Check an IP Address, Domain Name, Subnet, or ASN

185.164.81.156 was found in our database!

$ whois 185.164.81.156

country·🇲🇩 Moldova

isp·Primanet Srl

asn·AS207164

network·Standard

$ sikker risk 185.164.81.156scoring →

confidence

59%Medium

first_seen·Mar 23, 2026

last_seen·8d ago

sessions·1

events·1

$ sikker protocols 185.164.81.156

SSH

1 / 1

$ sikker summary 185.164.81.156

185.164.81.156 has a threat confidence score of 59%. This IP address from Moldova (AS207164, Primanet Srl) has been observed in 1 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on March 23, 2026, most recently active March 23, 2026.

$ sikker behaviors 185.164.81.156catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery1x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 185.164.81.156

ssh_routeros_ip_cloud_print_probe2 ssh_uname_all1 ssh_cat_proc_cpuinfo1 ssh_ps_ef_grep_miner_bracket_case1 ssh_ifconfig_interface_enumeration1 ssh_routeros_user_set_password_id01 ssh_echo_hi_pipe_cat_numbering_test1 ssh_locate_telegram_tdata_identifier1 ssh_routeros_interface_lte_print_probe1 ssh_routeros_ip_cloud_set_ddns_enabled1 ssh_ps_pipe_grep_miner_case_insensitive1 ssh_ls_telegram_tdata_and_gsm_sms_artifacts1

$ sikker related 185.164.81.156

🇲🇩·More threats fromMoldova→AS·More threats fromPrimanet Srl→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
45.15.224.178	90%	136
45.15.225.120	76%	25
185.164.80.171	59%	1
45.15.226.100	66%	16
45.15.227.120	69%	77

IP Address	Confidence	Events
45.15.224.178	90%	136
91.225.219.211	75%	3
185.70.189.82	18%	28
178.132.144.161	44%	256
45.15.225.120	76%	25