Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: Düsseldorf

Region: North Rhine-Westphalia

Country: Germany

Internet Service Provider: unknown

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:
No discussion about this IP yet. Click above link to make one.
Comments on same subnet:
IP Type Details Datetime
161.97.129.80 attackspambots
161.97.129.80 (US/United States/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 20 02:12:48 jbs1 sshd[20964]: Failed password for root from 83.48.29.116 port 31191 ssh2
Sep 20 02:13:23 jbs1 sshd[21673]: Failed password for root from 51.38.188.101 port 50022 ssh2
Sep 20 02:12:01 jbs1 sshd[20535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.159.237.46  user=root
Sep 20 02:12:03 jbs1 sshd[20535]: Failed password for root from 115.159.237.46 port 52426 ssh2
Sep 20 02:13:15 jbs1 sshd[21549]: Failed password for root from 161.97.129.80 port 36352 ssh2

IP Addresses Blocked:

83.48.29.116 (ES/Spain/-)
51.38.188.101 (FR/France/-)
115.159.237.46 (CN/China/-)
2020-09-20 22:01:30
161.97.129.80 attack
Fail2Ban Ban Triggered
2020-09-20 13:55:03
161.97.129.80 attackspambots
20 attempts against mh-ssh on shade
2020-09-20 05:54:35
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 161.97.129.98
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 62128
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;161.97.129.98.			IN	A

;; AUTHORITY SECTION:
.			183	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2022061901 1800 900 604800 86400

;; Query time: 21 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Jun 20 15:51:31 CST 2022
;; MSG SIZE  rcvd: 106
Host info
98.129.97.161.in-addr.arpa domain name pointer vmi443099.contaboserver.net.
Nslookup info:
Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
98.129.97.161.in-addr.arpa	name = vmi443099.contaboserver.net.

