Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: unknown

Region: unknown

Country: Zimbabwe

Internet Service Provider: Telone Pvt Ltd

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:
Type Details Datetime
attackspambots
Lines containing failures of 197.221.254.2
Jul 13 16:57:36 mellenthin postfix/smtpd[5323]: connect from unknown[197.221.254.2]
Jul x@x
Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: lost connection after DATA from unknown[197.221.254.2]
Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: disconnect from unknown[197.221.254.2] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.2
2019-07-14 08:02:14
Comments on same subnet:
IP Type Details Datetime
197.221.254.22 attack
Port Scan detected!
...
2020-07-14 08:05:45
197.221.254.235 attack
Logged onto my email
2020-07-05 03:55:10
197.221.254.235 attackspam
"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:
2020-05-29 06:30:57
197.221.254.79 attack
Fail2Ban - HTTP Auth Bruteforce Attempt
2020-05-12 05:24:46
197.221.254.176 attackbotsspam
2019-03-12 20:37:49 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25129 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-03-12 20:38:40 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25137 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-03-12 20:39:11 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25138 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
...
2020-01-30 04:45:43
197.221.254.63 attack
Unauthorized connection attempt detected from IP address 197.221.254.63 to port 445
2019-12-11 21:32:25
197.221.254.96 attack
2019-11-20 14:13:49 H=(16.96.telone.co.zw) [197.221.254.96]:6050 I=[10.100.18.22]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.96)
2019-11-20 14:13:49 unexpected disconnection while reading SMTP command from (16.96.telone.co.zw) [197.221.254.96]:6050 I=[10.100.18.22]:25 (error: Connection reset by peer)
2019-11-20 15:33:34 H=(16.96.telone.co.zw) [197.221.254.96]:6523 I=[10.100.18.22]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.96)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.96
2019-11-21 00:42:21
197.221.254.6 attackspambots
2019-11-20 15:12:24 H=(16.6.telone.co.zw) [197.221.254.6]:31578 I=[10.100.18.25]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.6)
2019-11-20 15:12:25 unexpected disconnection while reading SMTP command from (16.6.telone.co.zw) [197.221.254.6]:31578 I=[10.100.18.25]:25 (error: Connection reset by peer)
2019-11-20 15:29:34 H=(16.6.telone.co.zw) [197.221.254.6]:31622 I=[10.100.18.25]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.6)

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.6
2019-11-20 22:54:01
197.221.254.40 attack
firewall-block, port(s): 1433/tcp
2019-11-20 00:40:13
197.221.254.172 attackspambots
Hello!

As you may have noticed, I sent you an email from your account.
This means that I have full access to your device.

I've been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.

If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.

I also have access to all your contacts and all your correspondence.

Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.

I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks...
2019-10-13 06:30:27
197.221.254.157 attack
Spam
2019-08-14 23:36:14
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 197.221.254.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18659
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;197.221.254.2.			IN	A

;; AUTHORITY SECTION:
.			2356	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071301 1800 900 604800 86400

;; Query time: 1 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Jul 14 08:02:07 CST 2019
;; MSG SIZE  rcvd: 117
Host info
2.254.221.197.in-addr.arpa domain name pointer 16.2.telone.co.zw.
Nslookup info:
Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
2.254.221.197.in-addr.arpa	name = 16.2.telone.co.zw.

Authoritative answers can be found from:

