This IP address has been reported a total of
517
times from
410 distinct
sources.
116.99.173.91 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated SSH credential spraying activity observed by OSINT Intelligence SOC against the sentinel01 ...
show moreAutomated SSH credential spraying activity observed by OSINT Intelligence SOC against the sentinel01 Cowrie SSH honeypot.
The source IP successfully authenticated multiple times using commonly abused default and weak credential pairs including:
user:user
ubnt:ubnt
config:config
root:root123
guest:guest
test:test
The repeated use of multiple credential combinations across separate sessions is consistent with automated credential-spraying activity targeting exposed SSH services, network appliances, embedded Linux systems, routers, and IoT devices.
No legitimate administrative activity was observed. At the time of reporting, no post-authentication commands or payload delivery activity had been recorded.
Captured and documented by OSINT Intelligence SOC through the sentinel01 monitoring sensor.
Case Reference: OI-2026-0002
Classification: SSH Credential Spraying
Confidence: High
show less
2026-06-18T12:31:11.491596-04:00 oinkvps sshd[345584]: Invalid user kim from 116.99.173.91 port 3572 ...
show more2026-06-18T12:31:11.491596-04:00 oinkvps sshd[345584]: Invalid user kim from 116.99.173.91 port 35726
2026-06-18T12:31:12.425228-04:00 oinkvps sshd[345584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.99.173.91
2026-06-18T12:31:13.740479-04:00 oinkvps sshd[345584]: Failed password for invalid user kim from 116.99.173.91 port 35726 ssh2
2026-06-18T12:31:12.425228-04:00 oinkvps sshd[345584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.99.173.91
2026-06-18T12:31:13.740479-04:00 oinkvps sshd[345584]: Failed password for invalid user kim from 116.99.173.91 port 35726 ssh2
...
show less
Jun 18 12:22:56 vps-1 sshd-session[281915]: Invalid user btf from 116.99.173.91 port 42838
Jun 18 12 ...
show moreJun 18 12:22:56 vps-1 sshd-session[281915]: Invalid user btf from 116.99.173.91 port 42838
Jun 18 12:24:32 vps-1 sshd-session[282024]: Invalid user guest1 from 116.99.173.91 port 53496
...
show less
Active SSH brute-force detected. Logs: Jun 18 16:22:09 dev sshd[276832]: Failed password for invalid ...
show moreActive SSH brute-force detected. Logs: Jun 18 16:22:09 dev sshd[276832]: Failed password for invalid user admin from 116.99.173.91 port 47472 ssh2 Jun 18 16:22:31 dev sshd[276830]: Invalid user test from 116.99.173.91 port 41854 Jun 18 16:22:42 dev ssh...
show less
2026-06-18T12:15:29.949907-04:00 awesomesheep48 sshd-session[817652]: Invalid user admin from 116.99 ...
show more2026-06-18T12:15:29.949907-04:00 awesomesheep48 sshd-session[817652]: Invalid user admin from 116.99.173.91 port 33138
2026-06-18T12:15:39.980759-04:00 awesomesheep48 sshd-session[817655]: Invalid user nikita from 116.99.173.91 port 42802
2026-06-18T12:16:55.751310-04:00 awesomesheep48 sshd-session[817675]: Invalid user ftpuser from 116.99.173.91 port 40776
2026-06-18T12:17:06.839537-04:00 awesomesheep48 sshd-session[817688]: Invalid user username from 116.99.173.91 port 49194
2026-06-18T12:20:27.733061-04:00 awesomesheep48 sshd-session[817745]: Invalid user rebecca from 116.99.173.91 port 49608
...
show less
Jun 18 09:18:42 ismay sshd[2229143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eui ...
show moreJun 18 09:18:42 ismay sshd[2229143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.99.173.91 user=root
Jun 18 09:18:44 ismay sshd[2229143]: Failed password for root from 116.99.173.91 port 56728 ssh2
Jun 18 09:18:54 ismay sshd[2229151]: Invalid user username from 116.99.173.91 port 36256
Jun 18 09:18:56 ismay sshd[2229151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.99.173.91
Jun 18 09:18:59 ismay sshd[2229151]: Failed password for invalid user username from 116.99.173.91 port 36256 ssh2
...
show less
2026-06-18T16:16:24.041884+00:00 vm-wordpress sshd[755021]: Invalid user nikita from 116.99.173.91 p ...
show more2026-06-18T16:16:24.041884+00:00 vm-wordpress sshd[755021]: Invalid user nikita from 116.99.173.91 port 33710
2026-06-18T16:16:45.020535+00:00 vm-wordpress sshd[755111]: Invalid user admin from 116.99.173.91 port 54596
2026-06-18T16:16:45.020535+00:00 vm-wordpress sshd[755111]: Invalid user admin from 116.99.173.91 port 54596
2026-06-18T16:18:57.248950+00:00 vm-wordpress sshd[755225]: Invalid user username from 116.99.173.91 port 44648
...
show less