Check an IP Address, Domain Name, Subnet, or ASN

112.111.24.134 was found in our database!

$ whois 112.111.24.134

country·🇨🇳 China

city·Fuzhou

isp·CHINA UNICOM China169 Backbone

asn·AS4837

network·Standard

$ sikker risk 112.111.24.134scoring →

confidence

77%High

first_seen·Mar 28, 2026

last_seen·40m ago

sessions·8

events·8

$ sikker protocols 112.111.24.134

RDP

8 / 8

$ sikker summary 112.111.24.134

112.111.24.134 has a threat confidence score of 77%. This IP address from China (AS4837, CHINA UNICOM China169 Backbone) has been observed in 8 honeypot sessions targeting RDP protocols. First observed on March 28, 2026, most recently active March 28, 2026.

$ sikker behaviors 112.111.24.134catalog →

mediumRdp Nla Ntlm Authentication Attempt8x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 112.111.24.134

rdp_nla_ntlm_auth8

$ sikker related 112.111.24.134

🇨🇳·More threats fromChina→AS·More threats fromCHINA UNICOM China169 Backbone→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
175.42.32.205	96%	4,120
61.182.2.26	91%	393
123.188.239.125	97%	3,500
123.188.239.222	97%	2,906
116.140.211.102	89%	85

IP Address	Confidence	Events
14.103.120.124	100%	735
139.196.233.120	90%	35,320
59.36.204.120	92%	77
125.77.172.80	95%	80
221.131.45.31	96%	2,467