Check an IP Address, Domain Name, Subnet, or ASN

43.128.89.91 was found in our database!

$ whois 43.128.89.91

country·🇸🇬 Singapore

city·Singapore

isp·Tencent Building, Kejizhongyi Avenue

asn·AS132203

network·Standard

$ sikker risk 43.128.89.91scoring →

confidence

93%Very High

first_seen·Mar 10, 2026

last_seen·1h ago

sessions·130

events·130

$ sikker protocols 43.128.89.91

RDP

130 / 130

$ sikker summary 43.128.89.91

43.128.89.91 has a threat confidence score of 93%. This IP address from Singapore (AS132203, Tencent Building, Kejizhongyi Avenue) has been observed in 130 honeypot sessions targeting RDP protocols. First observed on March 10, 2026, most recently active March 16, 2026.

$ sikker behaviors 43.128.89.91catalog →

mediumRdp Nla Ntlm Authentication Attempt119x

Identifies RDP clients attempting authentication using Network Level Authentication (NLA) with the NTLM challenge-response protocol. This occurs during the CredSSP negotiation phase before a remote desktop session is established and indicates an active credential authentication attempt against the RDP service

$ sikker primitives 43.128.89.91

rdp_nla_ntlm_auth120

$ sikker related 43.128.89.91

🇸🇬·More threats fromSingapore→AS·More threats fromTencent Building, Kejizhongyi Avenue→RDP·More threats targetingRDP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
43.173.248.187	94%	154
124.156.160.12	95%	440
43.162.109.139	95%	402
43.134.83.126	94%	127
43.161.246.233	75%	8

IP Address	Confidence	Events
104.234.180.105	95%	379
172.69.176.102	7%	52
47.245.110.233	82%	31
134.122.153.211	96%	1,109
43.134.83.126	94%	127