188.114.96.6 Threat Intelligence and Host Information

Sep 03, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 188.114.96.6 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 57/100

Host and Network Information

Mitre ATT&CK IDs: T1012 - Query Registry, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036 - Masquerading, T1040 - Network Sniffing, T1041 - Exfiltration Over C2 Channel, T1043 - Commonly Used Port, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056.001 - Keylogging, T1057 - Process Discovery, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1064 - Scripting, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1089 - Disabling Security Tools, T1096 - NTFS File Attributes, T1105 - Ingress Tool Transfer, T1106 - Native API, T1112 - Modify Registry, T1114 - Email Collection, T1119 - Automated Collection, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1176 - Browser Extensions, T1179 - Hooking, T1204 - User Execution, T1410 - Network Traffic Capture or Redirection, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1480 - Execution Guardrails, T1496 - Resource Hijacking, T1497 - Virtualization/Sandbox Evasion, T1543 - Create or Modify System Process, T1547 - Boot or Logon Autostart Execution, T1562 - Impair Defenses, T1566 - Phishing, T1583.005 - Botnet, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0011 - Command and Control
Tags: 114.114.114.114, 198-46-194-153-host.colocrossing.com, aaaa, aaaa nxdomain, abuse contact, abuseipdb, accept, acint, activity beacon, adapter driver, adaptivebee, added active, address, address domain, address range, adload, admin, admin country, admin id, a domains, ad temdac, adult content, adversaries, adware, agent, agenttesla, akamai, alert, alerts, alexa, alexa top, algorithm, allocation type, all octoseek, allowed date, all scoreblue, all search, ally s, america city, analyzer paste, analyzer threat, android, anonymisation services, Anonymizer, anorexx, a nxdomain, apache, api, api call, apk, appdata, appdatalocal, apple, apple as8075, apple ios, april, arizona, artemis, as10753 level, as10796 charter, as11351 charter, as11426 charter, as11427 charter, as12271 charter, as133618, as15133 verizon, as16625 akamai, as16787 charter, as174 cogent, as19536 directv, as20001 charter, as20115 charter, as204601 zomro, as20940, as24940, as24940 hetzner, as26710, as26710 icann, as28521, as31898 oracle, as33363 charter, as3379 kaiser, as3456 charter, as36352, as39494 jsc, as396982 google, as40021 contabo, as40528 icann, as44273 host, as47846, as47995, as51167 contabo, as53418, as54113, as5742, as60664 xion, as6976 verizon, as7018 att, as701 verizon, as7843 charter, as797 att, as8075, ascii text, asn as133618, asnone, asnone germany, asnone united, assigned pa, attack, attacker, attorney, attorney james, august, australia, authority, avast avg, azorult, back, backdoor, bad traffic, bandoo, bank, banker, banking, beginstring, behav, benchhttp, benjamin, binary file, binder, bittorrent dht, blackievirus.com, blacklist, blacklist http, blackshades, bladabindi, body, body doctype, body head, body length, boost mobile, Botnet Command and Control, br, bradesco, brashears, brashears music, brashears porn, brashears song, breaking news, brian sabey, brontok, browser malware, browsing, business, busty xxx, C2, ca issuers, capa, ca validity, cc3517, cddad ad, centos web, certificate, certificate status, cgb stgreater, chase personal, check, child pornographer, china cobalt, chrome, ch ua, cidr, cisco umbrella, ck id, ck matrix, class, cleaner, click, close, cname, CNC, cnc feodo, cnc server, cnsectigo rsa, cobalt strike, Cobalt Strike, code, coinminer, colorado, command, comments, communicating, components, conduit, contacted, contacted urls, content length, contentlength, content reputation, content type, control server, cookie, cool, copy, copy md5, copyright, copy sha1, copy sha256, core, country united, covid19, covid19 scam, crack, create process, creates, creation date, critical, crlf line, cryptexportkey, culture, cus cndigicert, cus cngts, cus ouserver, cutwail, cybercrime, cyberfolks, cyber harassment, cyber security, cyberstalking, cyber threat, czechia unknown, d417n, daily, daisy, daisy coleman, data, data center, data upload, date, date hash, dead, death threats, defacement, default, defense evasion, delete, delete c, delete file, delphi, denmark unknown, denver, destination, details \iexplore.exe\ trying to touch file %WINDIR%\System32\v, detect, detection list, detplock, dev, developer, discord, discovery t1082, dns, DNS Requests, dnssec, doctype html, domain, domain name, domain names, domain related, domains, doscom c, downer, downldr, download, download csv, download encrypt, downloader, download json, dpt, dr city, dropper, drops, drweb, dynamic, dynamicloader, e98c1cec8156, ebony, ebony riding, ecacc, elf collection, emails, emails info, emotet, encrypt, engineering, enter so, enter soudcfidi, enter soupce, entertainment, entity ah36ripe, entries, entries http, enumerate, erase, error, et, et info, et p2p, etpro, etpro trojan, et tor, et trojan, eu data, evasion ta0005, evasive, example domain, exchange, excludea, execution, exe size, exit, expiration, expiration date, exploit, extr, extraction, extraction data, extraction f, extraction fail, extra data, facebook, failed, fakealert, fakedout threat, falcon sandbox, false files, fareit, fastly error, father sex, february, file, file access, filehashsha1, filehashsha256, file name, filename, file query, filerepmalware, files, filesadobe c, file samples, files c, files ip, files location, files marked clean, files matching, file system, filetour, file type, filter tsara, final url, finance, find, fixed line, flag, floxif, formbook, for privacy, found, france, fraud service, fusioncore, gamarue, games, gecko, geckohost, general, generator, generic, generic malware, genkryptik, germany, germany unknown, get http, getpost, get search, ghost rat, gif image, gmt0600, gmt content, gmtn, gmt server, go daddy, goldfinder, google, google safe, Google search, gopher, green, hackers, hacking, hacktool, hallrender, hall render denver, handle, hashes, hat server, head, heodo, hetzner, heur, heurunsec, hiddentear, hidden users, hifi, high, high level, highly targeted, high process, historical otx, historical ssl, home, hos hos, host, hostile, hosting, hostname, hostnames, hosts process, hsbc, html public, http, http header, http