88.254.253.254
Classification: Malicious
88.254.253.254 is a malicious IP address in Salihli, TR. Linked to Zeroaccess malware. 8 sightings from 3 threat sources (Mail Spammer), last seen 2026-10-14.
Current activity
- Known attacker — Seen launching attacks over the Internet.
MITRE ATT&CK associations
Malware families: ZEROACCESS (S0027)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Mail Spammer | Barracuda | 2025-12-21 01:46:35 | 2026-10-14 23:29:18 | attacker malicious-activity | |
| Trojan.Generic.KDZ | Hybrid-Analysis | 2020-03-02 06:45:09 | 2020-03-03 06:45:22 | ||
| Trojan.Generic.KD | Hybrid-Analysis | 2020-03-02 07:00:37 | 2020-03-02 07:00:37 | ||
| Backdoor.ZAccess | Hybrid-Analysis | 2019-06-06 21:31:42 | 2020-03-02 06:30:03 | S0027 Zeroaccess | |
| W32.ZAccess.185856 | Hybrid-Analysis | 2020-02-26 10:30:07 | 2020-02-26 10:30:07 | ||
| DeepScan:Generic.FakeAv.5 | Hybrid-Analysis | 2019-06-06 21:45:59 | 2019-06-06 21:46:33 | ||
| botnet,rootkit,zeroaccess | Maltiverse | 2018-01-01 05:44:17 | 2018-01-01 05:44:17 |
Tags
botnet rootkit zeroaccessWhois information
- AS name
- AS9121 TT ADSL-dynamic ulus
- AS registry
- ripencc
- AS date
- 2005-10-27 00:00:00
- AS CIDR
- 88.254.128.0/17
- Registrant
- TT ADSL-dynamic ulus
- City
- Salihli
- Postal code
- 45300
- Country
- TR — Türkiye 🇹🇷
- First indexed
- 2018-01-01 05:44:17
- Last updated
- 2026-10-14 23:29:19