Check an IP Address, Domain Name, Subnet, or ASN

111.73.172.117 was found in our database!

$ whois 111.73.172.117

country·🇨🇳 China

isp·Chinanet

asn·AS4134

network·Standard

$ sikker risk 111.73.172.117scoring →

confidence

74%High

first_seen·Apr 21, 2026

last_seen·9d ago

sessions·14

events·14

$ sikker protocols 111.73.172.117

RDP

14 / 14

$ sikker summary 111.73.172.117

111.73.172.117 has a threat confidence score of 74%. This IP address from China (AS4134, Chinanet) has been observed in 14 honeypot sessions targeting RDP protocols. First observed on April 21, 2026, most recently active April 23, 2026.

$ sikker behaviors 111.73.172.117catalog →

mediumRdp Nla Ntlm Authentication Attempt6x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 111.73.172.117

rdp_nla_ntlm_auth6

$ sikker related 111.73.172.117

🇨🇳·More threats fromChina→AS·More threats fromChinanet→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
60.186.158.52	23%	1
49.72.56.138	28%	7
58.209.234.84	100%	935
123.160.223.74	85%	546
49.88.156.34	99%	8,031

IP Address	Confidence	Events
125.40.80.103	30%	2
111.180.139.246	95%	660
118.182.101.179	95%	1,568
124.193.81.23	100%	921
175.42.32.205	96%	12,156