Check an IP Address, Domain Name, Subnet, or ASN

111.228.59.168 was found in our database!

$ whois 111.228.59.168

country·🇨🇳 China

isp·China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch

asn·AS141679

network·Standard

$ sikker risk 111.228.59.168scoring →

confidence

54%Medium

first_seen·Mar 25, 2026

last_seen·22m ago

sessions·2

events·2

$ sikker protocols 111.228.59.168

RDP

2 / 2

$ sikker summary 111.228.59.168

111.228.59.168 has a threat confidence score of 54%. This IP address from China (AS141679, China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch) has been observed in 2 honeypot sessions targeting RDP protocols. First observed on March 25, 2026, most recently active March 25, 2026.

$ sikker behaviors 111.228.59.168catalog →

mediumRdp Nla Ntlm Authentication Attempt2x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 111.228.59.168

rdp_nla_ntlm_auth2

$ sikker related 111.228.59.168

🇨🇳·More threats fromChina→AS·More threats fromChina Telecom Beijing Tianjin Hebei Big Data Industry Park Branch→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
111.228.60.109	96%	594
111.228.43.35	96%	1,158
111.228.60.223	96%	1,092
117.72.9.232	98%	37
111.228.41.1	94%	201

IP Address	Confidence	Events
117.50.199.207	63%	21
120.236.153.236	99%	6
113.214.18.234	100%	1,251
120.48.141.145	93%	81
112.46.212.143	74%	98