Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
116.196.85.94 has a threat confidence score of 50%. This IP address from China (AS4808, China Unicom Beijing Province Network) has been observed in 8 honeypot sessions targeting SSH protocols. First observed on March 29, 2026, most recently active April 2, 2026.
Attempts to remove filesystem attribute protections (e.g., immutable flags via chattr -i/-a) from the user’s ~/.ssh directory. This pattern indicates preparatory activity to modify SSH trust configuration, commonly preceding insertion or replacement of authorized_keys for persistence.