Check an IP Address, Domain Name, Subnet, or ASN

91.231.89.5 was found in our database!

$ whois 91.231.89.5

country·🇫🇷 France

city·Gravelines

isp·ONYPHE SAS

asn·AS213412

network·Standard

$ sikker risk 91.231.89.5scoring →

confidence

69%High

first_seen·Jan 21, 2026

last_seen·1h ago

sessions·68

events·85

$ sikker protocols 91.231.89.5

SSH

16 / 22

SIP

10 / 12

HTTPS

7 / 11

IMAP

8 / 9

HTTP

4 / 7

SMB

4 / 4

ELASTICSEARCH

4 / 4

FTP

3 / 3

REDIS

3 / 3

DOCKER

3 / 3

POSTGRES

3 / 3

RTSP

1 / 2

RDP

1 / 1

SMTP

1 / 1

$ sikker summary 91.231.89.5

91.231.89.5 has a threat confidence score of 69%. This IP address from France (AS213412, ONYPHE SAS) has been observed in 68 honeypot sessions targeting SSH, SIP, HTTPS, IMAP, HTTP and 9 other protocols. First observed on January 21, 2026, most recently active March 25, 2026.

$ sikker behaviors 91.231.89.5catalog →

infoHttps Root Path Request2x

Identifies HTTPS requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration

infoFtp Tls Upgrade1x

FTP session where the client issues AUTH TLS to upgrade the connection to Transport Layer Security. This reflects protocol-level encryption negotiation prior to further interaction.

infoHttp Bad Request Route Probe1x

Identifies HTTP GET requests directly targeting the /bad-request path, indicating automated or manual probing of application error-handling routes rather than legitimate navigation flow.

infoDocker Invalid Protocol Probe1x

Client repeatedly sends GET requests to the /bad-request Docker API endpoint, indicating malformed or incompatible traffic against the Docker daemon. This pattern is typically associated with generic internet scanning or tools attempting HTTP interaction without speaking the proper Docker API protocol.

infoFtp Tls Negotiation And Disconnect1x

FTP session where the client issues AUTH TLS to upgrade the connection to TLS and then terminates the session with QUIT without performing further commands. This reflects minimal interaction limited to encryption negotiation and immediate disconnect, commonly observed in capability testing or automated probing.

$ sikker primitives 91.231.89.5

elastic_http_get_request4 docker_get_method3 ftp_auth_tls2 https_path_root2 elastic_http_favicon_path_probe2 http_method_get1 ftp_session_quit1 http_path_bad_request1 docker_bad_request_uri1 elastic_root_path_probe1 elastic_http_bad_request_path_probe1 redis_command_http_connection_close1

$ sikker related 91.231.89.5

Report IP WHOIS Lookup →

IP Address	Confidence	Events
91.196.152.81	68%	77
91.231.89.204	79%	112
91.196.152.57	77%	85
91.196.152.58	66%	89
91.196.152.83	56%	82

IP Address	Confidence	Events
54.38.41.116	87%	33,270
91.231.89.117	81%	63
91.231.89.201	85%	99
51.91.168.102	99%	654,234
162.159.122.180	8%	20