename
ProjectUpdate-X.pdf
Family
phishingx
Type
trojan
File type
pdf
MIME
application/octet-stream
0%
xlsx
578413 bytes
communicates
Filename
Sathilab.com-14-Oct-23.xlsx
File type
xlsx
MIME
application/octet-stream
Size
578413
SHA1
247d9d13d3ebb7098406d5ea80845888fa45e76a
0%
vba
1359 bytes
communicates
Filename
CUMESVFOOOPLCZYUI.bat
Type
malware
File type
vba
MIME
text/plain
Size
1359
10%
high
html
38269 bytes
communicates
Filename
ZFAKY64G
Family
scrinject
Type
trojan
File type
html
MIME
text/html
Analysis details
Severity: low
Freshness: Fresh · Last seen today.
- Detection rate
- 6%
- detection
- 6 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- IP address
- 104.21.55.221
- Version
- v4
- Country
- United States
- City
- San Francisco
- Region
- CA
- CIDR
- 104.21.0.0/17
- Network range
- 104.16.0.0-104.31.255.255
- ASN
- 13335
- AS owner
- Cloudflare, Inc.
- ISP
- Cloudflare, Inc.
- Organization
- Cloudflare, Inc. (CLOUD14)/Cloudflare, Inc.
- Network type
- datacenter
- First seen
- 2023-09-30T08:39:41Z
- Last seen
- 2026-11-10T23:01:33Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Relationship context
5 related indicators are shown across 1 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
6 timestamped observations are arranged from 2022-11-14 to 2025-12-09. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
1 relationship group(s) provide pivot and infrastructure context.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Network profile
summarySelected network intelligence summary.
- CIDR
- 104.21.0.0/17
- Network range
- 104.16.0.0-104.31.255.255
- ASN
- 13335
- AS owner
- Cloudflare, Inc.
- Organization
- Cloudflare, Inc. (CLOUD14)/Cloudflare, Inc.
- ISP
- Cloudflare, Inc.
- Network type
- datacenter
- Country
- United States
- City
- San Francisco