Check an IP Address, Domain Name, Subnet, or ASN

91.196.152.199 was found in our database!

$ whois 91.196.152.199

country·🇫🇷 France

city·Roubaix

isp·ONYPHE SAS

asn·AS213412

network·Standard

$ sikker risk 91.196.152.199scoring →

confidence

44%Medium

first_seen·Feb 8, 2026

last_seen·1h ago

sessions·24

events·29

$ sikker protocols 91.196.152.199

IMAP

6 / 8

SSH

6 / 7

SIP

4 / 4

HTTPS

1 / 3

TELNET

2 / 2

FTP

1 / 1

HTTP

1 / 1

SMTP

1 / 1

DOCKER

1 / 1

ELASTICSEARCH

1 / 1

$ sikker summary 91.196.152.199

91.196.152.199 has a threat confidence score of 44%. This IP address from France (AS213412, ONYPHE SAS) has been observed in 24 honeypot sessions targeting IMAP, SSH, SIP, HTTPS, TELNET and 5 other protocols. First observed on February 8, 2026, most recently active March 27, 2026.

$ sikker behaviors 91.196.152.199catalog →

infoFtp Tls Upgrade1x

FTP session where the client issues AUTH TLS to upgrade the connection to Transport Layer Security. This reflects protocol-level encryption negotiation prior to further interaction.

infoDocker Invalid Protocol Probe1x

Client repeatedly sends GET requests to the /bad-request Docker API endpoint, indicating malformed or incompatible traffic against the Docker daemon. This pattern is typically associated with generic internet scanning or tools attempting HTTP interaction without speaking the proper Docker API protocol.

$ sikker primitives 91.196.152.199

ftp_auth_tls1 docker_get_method1 docker_bad_request_uri1 elastic_http_get_request1 elastic_http_bad_request_path_probe1

$ sikker related 91.196.152.199

🇫🇷·More threats fromFrance→AS·More threats fromONYPHE SAS→IMAP·More threats targetingIMAP→SSH·More threats targetingSSH→SIP·More threats targetingSIP→HTTP·More threats targetingHTTPS→TELN·More threats targetingTELNET→FTP·More threats targetingFTP→HTTP·More threats targetingHTTP→SMTP·More threats targetingSMTP→DOCK·More threats targetingDOCKER→ELAS·More threats targetingELASTICSEARCH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
91.231.89.118	69%	92
91.231.89.112	68%	67
91.231.89.131	84%	69
91.231.89.110	70%	72
91.231.89.3	66%	84

IP Address	Confidence	Events
54.38.94.109	98%	36,235
51.83.143.139	90%	80,441
51.91.168.102	99%	660,932
194.163.176.32	87%	9
34.155.183.47	87%	1,800