Check an IP Address, Domain Name, Subnet, or ASN

196.196.52.6 was found in our database!

$ whois 196.196.52.6

country·🇱🇻 Latvia

city·Riga

isp·Orion Network Limited

asn·AS41564

network·Standard

$ sikker risk 196.196.52.6scoring →

confidence

87%Very High

first_seen·Mar 26, 2026

last_seen·1h ago

sessions·52

events·52

$ sikker protocols 196.196.52.6

HTTPS

40 / 40

HTTP

12 / 12

$ sikker summary 196.196.52.6

196.196.52.6 has a threat confidence score of 87%. This IP address from Latvia (AS41564, Orion Network Limited) has been observed in 52 honeypot sessions targeting HTTPS, HTTP protocols. Detected attack patterns include https dotenv environment file exposure probe. First observed on March 26, 2026, most recently active March 26, 2026.

$ sikker behaviors 196.196.52.6catalog →

highHttps Dotenv Environment File Exposure Probe1x

Identifies an HTTPS request targeting a .env file in the web root or application directory. Access attempts to /.env indicate automated scanning for exposed environment configuration files that may contain application secrets, database credentials, API keys, or cloud tokens. This probe is commonly associated with opportunistic internet-wide scanning for misconfigured web deployments.

infoHttp Root Path Request8x

Identifies HTTP requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration.

infoHttps Root Path Request1x

Identifies HTTPS requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration

$ sikker primitives 196.196.52.6

http_method_get12 https_path_root1 https_path_dotenv1 https_path_config_json1 http_path_dotgit_config1 https_path_dotgit_config1 http_path_doc_page_login_asp_access1

$ sikker related 196.196.52.6

🇱🇻·More threats fromLatvia→AS·More threats fromOrion Network Limited→HTTP·More threats targetingHTTPS→HTTP·More threats targetingHTTP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
196.196.52.5	76%	45
89.251.0.108	68%	37
89.251.0.109	42%	3
2.57.169.3	36%	2
89.251.0.85	57%	6

IP Address	Confidence	Events
196.196.53.101	29%	4
196.196.52.5	76%	46
162.158.48.149	2%	2
162.158.48.185	19%	8
162.158.48.184	17%	7