@GossiTheDog here's my favorite: https://www.virustotal.com/gui/ip-address/188.114.96.0/relations (tap ••• a couple of times)
Not Cloudflare, but quite active as well (tickets for Paris olympics, EU soccer and lots of music arists - continuously changing domain names, most .ru but also .com an others): https://www.virustotal.com/gui/ip-address/91.239.26.147/relations
Source: https://www.bleepingcomputer.com/news/security/ticket-heist-fraud-gang-uses-700-domains-to-sell-fake-olympics-tickets/ -> https://quointelligence.eu/2024/07/ticket-heist-olympic-games-and-sporting-events-at-risk/