This IP address has been reported a total of
48
times from
37 distinct
sources.
161.97.93.216 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
Jul 8 22:36:01 mail fail2ban.actions [582]: NOTICE [sshd] Ban 161.97.93.216
Jul 8 23:50:37 ...
show moreJul 8 22:36:01 mail fail2ban.actions [582]: NOTICE [sshd] Ban 161.97.93.216
Jul 8 23:50:37 mail fail2ban.actions [582]: NOTICE [sshd] Ban 161.97.93.216
Jul 9 01:56:14 mail fail2ban.actions [582]: NOTICE [sshd] Ban 161.97.93.216
show less
session[897771] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER xpertservers: no such us ...
show moresession[897771] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER xpertservers: no such user found from vmi3229712.contaboserver.net [161.97.93.216] to ::ffff:10.1.2.109:2222
session[905466] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER root (Login failed): Incorrect password
session[913619] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER xpertservers: no such user found from vmi3229712.contaboserver.net [161.97.93.216] to ::ffff:10.1.2.109:2222
session[922227] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER xpertservers: no such user found from vmi3229712.contaboserver.net [161.97.93.216] to ::ffff:10.1.2.109:2222
session[930206] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER xpertservers: no such user found from vmi3229712.contaboserver.net [161.97.93.216] to ::ffff:10.1.2.109:2222
session[938282] 0.0.0.0 (vmi3229712.contaboserver.net[161.97.93.216]): USER root (Login failed): Incorrect password
session[946329] 0.0.0.0 (vmi
...
show less
Jul 8 18:47:00 xiaohack sshd[77240]: User root from 161.97.93.216 not allowed because not listed in ...
show moreJul 8 18:47:00 xiaohack sshd[77240]: User root from 161.97.93.216 not allowed because not listed in AllowUsers
Jul 8 19:11:43 xiaohack sshd[77612]: User root from 161.97.93.216 not allowed because not listed in AllowUsers
...
show less
Brute-Force
SSH
Anonymous
Failed login attempt detected by Fail2Ban in ssh jail
Brute-Force
Anonymous
Jul 8 23:50:34 mail sshd[15329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
show moreJul 8 23:50:34 mail sshd[15329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.93.216
Jul 8 23:50:36 mail sshd[15329]: Failed password for invalid user mlnservices from 161.97.93.216 port 50124 ssh2
show less
Jul 8 16:42:13 xiaohack sshd[75508]: Invalid user ferrimadera from 161.97.93.216 port 49972
Jul 8 ...
show moreJul 8 16:42:13 xiaohack sshd[75508]: Invalid user ferrimadera from 161.97.93.216 port 49972
Jul 8 17:06:53 xiaohack sshd[75843]: User root from 161.97.93.216 not allowed because not listed in AllowUsers
Jul 8 17:32:01 xiaohack sshd[76186]: Invalid user ferrimadera from 161.97.93.216 port 36082
...
show less
Jul 8 16:45:05 login sshd[25804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid= ...
show moreJul 8 16:45:05 login sshd[25804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.93.216
Jul 8 16:45:07 login sshd[25804]: Failed password for invalid user susannaharald from 161.97.93.216 port 58934 ssh2
...
show less
Brute-Force
SSH
Anonymous
sshd
Brute-Force
SSH
Anonymous
2026-07-08T16:42:02.220068+02:00 mail.mordor.email sshd-session[710610]: Invalid user mordor from 16 ...
show more2026-07-08T16:42:02.220068+02:00 mail.mordor.email sshd-session[710610]: Invalid user mordor from 161.97.93.216 port 54172
2026-07-08T16:42:02.247001+02:00 mail.mordor.email sshd-session[710610]: Connection closed by invalid user mordor 161.97.93.216 port 54172 [preauth]
2026-07-08T17:06:42.509660+02:00 mail.mordor.email sshd-session[711038]: Connection closed by authenticating user root 161.97.93.216 port 42530 [preauth]
...
show less
161.97.93.216 (DE/Germany/vmi3229712.contaboserver.net), 5 distributed sshd attacks on account [root ...
show more161.97.93.216 (DE/Germany/vmi3229712.contaboserver.net), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jul 8 09:33:48 15054 sshd[11018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.140.147.181 user=root
Jul 8 09:33:50 15054 sshd[11018]: Failed password for root from 13.140.147.181 port 47824 ssh2
Jul 8 09:55:11 15054 sshd[22039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.93.216 user=root
Jul 8 09:55:13 15054 sshd[22039]: Failed password for root from 161.97.93.216 port 35292 ssh2
Jul 8 09:56:25 15054 sshd[22666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.139.165.143 user=root
IP Addresses Blocked:
13.140.147.181 (DE/Germany/vmi3355752.contaboserver.net)
show less
Brute-Force
SSH
Anonymous
2026-07-08T16:25:48.793955+02:00 vm635618.cloud.nuxt.network sshd-session[4003]: Failed password for ...
show more2026-07-08T16:25:48.793955+02:00 vm635618.cloud.nuxt.network sshd-session[4003]: Failed password for invalid user pacificconcepts from 161.97.93.216 port 50224 ssh2
2026-07-08T16:49:47.232966+02:00 vm635618.cloud.nuxt.network sshd-session[4039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.97.93.216 user=root
2026-07-08T16:49:49.209308+02:00 vm635618.cloud.nuxt.network sshd-session[4039]: Failed password for root from 161.97.93.216 port 47052 ssh2
...
show less
2026-07-08T14:45:32.156407+00:00 thot sshd[2731259]: Invalid user bernardbichon from 161.97.93.216 p ...
show more2026-07-08T14:45:32.156407+00:00 thot sshd[2731259]: Invalid user bernardbichon from 161.97.93.216 port 47986
2026-07-08T14:45:32.178729+00:00 thot sshd[2731259]: Connection closed by invalid user bernardbichon 161.97.93.216 port 47986 [preauth]
...
show less
Brute-Force
SSH
Anonymous
SSH BruteForce attack
SSH
Showing 1 to
15
of 48 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