Authoritative answers can be found from:
Related IP info:
Related comments:
IP Type Details Datetime
51.75.207.61 attack
Jul  4 13:08:47 MK-Soft-VM4 sshd\[3408\]: Invalid user myuser1 from 51.75.207.61 port 46934
Jul  4 13:08:47 MK-Soft-VM4 sshd\[3408\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.207.61
Jul  4 13:08:48 MK-Soft-VM4 sshd\[3408\]: Failed password for invalid user myuser1 from 51.75.207.61 port 46934 ssh2
...
2019-07-05 02:48:09
89.64.34.16 attack
2019-07-04 13:03:18 H=89-64-34-16.dynamic.chello.pl [89.64.34.16]:60615 I=[10.100.18.21]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=89.64.34.16)
2019-07-04 13:03:18 unexpected disconnection while reading SMTP command from 89-64-34-16.dynamic.chello.pl [89.64.34.16]:60615 I=[10.100.18.21]:25 (error: Connection reset by peer)
2019-07-04 14:55:12 H=89-64-34-16.dynamic.chello.pl [89.64.34.16]:3631 I=[10.100.18.21]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=89.64.34.16)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=89.64.34.16
2019-07-05 03:16:11
103.237.175.114 attack
@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-03 11:55:38,864 INFO [shellcode_manager] (103.237.175.114) no match, writing hexdump (fbb743a9708c9ba0dc5b9189eccfb467 :2109448) - MS17010 (EternalBlue)
2019-07-05 02:51:51
219.137.226.52 attackbots
Jul  4 15:30:28 atlassian sshd[20739]: Invalid user 123456 from 219.137.226.52 port 11019
2019-07-05 02:54:23
171.61.33.87 attackspam
2019-07-04 14:53:10 unexpected disconnection while reading SMTP command from ([171.61.33.87]) [171.61.33.87]:47749 I=[10.100.18.23]:25 (error: Connection reset by peer)
2019-07-04 14:53:48 unexpected disconnection while reading SMTP command from ([171.61.33.87]) [171.61.33.87]:9055 I=[10.100.18.23]:25 (error: Connection reset by peer)
2019-07-04 14:55:00 unexpected disconnection while reading SMTP command from ([171.61.33.87]) [171.61.33.87]:52174 I=[10.100.18.23]:25 (error: Connection reset by peer)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=171.61.33.87
2019-07-05 03:14:12
107.179.116.226 attackbotsspam
Feb 20 15:01:03 dillonfme sshd\[13060\]: Invalid user rock from 107.179.116.226 port 43848
Feb 20 15:01:03 dillonfme sshd\[13060\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.179.116.226
Feb 20 15:01:05 dillonfme sshd\[13060\]: Failed password for invalid user rock from 107.179.116.226 port 43848 ssh2
Feb 20 15:06:45 dillonfme sshd\[13312\]: Invalid user hadoop from 107.179.116.226 port 34940
Feb 20 15:06:45 dillonfme sshd\[13312\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.179.116.226
...
2019-07-05 03:15:37
45.55.224.158 attackspambots
familiengesundheitszentrum-fulda.de 45.55.224.158 \[04/Jul/2019:17:54:25 +0200\] "POST /wp-login.php HTTP/1.1" 200 5690 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
familiengesundheitszentrum-fulda.de 45.55.224.158 \[04/Jul/2019:17:54:26 +0200\] "POST /wp-login.php HTTP/1.1" 200 5685 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
2019-07-05 02:43:36
139.59.95.244 attackspam
Jul  4 21:29:44 server01 sshd\[29130\]: Invalid user info5 from 139.59.95.244
Jul  4 21:29:44 server01 sshd\[29130\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.95.244
Jul  4 21:29:46 server01 sshd\[29130\]: Failed password for invalid user info5 from 139.59.95.244 port 54316 ssh2
...
2019-07-05 03:08:38
13.57.203.30 attackspam
[03/Jul/2019:05:53:09 -0400] "GET / HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
2019-07-05 03:14:48
87.123.104.167 attack
2019-07-04 14:53:15 unexpected disconnection while reading SMTP command from i577b68a7.versanet.de [87.123.104.167]:24363 I=[10.100.18.25]:25 (error: Connection reset by peer)
2019-07-04 14:53:56 unexpected disconnection while reading SMTP command from i577b68a7.versanet.de [87.123.104.167]:16305 I=[10.100.18.25]:25 (error: Connection reset by peer)
2019-07-04 14:54:19 unexpected disconnection while reading SMTP command from i577b68a7.versanet.de [87.123.104.167]:57841 I=[10.100.18.25]:25 (error: Connection reset by peer)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=87.123.104.167
2019-07-05 03:03:04
140.246.124.56 attack
RDP brute force attack detected by fail2ban
2019-07-05 02:55:07
103.44.132.44 attackspambots
Jul  4 20:42:57 lnxmysql61 sshd[23667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.44.132.44
Jul  4 20:42:57 lnxmysql61 sshd[23667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.44.132.44
2019-07-05 03:13:13
89.248.162.168 attack
Scanning (more than 2 packets) random ports - tries to find possible vulnerable services
2019-07-05 03:20:42
154.116.120.148 attackspam
2019-07-04 14:44:18 H=([154.116.120.148]) [154.116.120.148]:12910 I=[10.100.18.23]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=154.116.120.148)
2019-07-04 14:44:18 unexpected disconnection while reading SMTP command from ([154.116.120.148]) [154.116.120.148]:12910 I=[10.100.18.23]:25 (error: Connection reset by peer)
2019-07-04 14:54:00 H=([154.116.120.148]) [154.116.120.148]:59242 I=[10.100.18.23]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=154.116.120.148)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=154.116.120.148
2019-07-05 02:46:05
222.186.42.149 attack
Jul  4 20:36:04 minden010 sshd[21156]: Failed password for root from 222.186.42.149 port 42437 ssh2
Jul  4 20:36:06 minden010 sshd[21156]: Failed password for root from 222.186.42.149 port 42437 ssh2
Jul  4 20:36:09 minden010 sshd[21156]: Failed password for root from 222.186.42.149 port 42437 ssh2
...
2019-07-05 02:42:45

Recently Reported IPs

36.95.73.141 137.226.2.58 137.226.1.116 223.206.66.210
82.200.80.118 137.226.1.76 178.34.180.120 43.225.54.207
137.226.3.11 137.226.3.24 185.191.34.200 47.99.133.26
83.137.158.7 5.167.65.95 5.167.64.189 181.204.44.235
137.226.3.16 124.122.1.54 114.107.248.203 137.226.1.187