Check an IP Address, Domain Name, Subnet, or ASN

38.196.86.35 was found in our database!

$ whois 38.196.86.35

country·🇻🇪 Venezuela

city·Maracaibo

isp·4 EVER PLUG,C.A.

asn·AS271951

network·Standard

$ sikker risk 38.196.86.35scoring →

confidence

56%Medium

first_seen·Apr 19, 2026

last_seen·2h ago

sessions·1

events·1

$ sikker protocols 38.196.86.35

TELNET

1 / 1

$ sikker summary 38.196.86.35

38.196.86.35 has a threat confidence score of 56%. This IP address from Venezuela (AS271951, 4 EVER PLUG,C.A.) has been observed in 1 honeypot sessions targeting TELNET protocols. Detected attack patterns include telnet shell breakout with busybox payload execution. First observed on April 19, 2026, most recently active April 19, 2026.

$ sikker behaviors 38.196.86.35catalog →

highTelnet Shell Breakout With Busybox Payload Execution1x

Telnet session exhibiting privilege escalation and shell breakout attempts (enable, system, linuxshell, shell, sh) followed by execution of /bin/busybox with a non-standard or arbitrary applet name. The combination indicates an automated attempt to escape restricted CLI environments and execute a staged or randomly named payload via BusyBox. This pattern is characteristic of IoT/Linux bot deployment frameworks leveraging BusyBox as a universal execution wrapper.

$ sikker primitives 38.196.86.35

telnet_command_sh1 telnet_command_shell1 telnet_command_enable1 telnet_command_system1 telnet_command_linuxshell1 telnet_busybox_unknown_applet_invocation1

$ sikker related 38.196.86.35

🇻🇪·More threats fromVenezuela→AS·More threats from4 EVER PLUG,C.A.→TELN·More threats targetingTELNET→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
38.252.184.33	69%	8
38.196.84.80	73%	6
38.196.79.107	76%	7
38.196.81.142	80%	10
45.226.190.128	36%	1

IP Address	Confidence	Events
201.248.1.157	37%	7
201.208.165.75	39%	107
201.208.181.155	42%	135
38.43.208.4	47%	688
45.186.211.2	23%	89