Check an IP Address, Domain Name, Subnet, or ASN

222.76.145.59 was found in our database!

$ whois 222.76.145.59

country·🇨🇳 China

isp·Chinanet

asn·AS4134

network·Standard

$ sikker risk 222.76.145.59scoring →

confidence

90%Very High

first_seen·Mar 21, 2026

last_seen·26m ago

sessions·25

events·25

$ sikker protocols 222.76.145.59

RDP

25 / 25

$ sikker summary 222.76.145.59

222.76.145.59 has a threat confidence score of 90%. This IP address from China (AS4134, Chinanet) has been observed in 25 honeypot sessions targeting RDP protocols. First observed on March 21, 2026, most recently active March 21, 2026.

$ sikker behaviors 222.76.145.59catalog →

mediumRdp Nla Ntlm Authentication Attempt21x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 222.76.145.59

rdp_nla_ntlm_auth21

$ sikker related 222.76.145.59

🇨🇳·More threats fromChina→AS·More threats fromChinanet→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
183.145.247.1	90%	550
61.140.160.9	54%	61
222.93.17.116	78%	89
117.86.31.169	61%	27
112.67.216.151	96%	201

IP Address	Confidence	Events
139.129.13.203	85%	37,043
139.196.233.120	84%	30,793
182.43.76.120	100%	788
175.178.128.197	96%	1,162
112.67.216.151	96%	204