Check an IP Address, Domain Name, Subnet, or ASN

120.28.81.172 was found in our database!

$ whois 120.28.81.172

country·🇵🇭 Philippines

city·Caloocan City

isp·Globe Telecom Inc.

asn·AS132199

network·Standard

$ sikker risk 120.28.81.172scoring →

confidence

86%Very High

first_seen·Apr 6, 2026

last_seen·12d ago

sessions·13

events·13

$ sikker protocols 120.28.81.172

SMB

13 / 13

$ sikker summary 120.28.81.172

120.28.81.172 has a threat confidence score of 86%. This IP address from Philippines (AS132199, Globe Telecom Inc.) has been observed in 13 honeypot sessions targeting SMB protocols. Detected attack patterns include remcom remote execution. First observed on April 6, 2026, most recently active April 7, 2026.

$ sikker behaviors 120.28.81.172catalog →

highRemcom Remote Execution5x

Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.

$ sikker primitives 120.28.81.172

smb_empty_rpc_call5 smb_ipc_share_access5 smb_remcom_pipe_open5 smb_svcctl_pipe_open5

$ sikker related 120.28.81.172

🇵🇭·More threats fromPhilippines→AS·More threats fromGlobe Telecom Inc.→SMB·More threats targetingSMB→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
180.190.73.27	56%	77
120.28.109.188	100%	669
222.127.154.48	36%	1
180.190.122.27	47%	8
180.190.109.105	50%	10

IP Address	Confidence	Events
172.110.223.139	70%	20
161.49.89.39	100%	1,224
116.50.237.226	25%	111
45.250.157.82	25%	112
58.69.56.208	87%	12