199.188.201.16 Threat Intelligence and Host Information

Apr 04, 2025 ipinfopage

General

This page contains threat intelligence information for the IPv4 address 199.188.201.16 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.

Likely Malicious Host 🟠 52/100

Host and Network Information

  • Mitre ATT&CK IDs: T1014 - Rootkit, T1027 - Obfuscated Files or Information, T1031 - Modify Existing Service, T1036.004 - Masquerade Task or Service, T1036 - Masquerading, T1041 - Exfiltration Over C2 Channel, T1049 - System Network Connections Discovery, T1055 - Process Injection, T1056 - Input Capture, T1059.006 - Python, T1059.007 - JavaScript, T1068 - Exploitation for Privilege Escalation, T1071.001 - Web Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1105 - Ingress Tool Transfer, T1113 - Screen Capture, T1114 - Email Collection, T1125 - Video Capture, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1155 - AppleScript, T1156 - Malicious Shell Modification, T1444 - Masquerade as Legitimate Application, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1560 - Archive Collected Data, T1566 - Phishing, T1574.006 - Dynamic Linker Hijacking, T1598 - Phishing for Information, T1602.002 - Network Device Configuration Dump

  • Tags: 1663014711, 411260982, a7i string, aaaa, accept, access, address as, admin country, a domains, aes128gcm, alerts, all octoseek, analyze, android, anomalous file, apple, apple control, apple inc, apple ios, april, artro, as13335, as133618, as14061, as16509, as32244, as32244 liquid, as50295 triple, as58110 ip, as62597, as autonomous, asn13335, asn15169, asn213250, a td, a th, authentication, b image, binrm, blacklist https, body, body doctype, bookmarks, boundsstr, bq mar, brashears, brian sabey, browsing, b script, ca id, ca issuers, ca limited, capture, centos, certificate, cloudflar, cloudflare, cloudflarenet, cname, cncomodo ecc, cnisrg root, cnlet, comodo, connect facebook, contact, contacted, contacted urls, copy, create, created, creation date, criminal gang, criteria id, crl cache, crlcachedir, cust exe, customer client, cybercrime, darklivity, date, depot tech, design, digicert https, digitaloceanasn, directory, displays, dns replication, dnssec, domain, domain name, domainpath name, domains, download, dstroot, e0b function, e4609l, ecdheecdsa, email, emails, encrypt, entries, error, ev server, execution, expiration, expiration date, expired, express, facebook, facebook url, fastly, fear factor, february, filehash, files, files domain, files related, formbook, for privacy, foundation, frame, framing, france unknown, frankfurt, full url, gecko, general full, generic, generic malware, geoip, germany, germany unknown, gmbh version, google, google https, google safe, google url, greater, group, guard, hacktool, hash, hashes, high, hijacker, historical ssl, history killer, hit, hostname, hostnames, html public, http, https://otx.alienvault.com/pulse/65acace20c18a7d6c5da2e27, icmp traffic, identifier, identity search, impressum, inject-x64.exe, install, intel mac, iocs, ip address, ip https, ip security, ip summary, ipv4, itpsolutions, jeffrey reimer, js user, june, kb image, kb script, keychainssrc, key usage, khtml, legal, lets, license, limited, line, link, linkid69157 url, liquidweb, log id, log operator, lsalford, macintosh, main, makefile, malware, man, march, medium, men, meta, microsoft, migrate, miles it, modernizr, monitoring, moved, mozilla, name size, network_icmp, next, nib files, no expiration, no na, no no, ocomodo ca, ocsp, october, office depot, olet, open, os x, packet, parent, passive dns, paste, phishing, php logo, poison, pragma, protocol h2, pulse, pulse pulses, pulses, pulses otx, python, python connection, python software, record value, redirect, redirect chain, referer, referrer, registrar abuse, registrar iana, registry admin, relic, remote attackers, report spam, request chain, research group, resolutions, resource, resource path, reverse dns, rexxfield, rows, ruby logo, salford, sample, samples, san francisco, sat jul, scan endpoints, search, sectigo https, secure server, security tls, server, servers, service privacy, sha256, show, showing, size, smartfolder, smithtech, sniffs, software, software caddy, source browser, source level, splitcount, spyware, srcroot, sreredrum, ssl certificate, status, status page, subject, summary, summary leaf, system, tag count, tags, targetdisk, targets, td td, tech, tech country, technology, threat, threat analyzer, threat report, timestamp entry, tls web, tofsee, triple mirrors, trojan, tr tr, tsara brashears, type mimetype, ubuntu, united, unknown, url http, url https, urls, urls http, urls https, url summary, url text, valid, value, veryhigh, visit, webzilla, weeks ago, whois record, whois whois, win64, windows, windows nt, x509v3 subject, x8i string, xvideos, y3i string, yara rule, yoa https, z6s3i, z6s3i string, z6s3i y3i

  • JARM: 3fd3fd15d3fd3fd00042d42d000000038eaaf490bec8dc33757f165ce01762

  • View other sources: Spamhaus VirusTotal

Malware Detected on Host

Count: 6 dbb901ba686933f3970cea2814e91fb10b4060e517a52483534d6d32eecc81e6 f5b534cc28878e0c6aa048695379309da03f132aa169afe4b2c790646c67fd9b 9ec7af47934cf4cda2e592f953061dc8d7c58d0764f90500ae6a63c2d4461292 ec0cce2098ca374e3da729636056527bb40c504c5ad57584a0b9e48ee0733ce4 15075ed8ca00321a2908c33c6b80690c639fcf6085678283a1a406794a156549 12b9c04dadd8011ddf54a0618c3d52d3c475d11c54d6b94261153f71ccd34dbd

Open Ports Detected

21 26 443 53 80

Map

Whois Information

  • NetRange: 199.188.200.0 - 199.188.207.255
  • CIDR: 199.188.200.0/21
  • NetName: NCNET-1
  • NetHandle: NET-199-188-200-0-1
  • Parent: NET199 (NET-199-0-0-0-0)
  • NetType: Direct Allocation
  • OriginAS: AS16626, AS174, AS4323, AS3356, AS22612, AS32421
  • Organization: Namecheap, Inc. (NAMEC-4)
  • RegDate: 2011-08-03
  • Updated: 2015-03-24
  • Comment: http://namecheap.com
  • Comment: for any abuse please use: abuse@namecheap.com
  • Ref: https://rdap.arin.net/registry/ip/199.188.200.0
  • OrgName: Namecheap, Inc.
  • OrgId: NAMEC-4
  • Address: 11400 W. Olympic Blvd. Suite 200
  • City: Los Angeles
  • StateProv: CA
  • PostalCode: 90064
  • Country: US
  • RegDate: 2011-01-28
  • Updated: 2024-11-25
  • Ref: https://rdap.arin.net/registry/entity/NAMEC-4
  • OrgTechHandle: TECHT4-ARIN
  • OrgTechName: Tech team
  • OrgTechPhone: +1-323-375-2822
  • OrgTechEmail: tech@namecheaphosting.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/TECHT4-ARIN
  • OrgTechHandle: EFIME-ARIN
  • OrgTechName: Efimenko, Igor
  • OrgTechPhone: +1-323-375-2822
  • OrgTechEmail: igor.e@namecheap.com
  • OrgTechRef: https://rdap.arin.net/registry/entity/EFIME-ARIN
  • OrgAbuseHandle: ABUSE2885-ARIN
  • OrgAbuseName: Abuse team
  • OrgAbusePhone: +1-323-375-2822
  • OrgAbuseEmail: abuse@namecheaphosting.com
  • OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE2885-ARIN
  • network:Class-Name:network
  • network:Auth-Area:199.188.201.0/24
  • network:ID:NET-280689.199.188.201.16
  • network:IP-Network:199.188.201.16
  • network:IP-Network-Block:199.188.201.16
  • network:Org-Name:Web-hosting.com
  • network:Street-Address:3402 East University Drive
  • network:City:Phoenix
  • network:State:AZ
  • network:Postal-Code:85034
  • network:Country-Code:US
  • network:Tech-Contact:MAINT-280689.199.188.201.16
  • network:Created:20230911081044000
  • network:Updated:20230911081539000
  • network:Updated-By:net-admin@namecheap.com
  • contact:POC-Name:Network team
  • contact:POC-Email:net-admin@namecheap.com
  • contact:POC-Phone:
  • contact:Tech-Name:Network team
  • contact:Tech-Email:net-admin@namecheap.com
  • contact:Tech-Phone:
  • contact:Abuse-Name:Abuse team
  • contact:Abuse-Email:abuse@namecheaphosting.com

Links to attack logs

****** ****** ******

Share on: