Check an IP Address, Domain Name, Subnet, or ASN

159.89.140.55 was found in our database!

$ whois 159.89.140.55

country·🇺🇸 United States

city·Santa Clara

isp·DigitalOcean, LLC

asn·AS14061

network·Standard

$ sikker risk 159.89.140.55scoring →

confidence

65%High

first_seen·Mar 1, 2026

last_seen·1h ago

sessions·84

events·84

$ sikker protocols 159.89.140.55

MONGODB

41 / 41

SMB

21 / 21

HTTPS

10 / 10

RDP

6 / 6

ELASTICSEARCH

6 / 6

$ sikker summary 159.89.140.55

159.89.140.55 has a threat confidence score of 65%. This IP address from United States (AS14061, DigitalOcean, LLC) has been observed in 84 honeypot sessions targeting MONGODB, SMB, HTTPS, RDP, ELASTICSEARCH protocols. First observed on March 1, 2026, most recently active April 6, 2026.

$ sikker behaviors 159.89.140.55catalog →

mediumRdp Nla Ntlm Authentication Attempt2x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 159.89.140.55

elastic_http_get_request32 elastic_http_bad_request_path_probe24 elastic_root_path_probe8 mongodb_ismaster2 rdp_nla_ntlm_auth2

$ sikker related 159.89.140.55

🇺🇸·More threats fromUnited States→AS·More threats fromDigitalOcean, LLC→MONG·More threats targetingMONGODB→SMB·More threats targetingSMB→HTTP·More threats targetingHTTPS→RDP·More threats targetingRDP→ELAS·More threats targetingELASTICSEARCH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
206.81.29.46	85%	414
147.182.196.210	71%	21
104.131.0.219	75%	49
67.205.182.17	64%	11
104.248.14.7	78%	117

IP Address	Confidence	Events
64.62.156.222	100%	1,923
38.146.219.190	53%	13
209.222.101.54	99%	58,014
43.162.109.139	96%	3,548
65.49.1.182	100%	1,827