Check an IP Address, Domain Name, Subnet, or ASN

94.50.161.152 was found in our database!

$ whois 94.50.161.152

country·🇷🇺 Russia

city·Perm

isp·Rostelecom

asn·AS12389

network·Standard

$ sikker risk 94.50.161.152scoring →

confidence

86%Very High

first_seen·Mar 18, 2026

last_seen·54m ago

sessions·22

events·22

$ sikker protocols 94.50.161.152

SMB

22 / 22

$ sikker summary 94.50.161.152

94.50.161.152 has a threat confidence score of 86%. This IP address from Russia (AS12389, Rostelecom) has been observed in 22 honeypot sessions targeting SMB protocols. Detected attack patterns include remcom remote execution. First observed on March 18, 2026, most recently active April 15, 2026.

$ sikker behaviors 94.50.161.152catalog →

highRemcom Remote Execution10x

Sequential SMB session opening IPC$, accessing the svcctl pipe, issuing an RPC call, then opening the RemCom_communicaton pipe. Indicates remote service-based command execution.

$ sikker primitives 94.50.161.152

smb_empty_rpc_call10 smb_ipc_share_access10 smb_remcom_pipe_open10 smb_svcctl_pipe_open10

$ sikker related 94.50.161.152

🇷🇺·More threats fromRussia→AS·More threats fromRostelecom→SMB·More threats targetingSMB→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
82.162.63.90	80%	52
2.63.211.145	78%	22,825
90.150.21.25	13%	18
89.109.22.192	28%	141
81.177.101.45	100%	1,040

IP Address	Confidence	Events
82.162.63.90	80%	50
45.130.189.236	22%	81
2.63.211.145	78%	22,825
77.94.120.206	100%	9,748
81.18.134.18	37%	297