Check an IP Address, Domain Name, Subnet, or ASN

144.31.27.103 was found in our database!

$ whois 144.31.27.103

country·🇫🇮 Finland

city·Helsinki

isp·u1host ltd

asn·AS213877

network·Standard

$ sikker risk 144.31.27.103scoring →

confidence

64%High

first_seen·Mar 26, 2026

last_seen·2h ago

sessions·1

events·1

$ sikker protocols 144.31.27.103

HTTP

1 / 1

$ sikker summary 144.31.27.103

144.31.27.103 has a threat confidence score of 64%. This IP address from Finland (AS213877, u1host ltd) has been observed in 1 honeypot sessions targeting HTTP protocols. Detected attack patterns include http mass web rce exploitation scanning. First observed on March 26, 2026, most recently active March 26, 2026.

$ sikker behaviors 144.31.27.103catalog →

highHttp Mass Web Rce Exploitation Scanning1x

Coordinated automated exploitation attempts targeting public-facing web services, including PHPUnit eval-stdin access, PHP-CGI argument injection, Docker API exposure, directory traversal, ThinkPHP invokeFunction abuse, and command execution patterns (wget/curl pipe to shell). Identifies opportunistic bot-driven RCE scanning and framework-specific exploit chaining against internet-exposed applications.

$ sikker primitives 144.31.27.103

http_method_get42 http_php_echo_md5_hello_phpunit_marker37 http_body_wget_curl_pipe_to_sh_selfrep2 http_thinkphp_invokefunction_call_user_func_array_md52 http_php_cgi_allow_url_include_auto_prepend_input_injection2 http_cgi_bin_direct_bin_sh_access1 http_phpunit_eval_stdin_php_path_access1 http_phpunit_license_eval_stdin_path_probe1 http_docker_api_containers_json_path_access1 http_phpunit_util_php_eval_stdin_path_access1 http_root_phpunit_src_eval_stdin_path_access1 http_root_phpunit_util_eval_stdin_path_access1 http_double_vendor_phpunit_eval_stdin_path_probe1 http_phpunit_src_util_php_eval_stdin_path_access1 http_root_phpunit_util_php_eval_stdin_path_access1 http_lang_parameter_deep_path_traversal_tmp_index11 http_pearcmd_config_create_path_traversal_md5_write1 http_phpunit_legacy_util_php_eval_stdin_path_access1 http_root_phpunit_src_util_php_eval_stdin_path_access1 http_cgi_bin_percent_encoded_directory_traversal_bin_sh1

$ sikker related 144.31.27.103

🇫🇮·More threats fromFinland→AS·More threats fromu1host ltd→HTTP·More threats targetingHTTP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
144.31.137.41	90%	30
144.31.254.191	66%	8
144.31.255.133	52%	4
144.31.246.153	73%	7
77.239.101.27	53%	10

IP Address	Confidence	Events
46.8.70.162	67%	6
77.42.70.132	23%	1
46.62.222.88	73%	10
80.223.10.196	61%	2
2.27.50.135	57%	104