Check an IP Address, Domain Name, Subnet, or ASN

104.194.159.250 was found in our database!

$ whois 104.194.159.250

country·🇩🇪 Germany

city·Frankfurt am Main

isp·RouterHosting LLC

asn·AS14956

network·Standard

$ sikker risk 104.194.159.250scoring →

confidence

94%Very High

first_seen·Apr 11, 2026

last_seen·5d ago

sessions·696

events·696

$ sikker protocols 104.194.159.250

SIP

696 / 696

$ sikker summary 104.194.159.250

104.194.159.250 has a threat confidence score of 94%. This IP address from Germany (AS14956, RouterHosting LLC) has been observed in 696 honeypot sessions targeting SIP protocols. Detected attack patterns include sip call id high entropy hex 32. First observed on April 11, 2026, most recently active April 13, 2026.

$ sikker behaviors 104.194.159.250catalog →

highSip Call Id High Entropy Hex 325x

SIP activity where Call-ID values exhibit high entropy and fixed 32-character hexadecimal format, indicating automated generation typically associated with scanning tools, fuzzing frameworks, or SIP enumeration activity.

$ sikker primitives 104.194.159.250

sip_invite_request691 sip_call_id_hex_329 sip_call_id_alphanumeric_entropy9

$ sikker related 104.194.159.250

🇩🇪·More threats fromGermany→AS·More threats fromRouterHosting LLC→SIP·More threats targetingSIP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
144.172.101.50	84%	104
144.172.95.158	99%	3,365
45.61.133.122	29%	177
172.86.67.130	98%	1,390
172.86.69.91	89%	42

IP Address	Confidence	Events
216.24.213.226	88%	14,464
217.216.108.129	85%	1,584
194.164.59.59	100%	950
85.234.100.88	99%	66
212.132.118.184	95%	3,000