Check an IP Address, Domain Name, Subnet, or ASN

116.140.209.208 was found in our database!

$ whois 116.140.209.208

country·🇨🇳 China

isp·CHINA UNICOM China169 Backbone

asn·AS4837

network·Standard

$ sikker risk 116.140.209.208scoring →

confidence

74%High

first_seen·Mar 3, 2026

last_seen·1h ago

first_reported·Mar 11, 2026

last_reported·6d ago

sessions·25

events·25

reports·4

$ sikker protocols 116.140.209.208

SSH

15 / 15 / 1r

TELNET

7 / 7 / 3r

HTTPS

2 / 2

HTTP

1 / 1

$ sikker summary 116.140.209.208

116.140.209.208 has a threat confidence score of 74%. This IP address from China (AS4837, CHINA UNICOM China169 Backbone) has been observed in 25 honeypot sessions and reported 4 times targeting SSH, TELNET, HTTPS, HTTP protocols. First observed on March 3, 2026, most recently active March 24, 2026.

$ sikker primitives 116.140.209.208

http_method_get5 http_php_echo_md5_hello_phpunit_marker5 http_body_wget_curl_pipe_to_sh_selfrep2 https_body_wget_curl_pipe_to_sh_apache_selfrep2 http_php_cgi_allow_url_include_auto_prepend_input_injection2 http_cgi_bin_direct_bin_sh_access1 http_phpunit_eval_stdin_php_path_access1 http_phpunit_license_eval_stdin_path_probe1 http_phpunit_util_php_eval_stdin_path_access1 http_phpunit_src_util_php_eval_stdin_path_access1 http_phpunit_legacy_util_php_eval_stdin_path_access1 http_cgi_bin_percent_encoded_directory_traversal_bin_sh1 https_cgi_bin_percent_encoded_directory_traversal_bin_sh1 https_php_ini_directive_injection_allow_url_include_auto_prepend_file1

$ sikker reports 116.140.209.208submit →

Showing 4 of 4 reports from 1 contributor

Reporter	Date	Category	Protocol	Comment
User	Mar 17, 2026, 23:37	Brute Force	SSH	SikkerGuard: 2 blocked packets
User	Mar 16, 2026, 11:50	Brute Force	TELNET	SikkerGuard: 2 blocked packets
User	Mar 14, 2026, 22:38	Brute Force	TELNET	SikkerGuard: 2 blocked packets
User	Mar 11, 2026, 19:55	Brute Force	TELNET	SikkerGuard: 2 blocked packets

$ sikker related 116.140.209.208

🇨🇳·More threats fromChina→AS·More threats fromCHINA UNICOM China169 Backbone→SSH·More threats targetingSSH→TELN·More threats targetingTELNET→HTTP·More threats targetingHTTPS→HTTP·More threats targetingHTTP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
175.149.170.220	100%	91
183.184.58.162	77%	8
123.188.239.247	96%	545
221.1.217.6	67%	31
221.215.168.206	55%	156

IP Address	Confidence	Events
47.121.27.80	80%	22,460
120.26.86.89	50%	18
221.131.45.31	96%	2,290
121.199.160.16	35%	23
106.12.6.79	100%	1,159