Check an IP Address, Domain Name, Subnet, or ASN

222.121.250.156 was found in our database!

$ whois 222.121.250.156

country·🇰🇷 South Korea

city·Yeongdo-gu

isp·Korea Telecom

asn·AS4766

network·Standard

$ sikker risk 222.121.250.156scoring →

confidence

65%High

first_seen·Jan 21, 2026

last_seen·22d ago

sessions·15

events·150

$ sikker protocols 222.121.250.156

SSH

15 / 150

$ sikker summary 222.121.250.156

222.121.250.156 has a threat confidence score of 65%. This IP address from South Korea (AS4766, Korea Telecom) has been observed in 15 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on January 21, 2026, most recently active March 5, 2026.

$ sikker behaviors 222.121.250.156catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery1x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 222.121.250.156

ssh_routeros_ip_cloud_print_probe2 ssh_uname_all1 ssh_cat_proc_cpuinfo1 ssh_ps_ef_grep_miner_bracket_case1 ssh_ifconfig_interface_enumeration1 ssh_routeros_user_set_password_id01 ssh_echo_hi_pipe_cat_numbering_test1 ssh_locate_telegram_tdata_identifier1 ssh_routeros_interface_lte_print_probe1 ssh_routeros_ip_cloud_set_ddns_enabled1 ssh_ps_pipe_grep_miner_case_insensitive1 ssh_ls_telegram_tdata_and_gsm_sms_artifacts1

$ sikker related 222.121.250.156

🇰🇷·More threats fromSouth Korea→AS·More threats fromKorea Telecom→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
118.45.113.206	23%	1
220.76.68.23	77%	20
220.92.117.221	90%	4,890
14.48.223.144	47%	54
183.110.63.196	100%	149

IP Address	Confidence	Events
114.203.87.250	76%	7,232
211.186.79.173	99%	33
220.92.117.221	90%	4,890
182.252.140.114	46%	404
14.48.223.144	47%	54