Check an IP Address, Domain Name, Subnet, or ASN

89.109.149.19 was found in our database!

$ whois 89.109.149.19

country·🇷🇺 Russia

isp·Rostelecom

asn·AS34137

network·Standard

$ sikker risk 89.109.149.19scoring →

confidence

86%Very High

first_seen·Mar 2, 2026

last_seen·16d ago

sessions·11

events·11

$ sikker protocols 89.109.149.19

SMB

11 / 11

$ sikker summary 89.109.149.19

89.109.149.19 has a threat confidence score of 86%. This IP address from Russia (AS34137, Rostelecom) has been observed in 11 honeypot sessions targeting SMB protocols. Detected attack patterns include remcom remote execution. First observed on March 2, 2026, most recently active March 2, 2026.

$ sikker behaviors 89.109.149.19catalog →

highRemcom Remote Execution5x

Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.

$ sikker primitives 89.109.149.19

smb_empty_rpc_call5 smb_ipc_share_access5 smb_remcom_pipe_open5 smb_svcctl_pipe_open5

$ sikker related 89.109.149.19

🇷🇺·More threats fromRussia→AS·More threats fromRostelecom→SMB·More threats targetingSMB→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
89.109.180.38	30%	79
89.109.175.214	19%	36
85.88.179.176	36%	1
89.109.180.10	78%	11

IP Address	Confidence	Events
176.210.155.19	35%	3
82.147.84.72	63%	126
5.130.129.179	72%	4
5.141.117.4	42%	301
85.95.177.156	32%	134