identifier, httponly, http response, https, https webserver, hx88x89, hx88x9ax1e, hybrid, icann, ic excluded, icloader apr, ids detections, ietfdtd html, \iexplore.exe\ trying to touch file, iframe, included, included review, include review, include u, inc orgid, inc usage, indexed, indicator, indicator facts, infinity, information isp, informative, infostealer, injection, injection t1055, injector, inmortal, installcore, installer, installpack, intel, invalid pointer, invalid url, iobit, ioc, iocs, ios, ip address, ip files, iphone unlocker, ip summary, ipv4, ipv4 add, isp charter, isp hostname, issuers, javascript, javascript c, jeffrey, jeffrey reimer dpt, jfif, jfif standard, jpeg image, json sample, jujubox, july, Jumpseller phishing, june, kb body, kedence, kelihos, key, key algorithm, keybase, keygen, key identifier, key info, keylogger, keyloggers, kgs0, khtml, kls0, known tor, kryptiklfq, kryptikpii, kx82xd3x11, kyriazhs1975, lander script, land use, law, learn, level 3, levelblue, line isp, link location, local, location first, location los, location oxford, location united, log id, login, logon, lowfi, lumma stealer, maldoc, malicious, malicious host, malicious server, malicious site, malicious url, maltiverse, malvertizing, malware, malware beacon, malware host, malware hosting, malware site, march, mark brian sabey, matsnu, mb first, mcfunction, md5 google, md5 sha256, mediamagnet, medium, meekserver, memcommit, meta, metasploit, meterpreter, method, metro, metro t-mobile, mexico unknown, mi11255597wp, michigan, microsoft, mile high media, million, miner, mirai, misc attack, missouri, mitre, mitre att, modify system, module load, modules t1129, moldova related, moldova unknown, monitoring, most relevant, moved, mozilla, msie, msil, msms86718722, msr apr, ms windows, mtb apr, music, mutexes, mx81xd1r, name, named pipe, name servers, name tactics, name verdict, nanocore, nanocore rat, net107, net1070000, nethandle, netherlands, netherlands asn, netrange, netsupport rat, network, network related, network traffic, networm, next, next associated, next http, Nextray, nids, nights, nircmd, njrat, nod32, no data, node traffic, no expiration, noname057, none related, NSIS, ns nxdomain, ntp open resolver, null, number, nxdomain, nymaim, object, object moved, occamy, october, ogoogle trust, open, opencandy, open threat, openurl c, orgabuseref, orgid, orgtechhandle, orkut, os, os version, otx telemetry, ouserver ca, outbreak, oxford, panca type, panda, panel forum, passive dns, patcher, path, pattern match, paypal, paypal phishing, pcap, pdf broadcom, pegasus, persistence, phishing, phishing: Amazon.com, phishing bank, phishing chase, phishing google, phishing huntington bank, Phishing - Mr.Looquer, phishing site, phishtank, pingback, pixelrz, .pl, please, plesk forum, png image, poisoning, pony, porn, pornhub, porn videos, port, postalcode, post http, post utcore, pragma, praw type, prefetch2 name, presenoker, present jul, present jun, present oct, pr extract, probe, process32nextw, process details, process t1543, programfiles, project, psexec, pua, public, pulse, pulse http, pulse pulses, pulses, pulses none, pulse submit, pushdo, query, radar ineractive, ramnit, ransom, ransomware, raspberry robin, rat, read, read c, reads software, record type, record value, redacted for, redacted referrer, redirect, redline, redline stealer, referrer, refresh, regbinary, regdword, registrant fax, registrar, registrar abuse, registrar of, registry domain, registry policy, regsetvalueexa, regsetvalueexw, reimer, related nids, related pulses, related tags, relayrouter, relic, remcos, replacement, request, resolutions, response, reverse dns, review, ripe, ripe ncc, ripe network, riskware, rms, roberta, rock, role title, runescape, runtime process, russia unknown, sabey, sabey data centers, safebae, safebae.org, safe browsing, safe site, sality, sample, samples, sandbox, scan endpoints, scanning_host, scanning ip’s, scans show, scottsdale, script, script domains, script script, script urls, s data, sea p, search, sec ch, secrisk, secure, secure server, seen, sentinelone, september, server, server header, servers, service, services, serving ip, set cookie, sgeneric, sha1, sha256, shell, show, showing, show process, show technique, shutdown, sibot, signals mutexes, simda, site, size, skynet, smokeloader, sneaky server, soa nxdomain, soc http, soc https, social engineering, song culture, spam, spammer, span, spawns, specified, sports, spyware, squirrelwaffle, ssl certificate, stalker, startpage, stateprov, status, status code, stealer, steam route, stop, stop ransomware, storage, stream, strike, strings, subdomains, subject, subject billing, subject key, subject public, submit, sugges data, suggeste, summary, suppobox, suricata, susp, suspicious, swrort, systweak, t1055, t1059 very, t1064, t1071, t1083 reads, t1105, t1129, ta0002 command, ta0003 create, tag count, tags, tags none, target, tbmisch, tcp traffic, team, team phishing, tech email, telefonica, telefonica co, text c, threat report, threat roundup, Threats200220200050, threats et, tiggre, timestamp, title, title meta, tls rsa, tls web, t-mobile, tool, tools, track, tracker, tracker malware, trellian, trending videos, trojan, trojan features, trojanspy, trojanx, TrojanX, trydda dada, tsara, tsara brashears, tsara lynn, ttl value, tulach, tulach.cc, type, type data, type fixed, type indicator, type win32, typ url, ua full, ua platform, udi ad, u extractio, unauthorized, unauthorized scanning of hosts, united, united kingdom, united tls web, unknown, unknown aaaa, unknown url, unruy, unsafe, update date, ur extraction, url add, url analysis, url hos, url http, url https, urls, urls http, url summary, url url, usage type, user, utf8, v3 serial, vidar, video, vipre, virtool, virustotal, virustotal api, virut, vitro, VM, vps, wacatac, watch, watch tsara, weather, webshell, webtoolbar, whitelisted, whois, whois lookup, whois record, whois server, whois siblings, whois ssl, whois sslcert, whois whois, win32, win32dh, win64, windir, %WINDIR%\System32\vm3dum_loader.dll\ source API Call, windows, windows check, windows create, windows nt, windows service, write, write c, write file, x509v3, x509v3 subject, x8dxb7xb7, x92xac, x95xd3xa4, x adblock, xb9x8b, xe7xf3xf2x14x9d, x frame, xtrat, Yandex, yara detections, yara rule, yixun, zbot, zenbox, zpevdo, zune
View other sources: Spamhaus VirusTotal

