199.188.200.78 Threat Intelligence and Host Information

Apr 04, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 199.188.200.78 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 59/100

Host and Network Information

  • Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1012 - Query Registry, T1023 - Shortcut Modification, T1027 - Obfuscated Files or Information, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1047 - Windows Management Instrumentation, T1055 - Process Injection, T1057 - Process Discovery, T1060 - Registry Run Keys / Startup Folder, T1071 - Application Layer Protocol, T1082 - System Information Discovery, T1089 - Disabling Security Tools, T1106 - Native API, T1112 - Modify Registry, T1119 - Automated Collection, T1129 - Shared Modules, T1133 - External Remote Services, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1189 - Drive-by Compromise, T1203 - Exploitation for Client Execution, T1204 - User Execution, T1210 - Exploitation of Remote Services, T1428 - Exploit Enterprise Resources, T1485 - Data Destruction, T1564 - Hide Artifacts, T1566 - Phishing, T1573 - Encrypted Channel

  • Tags: 443 ma2592000, aaaa, accept, access, access ta0001, access ta0006, activity, activity mirai, address, address domain, a domains, adversaries, adware malware, ag alberto, ag ingo, air force, alerts, all quiet, all scoreblue, all search, analyzer paste, andariel, android, anomalous file, a nxdomain, apple, april, as12337 noris, as133618, as14061, as15169 google, as15598, as16276, as16552 tiggee, as16625 akamai, as174 cogent, as19024, as1921, as20940, as21342, as24940 hetzner, as29789, as32787 akamai, as32934, as35994 akamai, as397241, as40021 contabo, as44273 host, as45430, as47846, as49505, as51167 contabo, as62597 nsone, as63949 linode, as714 apple, as8068, as8075, as8560, as8972 host, as9009 m247, asn as15598, asnone dns, asnone germany, asnone related, asnone united, austria, av detections, avg clamav, backdoor, binbusybox, bios, bits, body, brazil, brian sabey, browsing, cachecontrol, cape, catalog tree, certificate, charter communications, checkin, china unknown, chrome, clickable urls, cname, cnapple public, cnc beacon, code, command, connection, contacted, content type, control ta0011, cookie, copy, copyright, cp bus, creates, creation date, cryp, cur cono, cve201717215, cyber folks, cyber warfare, czechia unknown, data redacted, date, date hash, date tue, ddos, default, defense evasion, delete, delete c, delete shadows, delphi, demonbot, denvecolorado, denver, denver colorado, detected m1, discovery e1082, div div, dns query, docguard, dock, domain, domain name, download, dynamicloader, e1203 data, e1564 hidden, echo request, ee edcje4j, ekyxe, emails, emails info, encrypt, entries, eofae, error, etpro malware, evasion ob0006, execution, expiration date, expires thu, exploit, exploitation, exploit none, externalport, fakedout threat, federation asn, filehash, files, file samples, files domain, files ip, file size, files location, files matching, file type, fin ivdo, flag united, format, for privacy, found, france unknown, gafgyt, germany, germany mail, germany unknown, gmt cache, gmt content, gmt contenttype, gmt setcookie, gmt vary, google safe, grum, guard, hash avast, hashes cape, helloworld, hichina, hide artifacts, high, high assurance, hitmen, holidaycheck ag, home network, honduras, hosting, hostmaster, hostname, http, http headers, http host, http request, huawei hg532, huawei remote, icmp traffic, ids detections, immobilien ag, impact ob0008, impact ta0040, inbound, indonesia, install, installcore, instrumentation, internalport, iocs, ios, ip address, ip check, ip country, ip traffic, ipv4, ireland, ireland unknown, issuing ca, javascript, june, kraupa, kryptikxp, kurt walther, labs pulses, licess, lnmp, lnmp a, location united, look, lredmond, m1, magic pdf, mail spammer, main, malware, malware traffic, malware worm, masquerade, media center, medium, memcommit, memory pattern, memreserve, meta, method status, mexico, miniigd upnp, mirai, mirai variant, mitm, mitre att, module load, moved, msdefender apr, msie, msms57295540, ms windows, mtb apr, mtb aug, name servers, networks, next, nids, nondns, nxdomain, ob0005 defense, odigicert inc, onelouder, onl our, open, otx scoreblue, overview ip, oxypumper, packing t1045, passive dns, pattern domains, payload hello, pdb path, pdf document, pdf execution, pe32, pedraz, pe resource, persistence, phy samo, .pl, please, poland, poland unknown, porn, pornhub.software, port, possible, post, powershell, process32nextw, project pi, pulse pulses, pulses, pulse submit, puma se, push, quantum fiber, ransom, read c, realtek sdk, record type, record value, recycle bin, redacted for, regbinary, regdword, registrar, regsetvalueexa, related nids, related pulses, resolverror, reverse dns, rpcs, rsa ca, rsa tls, russia as49505, sabey, sameorigin, samples, sandbox, scan endpoints, script domains, script urls, search, serce internetu, server, server ca, server error, servers, sha256, shell, show, showing, sinkhole cookie, slcc2, slovakia, soap command, spammer, spectrum, ssdeep, ssl certificate, status, stream, stwashington, subdomains, susp, suspicious, sweep, swipper, t1036, t1045, t1047, t1129, t1189 found, tcp syn, thailand, timo salzsieder, title, tofsee, tools, total, tptjsw, trid adobe, trojan, trojandropper, trojan features, trojanspy, tsara brashears, ttl value, tulach, type get, united, united kingdom, unknown, updated date, url analysis, url hostname, url http, urls, urls http, urls https, useragent, users, value snkz, vhash, vietnam, virtool, virus, virustotal, whitelisted, whitesky, whois, win32, win64, windows, windows nt, world, wow64, write, write c, wsasend, x cache, xe e, xport, yara detections, yara rule, yomi hunter, zenbox

