Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
14.22.76.75 has a threat confidence score of 81%. This IP address from China (AS135089, China Telecom) has been observed in 4 honeypot sessions targeting HTTPS, SSH, TELNET protocols. Detected attack patterns include docker remote exec via api, docker api container exec attempt. First observed on March 18, 2026, most recently active March 21, 2026.
Attacker interaction with an exposed Docker Engine API resulting in container enumeration followed by remote command execution inside running containers. The sequence of GET /containers/json and subsequent POST /containers/{id}/exec and /exec/{id}/start calls represents deliberate hands-on-keyboard activity where the adversary uses the Docker daemon as a control plane to execute commands, deploy payloads, or pivot further within the host environment. This behavior reflects active container abuse observed directly through high-interaction honeypot instrumentation.
Sequence of Docker API interactions involving container enumeration and execution endpoints, including GET requests to list containers followed by POST requests to exec endpoints, indicating an attempt to execute commands inside containers via the Docker remote API.