Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
139.59.251.3 has a threat confidence score of 99%. This IP address from Singapore (AS14061, DigitalOcean, LLC) has been observed in 57 honeypot sessions targeting RDP, SSH protocols. Detected attack patterns include ssh host fingerprint and shell rc immutable removal. First observed on February 22, 2026, most recently active April 7, 2026.
Execution of a multi-command host fingerprinting script that collects kernel details, architecture, uptime, CPU count and model, GPU information, login history, and binary help characteristics, combined with chattr -i $HOME/.bashrc $HOME/.zshrc 2>/dev/null || true to remove the immutable attribute from user shell initialization files in the current user’s home directory.
Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service