Check an IP Address, Domain Name, Subnet, or ASN

84.215.3.131 was found in our database!

$ whois 84.215.3.131

country·🇳🇴 Norway

city·Børgen

isp·Telia Norge AS

asn·AS25400

network·Standard

$ sikker risk 84.215.3.131scoring →

confidence

72%High

first_seen·Mar 24, 2026

last_seen·2d ago

sessions·3

events·3

$ sikker protocols 84.215.3.131

SSH

3 / 3

$ sikker summary 84.215.3.131

84.215.3.131 has a threat confidence score of 72%. This IP address from Norway (AS25400, Telia Norge AS) has been observed in 3 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on March 24, 2026, most recently active March 31, 2026.

$ sikker behaviors 84.215.3.131catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery3x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 84.215.3.131

ssh_routeros_ip_cloud_print_probe6 ssh_uname_all3 ssh_cat_proc_cpuinfo3 ssh_ps_ef_grep_miner_bracket_case3 ssh_ifconfig_interface_enumeration3 ssh_routeros_user_set_password_id03 ssh_echo_hi_pipe_cat_numbering_test3 ssh_locate_telegram_tdata_identifier3 ssh_routeros_interface_lte_print_probe3 ssh_routeros_ip_cloud_set_ddns_enabled3 ssh_ps_pipe_grep_miner_case_insensitive3 ssh_ls_telegram_tdata_and_gsm_sms_artifacts3

$ sikker related 84.215.3.131

🇳🇴·More threats fromNorway→AS·More threats fromTelia Norge AS→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
84.214.103.56	71%	5
85.19.195.12	51%	456
83.243.215.226	52%	1
83.243.182.148	55%	2
178.232.97.6	98%	95

IP Address	Confidence	Events
185.12.59.118	79%	6,076
84.214.103.56	71%	5
51.120.81.94	44%	3
89.11.147.1	83%	26
194.71.23.24	23%	1