Check an IP Address, Domain Name, Subnet, or ASN

91.201.241.164 was found in our database!

$ whois 91.201.241.164

country·🇺🇦 Ukraine

city·Kropyvnytskyi

isp·ISP Shtorm LTD

asn·AS31725

network·Standard

$ sikker risk 91.201.241.164scoring →

confidence

94%Very High

first_seen·Feb 11, 2026

last_seen·7d ago

sessions·145

events·253

$ sikker protocols 91.201.241.164

SMB

145 / 253

$ sikker summary 91.201.241.164

91.201.241.164 has a threat confidence score of 94%. This IP address from Ukraine (AS31725, ISP Shtorm LTD) has been observed in 145 honeypot sessions targeting SMB protocols. Detected attack patterns include remcom remote execution. First observed on February 11, 2026, most recently active March 14, 2026.

$ sikker behaviors 91.201.241.164catalog →

highRemcom Remote Execution18x

Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.

$ sikker primitives 91.201.241.164

smb_empty_rpc_call18 smb_ipc_share_access18 smb_remcom_pipe_open18 smb_svcctl_pipe_open18

$ sikker related 91.201.241.164

🇺🇦·More threats fromUkraine→AS·More threats fromISP Shtorm LTD→SMB·More threats targetingSMB→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
188.190.92.235	35%	3
91.201.243.27	35%	3
195.62.15.42	31%	119
91.201.244.198	39%	4
91.201.244.177	44%	6

IP Address	Confidence	Events
45.12.1.19	88%	8,688
45.144.212.43	98%	277
95.214.232.18	88%	11,170
91.220.230.203	96%	70
91.232.238.112	89%	466