JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

161.97.100.71

Neutral Activity

Abuse Confidence Score

0% Low Risk

84 reports

49 reporters · latest 6 months ago

ISP: Contabo GmbH
Usage Type: Data Center/Web Hosting/Transit
ASN: AS51167
Hostname(s): vmi2681835.contaboserver.net
Domain Name: contabo.com
Country: 🇫🇷 France
City: Lauterbourg, Grand Est

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

161.97.100.71 has been reported 84 times. The most recent report is from 6 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

84 from 49 distinct reporters

First reported

February 4th 2026

Most recent report

6 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 BellFix	2026-04-27 17:54:38 UTC · (6 months ago)	Fail2ban reported 161.97.100.71 for sshd	SSH Brute-Force
🇹🇷 rtbh.com.tr	2026-02-08 20:11:27 UTC · (9 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇹🇷 rtbh.com.tr	2026-02-05 20:11:24 UTC · (9 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Anonymous	2026-02-05 00:07:00 UTC · (9 months ago)	eval-stdin.php	Hacking Brute-Force Web App Attack
🇺🇸 paulo.apoloni	2026-02-04 20:16:11 UTC · (9 months ago)	161.97.100.71 - - [04/Feb/2026:01:21:38 -0300] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 150 "-" "-" ...	Web App Attack
🇹🇷 rtbh.com.tr	2026-02-04 20:11:24 UTC · (9 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
Anonymous	2026-02-04 09:03:14 UTC · (9 months ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	Hacking Web App Attack
🇺🇸 MPL	2026-02-04 09:01:21 UTC · (9 months ago)	tcp/443 (4 or more attempts)	Port Scan
🇺🇸 bigscoots.com	2026-02-04 08:59:30 UTC · (9 months ago)	(sshd) Failed SSH login from 161.97.100.71 (DE/Germany/vmi2681835.contaboserver.net): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Feb 4 02:58:17 15022 sshd[17519]: Invalid user admin from 161.97.100.71 port 53946 Feb 4 ... show more (sshd) Failed SSH login from 161.97.100.71 (DE/Germany/vmi2681835.contaboserver.net): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Feb 4 02:58:17 15022 sshd[17519]: Invalid user admin from 161.97.100.71 port 53946 Feb 4 02:58:19 15022 sshd[17519]: Failed password for invalid user admin from 161.97.100.71 port 53946 ssh2 Feb 4 02:58:50 15022 sshd[17533]: Invalid user orangepi from 161.97.100.71 port 54386 Feb 4 02:58:52 15022 sshd[17533]: Failed password for invalid user orangepi from 161.97.100.71 port 54386 ssh2 Feb 4 02:59:22 15022 sshd[17600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.100.71 user=root show less	Brute-Force SSH
🇺🇸 thardie	2026-02-04 08:59:20 UTC · (9 months ago)	2026-02-04T00:51:04.755990-08:00 orcas sshd[23831]: Invalid user orangepi from 161.97.100.71 2026-02-04T00:54:41.491294-08:00 orcas sshd[33719]: Invalid user test from 161.97.100.71 2026-02-04T00:55:12.489847-08:00 orcas sshd[35461]: Invalid user use ... show more 2026-02-04T00:51:04.755990-08:00 orcas sshd[23831]: Invalid user orangepi from 161.97.100.71 2026-02-04T00:54:41.491294-08:00 orcas sshd[33719]: Invalid user test from 161.97.100.71 2026-02-04T00:55:12.489847-08:00 orcas sshd[35461]: Invalid user user from 161.97.100.71 2026-02-04T00:56:45.426993-08:00 orcas sshd[39669]: Invalid user cirros from 161.97.100.71 2026-02-04T00:59:20.336872-08:00 orcas sshd[47171]: Invalid user rpc from 161.97.100.71 ... show less	Brute-Force SSH
🇺🇸 Moby	2026-02-04 08:46:17 UTC · (9 months ago)	Wed Feb 04 02:46:15.902253 2026161.97.100.71 - - [04/Feb/2026:02:46:16 -0600] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 985 "-" "libredtail-http" "98.194.227.56" "98.194.227.56" Wed Feb 04 02:46: ... show more Wed Feb 04 02:46:15.902253 2026161.97.100.71 - - [04/Feb/2026:02:46:16 -0600] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 985 "-" "libredtail-http" "98.194.227.56" "98.194.227.56" Wed Feb 04 02:46:15.902253 2026161.97.100.71 - - [04/Feb/2026:02:46:16 -0600] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 985 "-" "libredtail-http" "98.194.227.56" "98.194.227.56" Wed Feb 04 02:46:15.902253 2026161.97.100.71 - - [04/Feb/2026:02:46:16 -0600] "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 985 "-" "libredtail-http" "98.194.227.56" "98.194.227.56" ... show less	Web App Attack
