Check an IP Address, Domain Name, Subnet, or ASN

87.249.164.52 was found in our database!

$ whois 87.249.164.52

country·🇸🇪 Sweden

city·Järvsö

isp·Ljusnet AB

asn·AS25417

network·Standard

$ sikker risk 87.249.164.52scoring →

confidence

74%High

first_seen·Apr 3, 2026

last_seen·13d ago

sessions·3

events·3

$ sikker protocols 87.249.164.52

SSH

3 / 3

$ sikker summary 87.249.164.52

87.249.164.52 has a threat confidence score of 74%. This IP address from Sweden (AS25417, Ljusnet AB) has been observed in 3 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on April 3, 2026, most recently active April 6, 2026.

$ sikker behaviors 87.249.164.52catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery3x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 87.249.164.52

ssh_routeros_ip_cloud_print_probe6 ssh_uname_all3 ssh_cat_proc_cpuinfo3 ssh_ps_ef_grep_miner_bracket_case3 ssh_ifconfig_interface_enumeration3 ssh_routeros_user_set_password_id03 ssh_echo_hi_pipe_cat_numbering_test3 ssh_locate_telegram_tdata_identifier3 ssh_routeros_interface_lte_print_probe3 ssh_routeros_ip_cloud_set_ddns_enabled3 ssh_ps_pipe_grep_miner_case_insensitive3 ssh_ls_telegram_tdata_and_gsm_sms_artifacts3

$ sikker related 87.249.164.52

🇸🇪·More threats fromSweden→AS·More threats fromLjusnet AB→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
87.249.188.12	59%	1
87.249.172.70	59%	1
87.249.171.14	59%	1
87.249.168.118	59%	1
87.249.167.187	59%	1

IP Address	Confidence	Events
185.246.128.133	78%	13,289
46.59.89.5	49%	492
176.10.197.168	49%	487
185.186.78.170	70%	84
45.84.107.74	99%	957