Check an IP Address, Domain Name, Subnet, or ASN

80.234.72.192 was found in our database!

$ whois 80.234.72.192

country·🇷🇺 Russia

city·Samara

isp·Rostelecom

asn·AS12389

network·Standard

$ sikker risk 80.234.72.192scoring →

confidence

60%High

first_seen·Mar 29, 2026

last_seen·1h ago

sessions·2

events·2

$ sikker protocols 80.234.72.192

SMB

2 / 2

$ sikker summary 80.234.72.192

80.234.72.192 has a threat confidence score of 60%. This IP address from Russia (AS12389, Rostelecom) has been observed in 2 honeypot sessions targeting SMB protocols. Detected attack patterns include remcom remote execution. First observed on March 29, 2026, most recently active March 29, 2026.

$ sikker behaviors 80.234.72.192catalog →

highRemcom Remote Execution1x

Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.

$ sikker primitives 80.234.72.192

smb_empty_rpc_call1 smb_ipc_share_access1 smb_remcom_pipe_open1 smb_svcctl_pipe_open1

$ sikker related 80.234.72.192

🇷🇺·More threats fromRussia→AS·More threats fromRostelecom→SMB·More threats targetingSMB→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
95.152.62.133	35%	3
89.109.23.77	32%	79
2.63.211.145	79%	21,094
85.175.167.158	15%	25
88.205.172.170	98%	49

IP Address	Confidence	Events
176.120.22.97	52%	235
176.120.22.36	52%	227
185.90.101.64	49%	607
80.66.83.43	100%	5,465
176.120.22.110	51%	208