Check an IP Address, Domain Name, Subnet, or ASN

213.112.126.21 was found in our database!

$ whois 213.112.126.21

country·🇸🇪 Sweden

city·Stockholm

isp·Telenor Sverige AB

asn·AS8434

network·Standard

$ sikker risk 213.112.126.21scoring →

confidence

82%Very High

first_seen·Mar 21, 2026

last_seen·1h ago

sessions·6

events·6

$ sikker protocols 213.112.126.21

SSH

6 / 6

$ sikker summary 213.112.126.21

213.112.126.21 has a threat confidence score of 82%. This IP address from Sweden (AS8434, Telenor Sverige AB) has been observed in 6 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on March 21, 2026, most recently active April 5, 2026.

$ sikker behaviors 213.112.126.21catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery6x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 213.112.126.21

ssh_routeros_ip_cloud_print_probe12 ssh_uname_all6 ssh_cat_proc_cpuinfo6 ssh_ps_ef_grep_miner_bracket_case6 ssh_ifconfig_interface_enumeration6 ssh_routeros_user_set_password_id06 ssh_echo_hi_pipe_cat_numbering_test6 ssh_locate_telegram_tdata_identifier6 ssh_routeros_interface_lte_print_probe6 ssh_routeros_ip_cloud_set_ddns_enabled6 ssh_ps_pipe_grep_miner_case_insensitive6 ssh_ls_telegram_tdata_and_gsm_sms_artifacts6

$ sikker related 213.112.126.21

🇸🇪·More threats fromSweden→AS·More threats fromTelenor Sverige AB→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
92.33.193.44	23%	1
46.194.89.28	64%	4
85.229.46.153	48%	464
85.227.86.238	71%	81
85.231.90.253	28%	17

IP Address	Confidence	Events
217.209.13.98	100%	90
171.25.158.73	100%	595
4.223.104.110	51%	3
155.4.244.179	100%	495
185.246.130.20	86%	1,807