Check an IP Address, Domain Name, Subnet, or ASN

91.196.152.30 was found in our database!

$ whois 91.196.152.30

country·🇫🇷 France

city·Roubaix

isp·ONYPHE SAS

asn·AS213412

network·Standard

$ sikker risk 91.196.152.30scoring →

confidence

57%Medium

first_seen·Jan 20, 2026

last_seen·1h ago

sessions·51

events·83

$ sikker protocols 91.196.152.30

SIP

6 / 14

SSH

10 / 14

HTTPS

7 / 11

IMAP

7 / 10

FTP

3 / 8

SMTP

3 / 7

HTTP

4 / 6

POSTGRES

5 / 5

TR069

1 / 3

ELASTICSEARCH

3 / 3

DOCKER

2 / 2

$ sikker summary 91.196.152.30

91.196.152.30 has a threat confidence score of 57%. This IP address from France (AS213412, ONYPHE SAS) has been observed in 51 honeypot sessions targeting SIP, SSH, HTTPS, IMAP, FTP and 6 other protocols. First observed on January 20, 2026, most recently active March 20, 2026.

$ sikker behaviors 91.196.152.30catalog →

lowFtp Control Channel Protocol Anomaly1x

FTP session where an empty control-channel command is observed in conjunction with non-printable binary data on the control channel. This pattern reflects malformed or non-FTP-compliant input, commonly seen during TLS handshake attempts on plaintext endpoints, protocol confusion, or automated scanner misfires.

infoHttp Bad Request Route Probe2x

Identifies HTTP GET requests directly targeting the /bad-request path, indicating automated or manual probing of application error-handling routes rather than legitimate navigation flow.

$ sikker primitives 91.196.152.30

smtp_ehlo_greeting6 ftp_control_channel_binary_payload4 empty_ftp_command3 elastic_http_get_request3 http_method_get2 docker_get_method2 http_path_bad_request2 elastic_http_favicon_path_probe2 elastic_root_path_probe1

$ sikker related 91.196.152.30

🇫🇷·More threats fromFrance→AS·More threats fromONYPHE SAS→SIP·More threats targetingSIP→SSH·More threats targetingSSH→HTTP·More threats targetingHTTPS→IMAP·More threats targetingIMAP→FTP·More threats targetingFTP→SMTP·More threats targetingSMTP→HTTP·More threats targetingHTTP→POST·More threats targetingPOSTGRES→TR06·More threats targetingTR069→ELAS·More threats targetingELASTICSEARCH→DOCK·More threats targetingDOCKER→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
91.231.89.184	75%	88
91.231.89.41	72%	94
91.230.168.154	50%	23
195.184.76.208	72%	81
195.184.76.209	74%	78

IP Address	Confidence	Events
51.91.168.102	99%	621,916
54.38.41.116	87%	22,372
51.83.143.139	90%	70,108
163.172.50.79	30%	24
212.83.137.223	65%	18