Check an IP Address, Domain Name, Subnet, or ASN

173.22.111.219 was found in our database!

$ whois 173.22.111.219

country·🇺🇸 United States

city·Savage

isp·Mediacom Communications Corp

asn·AS30036

network·Standard

$ sikker risk 173.22.111.219scoring →

confidence

63%High

first_seen·Mar 17, 2026

last_seen·12d ago

sessions·2

events·2

$ sikker protocols 173.22.111.219

SSH

2 / 2

$ sikker summary 173.22.111.219

173.22.111.219 has a threat confidence score of 63%. This IP address from United States (AS30036, Mediacom Communications Corp) has been observed in 2 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on March 17, 2026, most recently active March 17, 2026.

$ sikker behaviors 173.22.111.219catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery1x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 173.22.111.219

ssh_routeros_ip_cloud_print_probe2 ssh_uname_all1 ssh_cat_proc_cpuinfo1 ssh_ps_ef_grep_miner_bracket_case1 ssh_ifconfig_interface_enumeration1 ssh_routeros_user_set_password_id01 ssh_echo_hi_pipe_cat_numbering_test1 ssh_locate_telegram_tdata_identifier1 ssh_routeros_interface_lte_print_probe1 ssh_routeros_ip_cloud_set_ddns_enabled1 ssh_ps_pipe_grep_miner_case_insensitive1 ssh_ls_telegram_tdata_and_gsm_sms_artifacts1

$ sikker related 173.22.111.219

🇺🇸·More threats fromUnited States→AS·More threats fromMediacom Communications Corp→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
173.21.102.64	78%	7
173.25.186.130	51%	454
173.24.222.84	82%	174
173.26.15.170	22%	55
173.21.3.14	99%	64

IP Address	Confidence	Events
157.230.7.142	77%	104
205.210.31.103	94%	339
54.218.81.185	61%	98
193.148.63.132	95%	112
20.65.144.90	73%	164