Check an IP Address, Domain Name, Subnet, or ASN

144.31.89.102 was found in our database!

$ whois 144.31.89.102

country·🇩🇪 Germany

city·Frankfurt am Main

isp·u1host ltd

asn·AS213877

network·Standard

$ sikker risk 144.31.89.102scoring →

confidence

78%High

first_seen·Mar 16, 2026

last_seen·5d ago

sessions·8

events·8

$ sikker protocols 144.31.89.102

HTTPS

6 / 6

HTTP

1 / 1

DOCKER

1 / 1

$ sikker summary 144.31.89.102

144.31.89.102 has a threat confidence score of 78%. This IP address from Germany (AS213877, u1host ltd) has been observed in 8 honeypot sessions targeting HTTPS, HTTP, DOCKER protocols. Detected attack patterns include http mass web rce exploitation scanning. First observed on March 16, 2026, most recently active March 19, 2026.

$ sikker behaviors 144.31.89.102catalog →

highHttp Mass Web Rce Exploitation Scanning1x

Coordinated automated exploitation attempts targeting public-facing web services, including PHPUnit eval-stdin access, PHP-CGI argument injection, Docker API exposure, directory traversal, ThinkPHP invokeFunction abuse, and command execution patterns (wget/curl pipe to shell). Identifies opportunistic bot-driven RCE scanning and framework-specific exploit chaining against internet-exposed applications.

$ sikker primitives 144.31.89.102

http_method_get42 http_php_echo_md5_hello_phpunit_marker37 https_query_thinkphp_invokefunction_md5_probe12 https_body_wget_curl_pipe_to_sh_apache_selfrep12 https_php_ini_directive_injection_allow_url_include_auto_prepend_file12 https_path_root6 https_phpunit_eval_stdin_rce_probe6 https_cgi_bin_percent_encoded_directory_traversal_bin_sh6 docker_post_method3 docker_container_exec_path2 http_body_wget_curl_pipe_to_sh_selfrep2 http_thinkphp_invokefunction_call_user_func_array_md52 http_php_cgi_allow_url_include_auto_prepend_input_injection2 docker_get_method1 docker_exec_start_endpoint1 docker_list_containers_endpoint1 http_cgi_bin_direct_bin_sh_access1 http_phpunit_eval_stdin_php_path_access1 http_phpunit_license_eval_stdin_path_probe1 http_docker_api_containers_json_path_access1

$ sikker related 144.31.89.102

🇩🇪·More threats fromGermany→AS·More threats fromu1host ltd→HTTP·More threats targetingHTTPS→HTTP·More threats targetingHTTP→DOCK·More threats targetingDOCKER→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
144.31.255.133	23%	1
144.31.137.41	89%	22
144.31.246.153	72%	3
144.31.254.191	65%	5
64.188.117.77	82%	10

IP Address	Confidence	Events
5.83.144.23	79%	1,386
89.163.204.62	88%	79,530
87.106.147.36	99%	221,532
152.53.191.128	83%	56,096
217.154.152.145	81%	650