Country: Netherlands
Network:
Noticed: 50 times
Protocols Attacked: Anonymous Proxy
Countries Attacked: Australia, Brazil, Canada, Czechia, Denmark, Estonia, France, Germany, Hungary, Ireland, Japan, Latvia, Lithuania, Luxembourg, Moldova Republic of, Norway, Poland, Romania, Russian Federation, Spain, Turkey, Ukraine, United Kingdom of Great Britain and Northern Ireland, United States of America
Passive DNS Results: phisingbabi.com panel.owswan.com ajkndnk125.shop gilanboy.ir cnamefuckxxs.yuchen.icu start-unity.com xn–11x.fun cdn9.1678520.xyz turtletvfr.ninja dl1g.30yavash.top 79j84.lle6qsedvkbmr2sstx3h.buzz 7nu79.k85toneg5s.buzz miliao.cloudns.org 1.dl.cn99.eu.org hanmei5.com xcheat.org nuova-ft.com peslibro.it vadyba.lt www.autopaginas.nl jyiddiz.tk ketookyqap.ru.com serenityboutique.shop image.rorydecoration.cyou glaflowmusic.com photokade.com mohamedsyllacoaching.com 669966.xyz www.astrofrance.online akkawi-group.com wecanservemagazine.com www.wecanservemagazine.com assets.root.me www.7inx.com 7inx.com trangtongk188.online uj7pbechd2pk6k.wtmdsb.site bdzg9dkmnngr.wtmdsb.site testapi.soutubot.moe

