Check an IP Address, Domain Name, Subnet, or ASN

167.172.196.107 was found in our database!

$ whois 167.172.196.107

country·🇺🇸 United States

city·Santa Clara

isp·DigitalOcean, LLC

asn·AS14061

network·Standard

$ sikker risk 167.172.196.107scoring →

confidence

57%Medium

first_seen·Mar 3, 2026

last_seen·1h ago

sessions·56

events·56

$ sikker protocols 167.172.196.107

MONGODB

39 / 39

HTTPS

10 / 10

RDP

5 / 5

ELASTICSEARCH

2 / 2

$ sikker summary 167.172.196.107

167.172.196.107 has a threat confidence score of 57%. This IP address from United States (AS14061, DigitalOcean, LLC) has been observed in 56 honeypot sessions targeting MONGODB, HTTPS, RDP, ELASTICSEARCH protocols. First observed on March 3, 2026, most recently active April 2, 2026.

$ sikker behaviors 167.172.196.107catalog →

mediumRdp Nla Ntlm Authentication Attempt1x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 167.172.196.107

elastic_http_get_request18 elastic_http_bad_request_path_probe12 elastic_root_path_probe3 rdp_nla_ntlm_auth1 elastic_nodes_enumeration1

$ sikker related 167.172.196.107

🇺🇸·More threats fromUnited States→AS·More threats fromDigitalOcean, LLC→MONG·More threats targetingMONGODB→HTTP·More threats targetingHTTPS→RDP·More threats targetingRDP→ELAS·More threats targetingELASTICSEARCH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
157.245.55.57	19%	35
165.232.137.88	23%	1
159.89.50.199	95%	265
192.241.149.213	78%	101
67.205.178.44	99%	89

IP Address	Confidence	Events
20.168.5.220	50%	48
162.159.99.80	13%	6
68.68.101.181	84%	283
92.118.39.63	100%	67,528
144.172.105.188	97%	20,624