Check an IP Address, Domain Name, Subnet, or ASN

103.38.218.22 was found in our database!

$ whois 103.38.218.22

country·🇮🇳 India

isp·HEGHESCOM NETWORKS PRIVATE LIMITED

asn·AS151769

network·Standard

$ sikker risk 103.38.218.22scoring →

confidence

54%Medium

first_seen·Jan 22, 2026

last_seen·14h ago

sessions·39

events·40

$ sikker protocols 103.38.218.22

SMB

34 / 35

MSSQL

5 / 5

$ sikker summary 103.38.218.22

103.38.218.22 has a threat confidence score of 54%. This IP address from India (AS151769, HEGHESCOM NETWORKS PRIVATE LIMITED) has been observed in 39 honeypot sessions targeting SMB, MSSQL protocols. Detected attack patterns include remcom remote execution. First observed on January 22, 2026, most recently active March 27, 2026.

$ sikker behaviors 103.38.218.22catalog →

highRemcom Remote Execution1x

Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.

$ sikker primitives 103.38.218.22

smb_empty_rpc_call1 smb_ipc_share_access1 smb_remcom_pipe_open1 smb_svcctl_pipe_open1

$ sikker related 103.38.218.22

🇮🇳·More threats fromIndia→AS·More threats fromHEGHESCOM NETWORKS PRIVATE LIMITED→SMB·More threats targetingSMB→MSSQ·More threats targetingMSSQL→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
103.147.150.236	99%	86
128.185.225.78	51%	441
122.187.230.130	47%	326
103.190.92.110	71%	138
49.205.198.2	95%	1,594