Open Ports Detected

2082 2083 2086 2087 443 80 8080 8443 8880

Map

Whois Information

inetnum: 188.114.96.0 - 188.114.99.255
netname: CLOUDFLARENET-EU
descr: CloudFlare, Inc.
descr: 101 Townsend Street, San Francisco, CA 94107, US
descr: +1 (650) 319-8930
descr: https://cloudflare.com/
country: US
admin-c: CAC80-RIPE
tech-c: CTC6-RIPE
status: ASSIGNED PA
mnt-by: MNT-CLOUDFLARE
mnt-lower: MNT-CLOUDFLARE
mnt-routes: MNT-CLOUDFLARE
created: 2015-10-16T16:26:10Z
last-modified: 2015-10-16T16:26:10Z
person: Cloudflare Abuse Contact
address: Viktualienmarkt Rosental 7 80331 Munchen, DE
phone: +49 89 2555 2276
nic-hdl: CAC80-RIPE
mnt-by: MNT-CLOUDFLARE
created: 2012-06-01T23:27:49Z
last-modified: 2022-04-21T01:07:44Z
person: Cloudflare Technical Contact
address: Viktualienmarkt Rosental 7 80331 Munchen, DE
phone: +49 89 2555 2276
nic-hdl: CTC6-RIPE
mnt-by: MNT-CLOUDFLARE
created: 2012-06-01T23:35:57Z
last-modified: 2022-04-21T01:07:28Z
route: 188.114.96.0/24
origin: AS13335
mnt-by: MNT-CLOUDFLARE
created: 2020-06-15T18:05:37Z
last-modified: 2020-06-15T18:05:37Z

Links to attack logs

Share on: