Check an IP Address, Domain Name, Subnet, or ASN

223.104.72.205 was found in our database!

$ whois 223.104.72.205

country·🇨🇳 China

city·Shenzhen

isp·China Mobile communications corporation

asn·AS56040

network·Standard

$ sikker risk 223.104.72.205scoring →

confidence

43%Medium

first_seen·Apr 10, 2026

last_seen·21d ago

sessions·1

events·1

$ sikker protocols 223.104.72.205

RDP

1 / 1

$ sikker summary 223.104.72.205

223.104.72.205 has a threat confidence score of 43%. This IP address from China (AS56040, China Mobile communications corporation) has been observed in 1 honeypot sessions targeting RDP protocols. First observed on April 10, 2026, most recently active April 10, 2026.

$ sikker behaviors 223.104.72.205catalog →

mediumRdp Nla Ntlm Authentication Attempt1x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 223.104.72.205

rdp_nla_ntlm_auth1

$ sikker related 223.104.72.205

🇨🇳·More threats fromChina→AS·More threats fromChina Mobile communications corporation→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
120.241.79.66	100%	759
183.236.48.45	60%	6
123.88.228.248	53%	13
36.139.109.183	30%	2
120.235.162.225	42%	3

IP Address	Confidence	Events
36.151.144.79	94%	1,173
101.52.130.122	100%	727
219.139.32.68	100%	344
47.108.152.113	94%	1,213
36.156.154.52	95%	2,097