Check an IP Address, Domain Name, Subnet, or ASN

111.53.52.206 was found in our database!

$ whois 111.53.52.206

country·🇨🇳 China

isp·China Mobile communications corporation

asn·AS56042

network·Standard

$ sikker risk 111.53.52.206scoring →

confidence

61%High

first_seen·Apr 9, 2026

last_seen·15h ago

sessions·5

events·5

$ sikker protocols 111.53.52.206

RDP

5 / 5

$ sikker summary 111.53.52.206

111.53.52.206 has a threat confidence score of 61%. This IP address from China (AS56042, China Mobile communications corporation) has been observed in 5 honeypot sessions targeting RDP protocols. First observed on April 9, 2026, most recently active April 13, 2026.

$ sikker behaviors 111.53.52.206catalog →

mediumRdp Nla Ntlm Authentication Attempt5x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 111.53.52.206

rdp_nla_ntlm_auth5

$ sikker related 111.53.52.206

🇨🇳·More threats fromChina→AS·More threats fromChina Mobile communications corporation→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
221.131.45.31	96%	5,148
111.53.147.80	100%	840
111.52.254.239	38%	322
111.53.234.150	73%	9
223.104.199.16	30%	2

IP Address	Confidence	Events
125.75.110.72	100%	893
8.148.180.18	84%	5,666
120.46.185.45	96%	175
106.12.154.42	94%	875
1.192.212.177	76%	2,382