Check an IP Address, Domain Name, Subnet, or ASN

91.196.152.69 was found in our database!

$ whois 91.196.152.69

country·🇫🇷 France

city·Roubaix

isp·ONYPHE SAS

asn·AS213412

network·Standard

$ sikker risk 91.196.152.69scoring →

confidence

70%High

first_seen·Jan 21, 2026

last_seen·1h ago

sessions·45

events·57

$ sikker protocols 91.196.152.69

DOCKER

4 / 8

FTP

4 / 6

SSH

4 / 6

IMAP

5 / 6

SIP

4 / 4

RTSP

3 / 3

SMTP

2 / 3

MSSQL

3 / 3

TELNET

2 / 3

ELASTICSEARCH

3 / 3

SMB

1 / 2

HTTP

2 / 2

HTTPS

2 / 2

REDIS

2 / 2

POSTGRES

2 / 2

RDP

1 / 1

MONGODB

1 / 1

$ sikker summary 91.196.152.69

91.196.152.69 has a threat confidence score of 70%. This IP address from France (AS213412, ONYPHE SAS) has been observed in 45 honeypot sessions targeting DOCKER, FTP, SSH, IMAP, SIP and 12 other protocols. First observed on January 21, 2026, most recently active March 22, 2026.

$ sikker behaviors 91.196.152.69catalog →

lowRtsp Options Probe3x

Client sends RTSP OPTIONS requests to check supported methods and confirm that an RTSP service is exposed, then disconnects without attempting authentication or stream setup. This pattern is typically associated with automated reconnaissance or internet-wide scanning rather than active stream access.

infoHttp Root Path Request2x

Identifies HTTP requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration.

infoDocker Invalid Protocol Probe2x

Client repeatedly sends GET requests to the /bad-request Docker API endpoint, indicating malformed or incompatible traffic against the Docker daemon. This pattern is typically associated with generic internet scanning or tools attempting HTTP interaction without speaking the proper Docker API protocol.

infoFtp Tls Negotiation And Disconnect2x

FTP session where the client issues AUTH TLS to upgrade the connection to TLS and then terminates the session with QUIT without performing further commands. This reflects minimal interaction limited to encryption negotiation and immediate disconnect, commonly observed in capability testing or automated probing.

$ sikker primitives 91.196.152.69

docker_get_method8 docker_bad_request_uri4 elastic_http_get_request4 rtsp_options3 elastic_root_path_probe3 ftp_auth_tls2 http_method_get2 ftp_session_quit2 elastic_http_bad_request_path_probe1

$ sikker related 91.196.152.69

Report IP WHOIS Lookup →

IP Address	Confidence	Events
91.196.152.224	59%	91
91.196.152.244	59%	22
91.196.152.245	63%	29
91.196.152.155	75%	81
91.196.152.230	69%	72

IP Address	Confidence	Events
173.212.244.151	98%	10,270
54.38.41.116	87%	27,885
51.91.168.102	99%	635,126
51.83.143.139	90%	73,891
161.97.132.79	98%	63,540