This IP address has been reported a total of
122
times from
105 distinct
sources.
101.96.214.116 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 24
reports;
United States of America
with 22
reports;
France
with 12
reports.
The most common categories in these recent reports were:
SSH
110
times;
Brute-Force
100
times;
Port Scan
12
times;
Hacking
7
times;
Exploited Host
1
time;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 12 15:05:20 f2b auth.info sshd[1407366]: Invalid user fabio from 101.96.214.116 port 43208
Oct 1 ...
show moreOct 12 15:05:20 f2b auth.info sshd[1407366]: Invalid user fabio from 101.96.214.116 port 43208
Oct 12 15:05:20 f2b auth.info sshd[1407366]: Failed password for invalid user fabio from 101.96.214.116 port 43208 ssh2
Oct 12 15:05:20 f2b auth.info sshd[1407366]: Disconnected from invalid user fabio 101.96.214.116 port 43208 [preauth]
...
show less
Honeypot [honeypot-ca-sensor1]: Brute-force attack detected on 22/SSH
• Credential used: ariel:12345 ...
show moreHoneypot [honeypot-ca-sensor1]: Brute-force attack detected on 22/SSH
• Credential used: ariel:123456
• Number of login attempts: 1
• Client: SSH-2.0-libssh_0.11.1
show less
3 SSH sessions from libssh_0.11.1 used brute-force logins: 345gs5662d34/345gs5662d34, uap/3245gs5662 ...
show more3 SSH sessions from libssh_0.11.1 used brute-force logins: 345gs5662d34/345gs5662d34, uap/3245gs5662d34, and uap/uap. After login, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx to wipe and recreate the SSH directory and begin planting an SSH public key. A second command attempted to remove file protections with chattr -ia .ssh and lockr -ia .ssh. No downloads, dropped files, persistence beyond these SSH-key setup attempts, lateral movement, or exfiltration were observed.
show less
(sshd) Failed SSH login from 101.96.214.116 (CN/China/-): 1 in the last 3600 secs; Ports: *; Directi ...
show more(sshd) Failed SSH login from 101.96.214.116 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 12 15:01:20 sshd[1326053]: Invalid user [USERNAME] from 101.96.214.116 port 59242
show less
Automated honeypot observation: SSH brute-force / credential-stuffing. Failed logins: 1, successful: ...
show moreAutomated honeypot observation: SSH brute-force / credential-stuffing. Failed logins: 1, successful: 0, commands: 0, file transfers: 0. Seen on 1 sensor(s) (eu1) over 2026-10-12..2026-10-12. Reported by an SSH honeypot network; no production service involved.
show less
Oct 11 23:55:16 f2b auth.info sshd[1249738]: Invalid user firewall2 from 101.96.214.116 port 33910
O ...
show moreOct 11 23:55:16 f2b auth.info sshd[1249738]: Invalid user firewall2 from 101.96.214.116 port 33910
Oct 11 23:55:16 f2b auth.info sshd[1249738]: Failed password for invalid user firewall2 from 101.96.214.116 port 33910 ssh2
Oct 11 23:55:16 f2b auth.info sshd[1249738]: Disconnected from invalid user firewall2 101.96.214.116 port 33910 [preauth]
...
show less
