This IP address has been reported a total of
25
times from
22 distinct
sources.
16.16.27.149 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 5
reports;
Belarus
with 4
reports;
United States of America
with 4
reports.
The most common categories in these recent reports were:
SSH
24
times;
Brute-Force
21
times;
Port Scan
7
times;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Active SSH brute-force detected. Logs: 2026-10-25T06:14:19.925499+00:00 SUPPORTBOT sshd-session[3740 ...
show moreActive SSH brute-force detected. Logs: 2026-10-25T06:14:19.925499+00:00 SUPPORTBOT sshd-session[3740520]: Failed password for root from 16.16.27.149 port 38584 ssh2 2026-10-25T06:14:21.218416+00:00 SUPPORTBOT sshd-session[3740523]: pam_unix(sshd:auth):...
show less
Blocked by firewall: 7 unsolicited inbound connection attempts within 24 hours to ports 22. Automate ...
show moreBlocked by firewall: 7 unsolicited inbound connection attempts within 24 hours to ports 22. Automated report from a home network.
show less
Single SSH login attempt using root/ubuntu from SSH-2.0-Go. After login, attacker uploaded a file na ...
show moreSingle SSH login attempt using root/ubuntu from SSH-2.0-Go. After login, attacker uploaded a file named ./.1695609918500997275/sshd and executed it with chmod +x ./.1695609918500997275/sshd;nohup ./.1695609918500997275/sshd &. This shows malware deployment and immediate background persistence via nohup. No other commands, downloads, port forwards, lateral movement, or additional credentials were observed.
show less
2026-10-25T04:15:13.271265+02:00 groves sshd-session[3016598]: Failed password for root from 16.16.2 ...
show more2026-10-25T04:15:13.271265+02:00 groves sshd-session[3016598]: Failed password for root from 16.16.27.149 port 59878 ssh2
2026-10-25T04:15:13.519123+02:00 groves sshd-session[3016649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=16.16.27.149 user=root
2026-10-25T04:15:15.268333+02:00 groves sshd-session[3016649]: Failed password for root from 16.16.27.149 port 60266 ssh2
...
show less
2026-10-25T03:32:26.782170docker008 sshd[2713151]: Invalid user user from 16.16.27.149 port 57226
20 ...
show more2026-10-25T03:32:26.782170docker008 sshd[2713151]: Invalid user user from 16.16.27.149 port 57226
2026-10-25T03:32:26.927712docker008 sshd[2713153]: Invalid user user from 16.16.27.149 port 57228
2026-10-25T03:32:27.065817docker008 sshd[2713155]: Invalid user user from 16.16.27.149 port 57230
...
show less
2026-10-25T03:03:48.712573whm12.palvelukanava.fi sshd[629933]: Failed password for root from 16.16.2 ...
show more2026-10-25T03:03:48.712573whm12.palvelukanava.fi sshd[629933]: Failed password for root from 16.16.27.149 port 51822 ssh2
2026-10-25T03:03:50.229703whm12.palvelukanava.fi sshd[629937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=16.16.27.149 user=root
2026-10-25T03:03:52.076967whm12.palvelukanava.fi sshd[629937]: Failed password for root from 16.16.27.149 port 51834 ssh2
...
show less
Brute-Force
SSH
Anonymous
Network service scanning detected by FortiGate; source quarantined.
Port Scan
Anonymous
Blocked by firewall on hugin [22/tcp] | Rule: UFW | SPT: 56030 | TTL: 122 | LEN: 60 | TOS: 0x00 • Re ...
show moreBlocked by firewall on hugin [22/tcp] | Rule: UFW | SPT: 56030 | TTL: 122 | LEN: 60 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
2026-10-24T22:05:14.532968+02:00 server1 sshd-session[1090475]: User root from 16.16.27.149 not allo ...
show more2026-10-24T22:05:14.532968+02:00 server1 sshd-session[1090475]: User root from 16.16.27.149 not allowed because not listed in AllowUsers
2026-10-24T22:05:14.711892+02:00 server1 sshd-session[1090477]: User root from 16.16.27.149 not allowed because not listed in AllowUsers
2026-10-24T22:05:15.916674+02:00 server1 sshd-session[1090480]: User root from 16.16.27.149 not allowed because not listed in AllowUsers
...
show less
