Check an IP Address, Domain Name, Subnet, or ASN

123.54.215.78 was found in our database!

$ whois 123.54.215.78

country·🇨🇳 China

isp·China Telecom Henan Zhengzhou Shujugang IDC network

asn·AS139587

network·Standard

$ sikker risk 123.54.215.78scoring →

confidence

94%Very High

first_seen·Mar 10, 2026

last_seen·37m ago

sessions·425

events·425

$ sikker protocols 123.54.215.78

RDP

425 / 425

$ sikker summary 123.54.215.78

123.54.215.78 has a threat confidence score of 94%. This IP address from China (AS139587, China Telecom Henan Zhengzhou Shujugang IDC network) has been observed in 425 honeypot sessions targeting RDP protocols. First observed on March 10, 2026, most recently active March 20, 2026.

$ sikker behaviors 123.54.215.78catalog →

mediumRdp Nla Ntlm Authentication Attempt396x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 123.54.215.78

rdp_nla_ntlm_auth396

$ sikker related 123.54.215.78

🇨🇳·More threats fromChina→AS·More threats fromChina Telecom Henan Zhengzhou Shujugang IDC network→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
1.194.209.65	23%	1
1.194.209.80	23%	1
1.194.209.91	23%	1
123.54.197.60	26%	39
1.194.195.182	50%	8

IP Address	Confidence	Events
221.131.45.31	95%	415
139.196.233.120	84%	29,515
39.104.208.231	73%	3,181
36.212.221.214	92%	40
58.18.38.116	41%	161