  • JARM: 3fd3fd15d3fd3fd00042d42d000000038eaaf490bec8dc33757f165ce01762

  • View other sources: Spamhaus VirusTotal

  • Contained within other IP sets: hphosts_fsa

Malware Detected on Host

Count: 1 dd8ad034f4e91eda33712a8705dc7c96d2b4c69f900d00137396e7ba1fc320be

Open Ports Detected

2077 2095 2096 21 443 80

CVEs Detected

CVE-2016-10735 CVE-2018-14040 CVE-2018-14042 CVE-2018-20676 CVE-2018-20677 CVE-2019-8331 CVE-2024-6484

Map

Whois Information

  • NetRange: 199.188.200.0 - 199.188.207.255
  • CIDR: 199.188.200.0/21
  • NetName: NCNET-1
  • NetHandle: NET-199-188-200-0-1
  • Parent: NET199 (NET-199-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS: AS16626, AS174, AS4323, AS3356, AS22612, AS32421
  • Organization: Namecheap, Inc. (NAMEC-4)
  • RegDate: 2011-08-03
  • Updated: 2015-03-24
  • Comment: http://namecheap.com
  • Comment: for any abuse please use: abuse@namecheap.com
  • Ref: https://rdap.arin.net/registry/ip/199.188.200.0
  • OrgName: Namecheap, Inc.
  • OrgId: NAMEC-4
  • Address: 11400 W. Olympic Blvd. Suite 200
  • City: Los Angeles
  • StateProv: CA
  • PostalCode: 90064
  • Country: US
  • RegDate: 2011-01-28
  • Updated: 2024-11-25
  • Ref: https://rdap.arin.net/registry/entity/NAMEC-4
  • OrgTechHandle: TECHT4-ARIN
  • OrgTechName: Tech team
  • OrgTechPhone: +1-661-310-2107
  • OrgTechEmail: tech@namecheaphosting.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/TECHT4-ARIN
  • OrgTechHandle: EFIME-ARIN
  • OrgTechName: Efimenko, Igor
  • OrgTechPhone: +1-323-375-2822
  • OrgTechEmail: igor.e@namecheap.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/EFIME-ARIN
  • OrgAbuseHandle: ABUSE2885-ARIN
  • OrgAbuseName: Abuse team
  • OrgAbusePhone: +1-323-375-2822
  • OrgAbuseEmail: abuse@namecheaphosting.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2885-ARIN
  • network:Class-Name:network
  • network:Auth-Area:199.188.200.0/24
  • network:ID:NET-82703.199.188.200.78
  • network:IP-Network:199.188.200.78
  • network:IP-Network-Block:199.188.200.78
  • network:Org-Name:Web-hosting.com
  • network:Street-Address:3402 East University Drive
  • network:City:Phoenix
  • network:State:AZ
  • network:Postal-Code:85034
  • network:Country-Code:US
  • network:Tech-Contact:MAINT-82703.199.188.200.78
  • network:Created:20190708074439000
  • network:Updated:20190708074439000
  • network:Updated-By:net-admin@namecheap.com
  • contact:POC-Name:Network team
  • contact:POC-Email:net-admin@namecheap.com
  • contact:POC-Phone:
  • contact:Tech-Name:Network team
  • contact:Tech-Email:net-admin@namecheap.com
  • contact:Tech-Phone:
  • contact:Abuse-Name:Abuse team
  • contact:Abuse-Email:abuse@namecheaphosting.com

Links to attack logs

****** ****** ******

Share on: