196.251.121.165
Classification: Suspicious
196.251.121.165 is a suspicious IP address in Frankfurt am Main, DE. Linked to Remcos malware. 19 sightings, last seen 2026-09-04.
Current activity
- VPN node — Provides anonymization that can hide an attacker.
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| VPN | IPWhois.io | 2026-07-03 08:25:05 | 2026-09-04 15:16:19 | anonymization vpn | |
| Remcos | ThreatFox Abuse.ch | 2026-07-03 08:20:58 | 2026-07-03 08:25:04 | botnet malicious-activity | S0332 Remcos |
Tags
port:14864 remvio port:14855 port:14862 remcos port:14869 port:14865 remcosrat port:14858 port:14867 port:14863 port:14634 port:14856 port:14860 port:14854 port:14861 port:14857 port:14859 port:14868 socmer port:14866Whois information
- AS name
- AS205759 internet-security
- Registrant
- internet-security
- City
- Frankfurt am Main
- Postal code
- 60311
- Country
- DE — Germany 🇩🇪
- First indexed
- 2026-07-03 08:25:04
- Last updated
- 2026-09-04 15:16:20