Check an IP Address, Domain Name, Subnet, or ASN

213.103.131.143 was found in our database!

$ whois 213.103.131.143

country·🇸🇪 Sweden

city·Gothenburg

isp·Tele2 SWIPnet

asn·AS1257

network·Standard

$ sikker risk 213.103.131.143scoring →

confidence

59%Medium

first_seen·Mar 29, 2026

last_seen·1h ago

sessions·1

events·1

$ sikker protocols 213.103.131.143

SSH

1 / 1

$ sikker summary 213.103.131.143

213.103.131.143 has a threat confidence score of 59%. This IP address from Sweden (AS1257, Tele2 SWIPnet) has been observed in 1 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on March 29, 2026, most recently active March 29, 2026.

$ sikker behaviors 213.103.131.143catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery1x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 213.103.131.143

ssh_routeros_ip_cloud_print_probe2 ssh_uname_all1 ssh_cat_proc_cpuinfo1 ssh_ps_ef_grep_miner_bracket_case1 ssh_ifconfig_interface_enumeration1 ssh_routeros_user_set_password_id01 ssh_echo_hi_pipe_cat_numbering_test1 ssh_locate_telegram_tdata_identifier1 ssh_routeros_interface_lte_print_probe1 ssh_routeros_ip_cloud_set_ddns_enabled1 ssh_ps_pipe_grep_miner_case_insensitive1 ssh_ls_telegram_tdata_and_gsm_sms_artifacts1

$ sikker related 213.103.131.143

🇸🇪·More threats fromSweden→AS·More threats fromTele2 SWIPnet→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
213.103.113.159	39%	4
87.227.94.215	53%	524
83.181.74.161	24%	6
188.149.157.66	68%	2
83.254.220.215	60%	47

IP Address	Confidence	Events
185.246.128.133	79%	8,606
83.254.220.215	60%	48
195.178.191.5	100%	984
83.227.142.225	29%	8
46.59.93.200	47%	462