Total reports
10 from
7 distinct
reporters
First reported
November 9th 2026
Most recent report
6 hours ago
Last 60 days
Top reporter locations
🇫🇷
France
8
🇫🇮
Finland
1
🇵🇱
Poland
1
Most common categories
Port Scan
10
Hacking
1
Brute-Force
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇮
iamxorum
2026-11-13 05:33:56
UTC ·
(6 hours ago)
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-11-13T05:33:55.334040+00:00 XRM-00 kernel: [1105484.658221] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=1.171.104.194 DST=REDACTED LEN=52 TOS=0x00 PREC=0x00 TTL=111 ...
show more
Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-11-13T05:33:55.334040+00:00 XRM-00 kernel: [1105484.658221] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=1.171.104.194 DST=REDACTED LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=21392 DF PROTO=TCP SPT=61403 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
Kejult
2026-11-12 22:22:32
UTC ·
(13 hours ago)
Honeypot Finding: SMB activity on TCP/445; 5 Dionaea events.
Port Scan
2026-11-11 19:34:00
UTC ·
(1 day ago)
2026-11-11T21:33:59.329395+02:00 vps kernel: [10796387.492790] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=1.171.104.194 DST=54.37.14.118 LEN=52 TOS=0x00 PREC=0x00 TTL=102 ID=2436 DF PROTO=TCP SPT=52138 DPT=445 ...
show more
2026-11-11T21:33:59.329395+02:00 vps kernel: [10796387.492790] [PORTSCAN DETECTED] IN=ens3 OUT= MAC=fa:16:3e:66:f6:24:02:37:19:0d:c2:f3:08:00 SRC=1.171.104.194 DST=54.37.14.118 LEN=52 TOS=0x00 PREC=0x00 TTL=102 ID=2436 DF PROTO=TCP SPT=52138 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
Brute-Force
🇫🇷
JohnAtlas
2026-11-11 05:59:45
UTC ·
(2 days ago)
Honeypot: connection attempt to unused port(s) 445/tcp on a server where these services do not exist. Automated firewall trap.
Port Scan
Hacking
🇫🇷
sthoyer.de
2026-11-11 02:53:11
UTC ·
(2 days ago)
Nov 11 03:53:09 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=1.171.104.194 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=12447 DF PROTO=TCP SPT=56061 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ...
show more
Nov 11 03:53:09 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=1.171.104.194 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=12447 DF PROTO=TCP SPT=56061 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
sthoyer.de
2026-11-10 19:24:01
UTC ·
(2 days ago)
Nov 10 20:24:00 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=1.171.104.194 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=29530 DF PROTO=TCP SPT=51426 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ...
show more
Nov 10 20:24:00 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=1.171.104.194 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=29530 DF PROTO=TCP SPT=51426 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
Little Iguana
2026-11-10 19:22:51
UTC ·
(2 days ago)
trying to access non-authorized port
Port Scan
🇫🇷
sthoyer.de
2026-11-10 13:54:14
UTC ·
(2 days ago)
Nov 10 14:54:12 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=1.171.104.194 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=19119 DF PROTO=TCP SPT=61309 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ...
show more
Nov 10 14:54:12 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=1.171.104.194 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=114 ID=19119 DF PROTO=TCP SPT=61309 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇫🇷
Kejult
2026-11-10 12:40:44
UTC ·
(2 days ago)
Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.
Port Scan
🇵🇱
sefinek.net
2026-11-09 12:07:58
UTC ·
(4 days ago)
Honeypot hit: MSSQL traffic (on 1433) without login credentials
Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB
Port Scan
