Check an IP Address, Domain Name, Subnet, or ASN

5.39.53.85 was found in our database!

$ whois 5.39.53.85

country·🇫🇷 France

isp·OVH SAS

asn·AS16276

network·Standard

$ sikker risk 5.39.53.85scoring →

confidence

92%Very High

first_seen·Mar 13, 2026

last_seen·1h ago

sessions·139

events·139

$ sikker protocols 5.39.53.85

SIP

139 / 139

$ sikker summary 5.39.53.85

5.39.53.85 has a threat confidence score of 92%. This IP address from France (AS16276, OVH SAS) has been observed in 139 honeypot sessions targeting SIP protocols. First observed on March 13, 2026, most recently active March 25, 2026.

$ sikker behaviors 5.39.53.85catalog →

mediumSip Automated Enumeration Activity36x

Represents automated SIP reconnaissance activity characterized by multiple unauthenticated SIP methods (such as REGISTER and INVITE) issued using bot-like Call-ID formats. This behavior indicates an attempt to enumerate valid SIP users, extensions, or call routing behavior by systematically probing a SIP service without establishing legitimate registration or dialog context. The use of a numeric-only, hyphen-delimited Call-ID format across different SIP methods strongly suggests an automated scanner or fraud bot rather than a legitimate user agent.

$ sikker primitives 5.39.53.85

sip_register_request72 sip_call_id_numeric_triplet72

$ sikker related 5.39.53.85

🇫🇷·More threats fromFrance→AS·More threats fromOVH SAS→SIP·More threats targetingSIP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
51.89.235.201	89%	57,345
51.83.143.139	90%	77,991
54.38.41.116	87%	33,345
15.204.128.147	96%	2,830
188.165.26.231	68%	438

IP Address	Confidence	Events
194.180.176.29	95%	143
54.38.41.116	87%	33,381
51.83.143.139	90%	78,026
62.171.167.109	81%	16
91.196.152.57	77%	86