Check an IP Address, Domain Name, Subnet, or ASN

94.132.24.206 was found in our database!

$ whois 94.132.24.206

country·🇵🇹 Portugal

city·Amora

isp·Nos Comunicacoes, S.A.

asn·AS2860

network·Standard

$ sikker risk 94.132.24.206scoring →

confidence

59%Medium

first_seen·Mar 25, 2026

last_seen·3d ago

sessions·1

events·1

$ sikker protocols 94.132.24.206

SSH

1 / 1

$ sikker summary 94.132.24.206

94.132.24.206 has a threat confidence score of 59%. This IP address from Portugal (AS2860, Nos Comunicacoes, S.A.) has been observed in 1 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh routeros cloud probe and telegram sms artifact discovery. First observed on March 25, 2026, most recently active March 25, 2026.

$ sikker behaviors 94.132.24.206catalog →

highSsh Routeros Cloud Probe And Telegram Sms Artifact Discovery1x

SSH post-auth sequence running RouterOS cloud/DDNS commands, Telegram data path checks, GSM/SMS artifact searches, and miner process lookups (`ps | grep miner`), preceded by basic system enumeration.

$ sikker primitives 94.132.24.206

ssh_routeros_ip_cloud_print_probe2 ssh_uname_all1 ssh_cat_proc_cpuinfo1 ssh_ps_ef_grep_miner_bracket_case1 ssh_ifconfig_interface_enumeration1 ssh_routeros_user_set_password_id01 ssh_echo_hi_pipe_cat_numbering_test1 ssh_locate_telegram_tdata_identifier1 ssh_routeros_interface_lte_print_probe1 ssh_routeros_ip_cloud_set_ddns_enabled1 ssh_ps_pipe_grep_miner_case_insensitive1 ssh_ls_telegram_tdata_and_gsm_sms_artifacts1

$ sikker related 94.132.24.206

🇵🇹·More threats fromPortugal→AS·More threats fromNos Comunicacoes, S.A.→SSH·More threats targetingSSH→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
79.169.195.199	59%	1
109.51.24.5	73%	4
89.152.179.132	98%	45
79.168.139.28	100%	638
85.139.113.172	25%	4

IP Address	Confidence	Events
45.156.128.14	53%	23
45.156.128.15	54%	24
109.105.210.78	84%	1,479
109.105.210.77	76%	2,498
109.105.210.79	72%	1,322