🇺🇸 bigscoots.com	2026-02-04 08:22:08 UTC · (9 months ago)	(sshd) Failed SSH login from 161.97.100.71 (DE/Germany/vmi2681835.contaboserver.net): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Feb 4 02:20:44 17532 sshd[20757]: Invalid user admin from 161.97.100.71 port 44722 Feb 4 ... show more (sshd) Failed SSH login from 161.97.100.71 (DE/Germany/vmi2681835.contaboserver.net): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Feb 4 02:20:44 17532 sshd[20757]: Invalid user admin from 161.97.100.71 port 44722 Feb 4 02:20:46 17532 sshd[20757]: Failed password for invalid user admin from 161.97.100.71 port 44722 ssh2 Feb 4 02:21:17 17532 sshd[20831]: Invalid user orangepi from 161.97.100.71 port 45080 Feb 4 02:21:18 17532 sshd[20831]: Failed password for invalid user orangepi from 161.97.100.71 port 45080 ssh2 Feb 4 02:21:49 17532 sshd[20837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.100.71 user=root show less	Brute-Force SSH
🇬🇧 chrisw	2026-02-04 08:22:01 UTC · (9 months ago)	2026-02-04T08:19:59.457009l03.customhost.org.uk proftpd[6976]: 0.0.0.0 (161.97.100.71[161.97.100.71]) - USER admin: no such user found from 161.97.100.71 [161.97.100.71] to ::ffff:176.126.240.161:2222 2026-02-04T08:20:29.613412l03.customhost.org.uk p ... show more 2026-02-04T08:19:59.457009l03.customhost.org.uk proftpd[6976]: 0.0.0.0 (161.97.100.71[161.97.100.71]) - USER admin: no such user found from 161.97.100.71 [161.97.100.71] to ::ffff:176.126.240.161:2222 2026-02-04T08:20:29.613412l03.customhost.org.uk proftpd[7074]: 0.0.0.0 (161.97.100.71[161.97.100.71]) - USER orangepi: no such user found from 161.97.100.71 [161.97.100.71] to ::ffff:176.126.240.161:2222 2026-02-04T08:20:59.782575l03.customhost.org.uk proftpd[7082]: 0.0.0.0 (161.97.100.71[161.97.100.71]) - USER root (Login failed): Incorrect password 2026-02-04T08:21:29.915918l03.customhost.org.uk proftpd[7405]: 0.0.0.0 (161.97.100.71[161.97.100.71]) - USER root (Login failed): Incorrect password 2026-02-04T08:22:00.354840l03.customhost.org.uk proftpd[7431]: 0.0.0.0 (161.97.100.71[161.97.100.71]) - USER root (Login failed): Incorrect password ... show less	FTP Brute-Force Brute-Force
🇩🇪 xserverx.ru	2026-02-04 08:14:52 UTC · (9 months ago)	[UFW SCAN!!!!] SRC=161.97.100.71 LEN=40 TOS=0x00 PREC=0x00 TTL=55 PROTO=TCP SPT=55569 DPT=2375 WINDOW=65535 RES=0x00 SYN URGP=0 ...	Port Scan
🇺🇸 TPI-Abuse	2026-02-04 08:13:18 UTC · (9 months ago)	(mod_security) mod_security (id:218420) triggered by 161.97.100.71 (vmi2681835.contaboserver.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 03:13:11.603974 2026] [security2:error] [pid 3638551:tid 3638551] ... show more (mod_security) mod_security (id:218420) triggered by 161.97.100.71 (vmi2681835.contaboserver.net): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 03:13:11.603974 2026] [security2:error] [pid 3638551:tid 3638551] [client 161.97.100.71:41292] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.69:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.69"] [uri "/hello.world"] [unique_id "aYL_l9oKrug5UlffAKwWQgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 84 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇱 2400:cb00:906:1000:9deb:3ef0:49e:eb73

🇺🇸 199.165.159.25

🇺🇸 158.94.187.24

🇧🇷 150.230.66.98

🇺🇸 147.182.194.60

🇺🇸 66.132.172.42

🇨🇳 47.97.103.223

🇺🇸 47.89.193.150

🇻🇪 38.183.114.60

🇺🇸 31.105.245.120

🇵🇱 2400:cb00:923:1000:c135:6afe:5855:19d7

🇺🇸 199.165.159.43

🇺🇸 198.23.52.200

🇳🇱 176.65.148.51

🇺🇸 165.65.142.181

🇮🇳 122.165.162.117

🇨🇳 116.179.33.199

🇳🇱 109.160.32.128

🇫🇷 91.196.152.62

🇺🇸 66.17.228.58