Check an IP Address, Domain Name, Subnet, or ASN

2.26.115.54 was found in our database!

$ whois 2.26.115.54

country·🇬🇧 United Kingdom

city·Croydon

isp·British Telecommunications PLC

asn·AS2856

network·Standard

$ sikker risk 2.26.115.54scoring →

confidence

89%Very High

first_seen·Apr 16, 2026

last_seen·3d ago

sessions·23

events·23

$ sikker protocols 2.26.115.54

SSH

23 / 23

$ sikker summary 2.26.115.54

2.26.115.54 has a threat confidence score of 89%. This IP address from United Kingdom (AS2856, British Telecommunications PLC) has been observed in 23 honeypot sessions targeting SSH protocols. First observed on April 16, 2026, most recently active April 16, 2026.

$ sikker primitives 2.26.115.54

ssh_kill_sigkill_target_root_literal64 ssh_readlink_proc_root_exe_resolved_path64 ssh_kill_sigkill_target_systemd_plus_literal48 ssh_cd_dev_shm_tmp_var_run_mnt_root_fallback_then_cat_to_netai48 ssh_uname_all16 ssh_ps_aux_grep_netai_exclude_grep_count16 ssh_cpu_core_count_via_proc_cpuinfo_pipeline16 ssh_kill_sigkill_target_message_plus_literal16 ssh_top_10_processes_by_cpu_via_ps_sorted_desc16 ssh_readlink_proc_message_plus_exe_resolved_path16 ssh_cd_dev_shm_tmp_var_run_mnt_root_fallback_pwd_echo16 ssh_cd_tmp_create_w_sh_if_missing_via_stdin_and_chmod_exec16 ssh_create_user_systemd_watcher_netai_service_and_enable_now16 ssh_crontab_persist_tmp_w_sh_with_reboot_and_hourly_execution_if_missing16

$ sikker related 2.26.115.54

🇬🇧·More threats fromUnited Kingdom→AS·More threats fromBritish Telecommunications PLC→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
86.142.188.221	56%	1
86.150.104.142	74%	4
86.160.225.60	75%	3
81.143.216.61	95%	267
86.149.181.52	61%	2

IP Address	Confidence	Events
35.203.211.124	80%	184
35.203.211.93	86%	275
51.89.1.86	93%	10,317
194.213.3.5	97%	5,511
35.203.211.125	80%	276