Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
185.105.88.5 has a very high threat confidence level of 91%, originating from Moscow, Russia, on the First Server Limited network (205090). It has been observed across 45 sessions targeting SMB, First observed on March 3, 2026, most recently active March 5, 2026.
Composite behavior identifying authenticated SMB interaction where a client accesses the IPC$ share, performs root directory reads, binds to the SAMR RPC interface, and interacts with the SRVSVC service pipe. This sequence is consistent with remote host and account enumeration activity over SMB, typically used to gather domain, user, and share information prior to lateral movement or privilege escalation attempts.