Related IP info:
Related comments:
IP Type Details Datetime
80.82.70.239 attackspambots
firewall-block, port(s): 3435/tcp, 3438/tcp, 3445/tcp, 3457/tcp, 3459/tcp
2020-03-01 22:41:05
114.35.150.230 attack
Honeypot attack, port: 81, PTR: 114-35-150-230.HINET-IP.hinet.net.
2020-03-01 23:18:53
142.93.130.58 attackbotsspam
Mar  1 04:31:05 wbs sshd\[16416\]: Invalid user ts from 142.93.130.58
Mar  1 04:31:05 wbs sshd\[16416\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.130.58
Mar  1 04:31:07 wbs sshd\[16416\]: Failed password for invalid user ts from 142.93.130.58 port 59294 ssh2
Mar  1 04:39:21 wbs sshd\[17123\]: Invalid user kafka from 142.93.130.58
Mar  1 04:39:21 wbs sshd\[17123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.130.58
2020-03-01 22:48:03
51.75.27.78 attackbots
Mar  1 16:29:13 lukav-desktop sshd\[8123\]: Invalid user steam from 51.75.27.78
Mar  1 16:29:13 lukav-desktop sshd\[8123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.27.78
Mar  1 16:29:16 lukav-desktop sshd\[8123\]: Failed password for invalid user steam from 51.75.27.78 port 40758 ssh2
Mar  1 16:35:43 lukav-desktop sshd\[8214\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.27.78  user=bin
Mar  1 16:35:45 lukav-desktop sshd\[8214\]: Failed password for bin from 51.75.27.78 port 35450 ssh2
2020-03-01 23:22:03
141.98.10.137 attackbotsspam
Rude login attack (76 tries in 1d)
2020-03-01 22:36:31
222.186.175.148 attackspambots
(sshd) Failed SSH login from 222.186.175.148 (CN/China/-): 5 in the last 3600 secs
2020-03-01 23:13:22
138.255.110.165 attackspambots
Honeypot attack, port: 445, PTR: PTR record not found
2020-03-01 22:47:21
103.40.226.168 attackbotsspam
Mar  1 04:52:32 our-server-hostname postfix/smtpd[14087]: connect from unknown[103.40.226.168]
Mar x@x
Mar  1 04:52:33 our-server-hostname postfix/smtpd[14087]: disconnect from unknown[103.40.226.168]
Mar  1 04:52:36 our-server-hostname postfix/smtpd[13397]: connect from unknown[103.40.226.168]
Mar x@x
Mar  1 04:52:37 our-server-hostname postfix/smtpd[13397]: disconnect from unknown[103.40.226.168]
Mar  1 04:53:13 our-server-hostname postfix/smtpd[14084]: connect from unknown[103.40.226.168]
Mar x@x
Mar  1 04:53:14 our-server-hostname postfix/smtpd[14084]: disconnect from unknown[103.40.226.168]
Mar  1 04:55:01 our-server-hostname postfix/smtpd[13397]: connect from unknown[103.40.226.168]
Mar x@x
Mar  1 04:55:02 our-server-hostname postfix/smtpd[13397]: disconnect from unknown[103.40.226.168]
Mar  1 04:57:16 our-server-hostname postfix/smtpd[13355]: connect from unknown[103.40.226.168]
Mar x@x
Mar  1 04:57:17 our-server-hostname postfix/smtpd[13355]: disconnect from unk........
-------------------------------
2020-03-01 22:44:18
94.158.41.208 attack
Unauthorised access (Mar  1) SRC=94.158.41.208 LEN=52 TTL=58 ID=25049 DF TCP DPT=1433 WINDOW=8192 SYN
2020-03-01 22:52:38
222.186.175.215 attack
Mar  1 14:33:15 localhost sshd[25350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.215  user=root
Mar  1 14:33:17 localhost sshd[25350]: Failed password for root from 222.186.175.215 port 42834 ssh2
Mar  1 14:33:21 localhost sshd[25350]: Failed password for root from 222.186.175.215 port 42834 ssh2
Mar  1 14:33:15 localhost sshd[25350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.215  user=root
Mar  1 14:33:17 localhost sshd[25350]: Failed password for root from 222.186.175.215 port 42834 ssh2
Mar  1 14:33:21 localhost sshd[25350]: Failed password for root from 222.186.175.215 port 42834 ssh2
Mar  1 14:33:15 localhost sshd[25350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.215  user=root
Mar  1 14:33:17 localhost sshd[25350]: Failed password for root from 222.186.175.215 port 42834 ssh2
Mar  1 14:33:21 localhost sshd[25
...
2020-03-01 22:50:35
40.114.44.8 attackbotsspam
Mar  1 22:08:07 webhost01 sshd[12831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.114.44.8
Mar  1 22:08:09 webhost01 sshd[12831]: Failed password for invalid user liucanbin from 40.114.44.8 port 35762 ssh2
...
2020-03-01 23:18:15
82.196.4.66 attackbotsspam
Mar  1 09:45:00 NPSTNNYC01T sshd[12334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.196.4.66
Mar  1 09:45:02 NPSTNNYC01T sshd[12334]: Failed password for invalid user alma from 82.196.4.66 port 58258 ssh2
Mar  1 09:48:27 NPSTNNYC01T sshd[12518]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.196.4.66
...
2020-03-01 23:19:30
222.186.31.83 attackbots
2020-03-01T15:39:07.347023scmdmz1 sshd[22960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
2020-03-01T15:39:08.813582scmdmz1 sshd[22960]: Failed password for root from 222.186.31.83 port 49377 ssh2
2020-03-01T15:39:12.353331scmdmz1 sshd[22960]: Failed password for root from 222.186.31.83 port 49377 ssh2
2020-03-01T15:39:07.347023scmdmz1 sshd[22960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
2020-03-01T15:39:08.813582scmdmz1 sshd[22960]: Failed password for root from 222.186.31.83 port 49377 ssh2
2020-03-01T15:39:12.353331scmdmz1 sshd[22960]: Failed password for root from 222.186.31.83 port 49377 ssh2
2020-03-01T15:39:07.347023scmdmz1 sshd[22960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.31.83  user=root
2020-03-01T15:39:08.813582scmdmz1 sshd[22960]: Failed password for root from 222.186.31.83 port 49377 ssh2
2020-03-0
2020-03-01 22:53:48
125.59.195.205 attackspambots
Honeypot attack, port: 5555, PTR: cm125-59-195-205.hkcable.com.hk.
2020-03-01 23:21:10
104.236.124.45 attackspambots
Mar  1 15:15:55 vps670341 sshd[674]: Invalid user rootalias from 104.236.124.45 port 56896
2020-03-01 22:52:17

Recently Reported IPs

109.75.37.9 117.69.30.138 105.112.50.72 170.82.22.45
78.190.215.155 60.178.47.102 178.63.53.43 5.153.187.232
45.118.188.44 49.148.216.113 85.202.56.87 187.101.236.171
190.38.165.84 190.3.130.107 180.252.31.122 37.32.41.168
61.19.40.38 88.114.86.83 187.8.168.57 134.209.169.72