Check an IP Address, Domain Name, Subnet, or ASN

89.109.54.201 was found in our database!

$ whois 89.109.54.201

country·🇷🇺 Russia

city·Nizhniy Novgorod

isp·Rostelecom

asn·AS12389

network·Standard

$ sikker risk 89.109.54.201scoring →

confidence

100%Very High

first_seen·Mar 10, 2026

last_seen·56m ago

sessions·169

events·169

$ sikker protocols 89.109.54.201

FTP

169 / 169

$ sikker summary 89.109.54.201

89.109.54.201 has a threat confidence score of 100%. This IP address from Russia (AS12389, Rostelecom) has been observed in 169 honeypot sessions targeting FTP protocols. Detected attack patterns include ftp valid account photo scr deployment. First observed on March 10, 2026, most recently active March 20, 2026.

$ sikker behaviors 89.109.54.201catalog →

highFtp Valid Account Photo Scr Deployment50x

Detects an automated FTP session performing credential probing, directory discovery, ASCII mode configuration, passive transfer negotiation, and staged upload of a photo_scr payload. This pattern is consistent with scripted web shell or content-stager deployment via compromised FTP credentials.

mediumFtp Photo Payload Upload Attempt14x

FTP session where the client uploads files named Photo.scr and Photo.lnk using STOR after entering passive mode.

$ sikker primitives 89.109.54.201

ftp_enter_passive_mode956 ftp_user_probe163 ftp_file_upload_photo_scr163 ftp_print_working_directory163 ftp_change_working_directory163 ftp_password_attempt161 ftp_set_ascii_mode128 ftp_file_upload_photo_lnk34 ftp_noop_request12

$ sikker related 89.109.54.201

🇷🇺·More threats fromRussia→AS·More threats fromRostelecom→FTP·More threats targetingFTP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
90.188.38.227	52%	438
2.63.211.145	79%	19,718
82.208.124.116	36%	10
95.70.33.11	23%	1
5.141.84.102	33%	111

IP Address	Confidence	Events
90.188.38.227	52%	438
2.63.211.145	79%	19,718
82.208.124.116	36%	10
81.30.196.70	32%	132
81.29.142.100	100%	26,871