JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 49.228.239.106

49.228.239.106 was found in our database!

This IP was reported 471 times. Confidence of Abuse is 2%: ?

ISP	AIS Fibre
Usage Type	Fixed Line ISP
ASN	AS133481
Hostname(s)	49-228-239-0.24.nat.tls1a-cgn02.myaisfibre.com
Domain Name	ais.th
Country	🇹🇭 Thailand
City	Chiang Mai, Chiang Mai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 49.228.239.106

Whois 49.228.239.106

IP Abuse Reports for 49.228.239.106:

This IP address has been reported a total of 471 times from 298 distinct sources. 49.228.239.106 was first reported on June 20th 2023, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-06-26 05:53:22 (1 week ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 ecs.ge	2026-04-20 23:32:03 (2 months ago)	Automatic Fail2Ban report from jail ssh: multiple matching events detected.	Brute-Force SSH
🇩🇪 ecs.ge	2026-04-16 22:52:34 (2 months ago)	Automatic Fail2Ban report from jail ssh: multiple matching events detected.	Brute-Force SSH
🇨🇳 ThreatBook.io	2026-04-16 00:46:47 (2 months ago)	ThreatBook Intelligence: Zombie,Mobile more details on https://threatbook.io/ip/49.228.239.106	SSH
🇹🇷 sh97	2026-04-15 19:46:13 (2 months ago)	tr01: SSH Brute Force from 49.228.239.106 at 2026-04-16 01:16:13 IST	Brute-Force SSH
🇹🇷 sh97	2026-04-15 07:29:18 (2 months ago)	tr01: SSH Brute Force from 49.228.239.106 at 2026-04-15 12:59:17 IST	Brute-Force SSH
🇩🇪 nicosqc	2026-04-14 21:14:55 (2 months ago)	Invalid user testuser from 49.228.239.106 port 42874	Brute-Force SSH
🇩🇪 nicosqc	2026-04-14 21:14:55 (2 months ago)	Invalid user testuser from 49.228.239.106 port 42874	Brute-Force SSH
🇩🇪 nicosqc	2026-04-14 21:14:55 (2 months ago)	Invalid user testuser from 49.228.239.106 port 42874	Brute-Force SSH
🇩🇪 ipcop.net	2026-04-14 20:41:02 (2 months ago)	2026-04-14T22:36:25.523198+02:00 guestgw-router01.remscheid.de sshd-session[4185267]: Invalid user m ... show more 2026-04-14T22:36:25.523198+02:00 guestgw-router01.remscheid.de sshd-session[4185267]: Invalid user mohamed from 49.228.239.106 port 57498 2026-04-14T22:36:25.751360+02:00 guestgw-router01.remscheid.de sshd-session[4185267]: Disconnected from invalid user mohamed 49.228.239.106 port 57498 [preauth] 2026-04-14T22:39:48.501983+02:00 guestgw-router01.remscheid.de sshd-session[4185818]: Invalid user ubuntu from 49.228.239.106 port 38992 2026-04-14T22:39:48.739153+02:00 guestgw-router01.remscheid.de sshd-session[4185818]: Disconnected from invalid user ubuntu 49.228.239.106 port 38992 [preauth] 2026-04-14T22:41:02.260058+02:00 guestgw-router01.remscheid.de sshd-session[4186032]: Invalid user user from 49.228.239.106 port 39466 show less	Brute-Force
🇺🇸 bigscoots.com	2026-04-14 20:39:31 (2 months ago)	(sshd) Failed SSH login from 49.228.239.106 (TH/Thailand/49-228-239-0.24.nat.tls1a-cgn02.myaisfibre. ... show more (sshd) Failed SSH login from 49.228.239.106 (TH/Thailand/49-228-239-0.24.nat.tls1a-cgn02.myaisfibre.com): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Apr 14 15:37:26 17443 sshd[24609]: Invalid user mohamed from 49.228.239.106 port 49156 Apr 14 15:37:28 17443 sshd[24609]: Failed password for invalid user mohamed from 49.228.239.106 port 49156 ssh2 Apr 14 15:38:33 17443 sshd[24690]: Invalid user vpn from 49.228.239.106 port 44224 Apr 14 15:38:35 17443 sshd[24690]: Failed password for invalid user vpn from 49.228.239.106 port 44224 ssh2 Apr 14 15:39:19 17443 sshd[24775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.228.239.106 user=root show less	Brute-Force SSH
🇺🇸 Skynet	2026-04-14 20:03:14 (2 months ago)	SSH login attempts with user root.	Brute-Force
🇭🇰 mutebot.net	2026-04-14 20:02:20 (2 months ago)	2026-04-15T04:00:24.435145+08:00 dh sshd[2486711]: Disconnected from authenticating user root 49.228 ... show more 2026-04-15T04:00:24.435145+08:00 dh sshd[2486711]: Disconnected from authenticating user root 49.228.239.106 port 48588 [preauth] 2026-04-15T04:01:36.644764+08:00 dh sshd[2486764]: Disconnected from authenticating user root 49.228.239.106 port 48874 [preauth] 2026-04-15T04:02:09.271450+08:00 dh sshd[2486829]: Invalid user bot from 49.228.239.106 port 60262 2026-04-15T04:02:09.370395+08:00 dh sshd[2486829]: Disconnected from invalid user bot 49.228.239.106 port 60262 [preauth] 2026-04-15T04:02:19.538044+08:00 dh sshd[2486850]: Disconnected from authenticating user root 49.228.239.106 port 56378 [preauth] show less	Brute-Force SSH
🇩🇪 killmself	2026-04-14 19:59:39 (2 months ago)	Caught by Fail2Ban	Brute-Force SSH
🇺🇸 bigscoots.com	2026-04-14 19:38:58 (2 months ago)	49.228.239.106 (TH/Thailand/49-228-239-0.24.nat.tls1a-cgn02.myaisfibre.com), 5 distributed sshd atta ... show more 49.228.239.106 (TH/Thailand/49-228-239-0.24.nat.tls1a-cgn02.myaisfibre.com), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Apr 14 14:38:41 15292 sshd[8149]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.228.239.106 user=root Apr 14 14:37:17 15292 sshd[7995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.228.239.106 user=root Apr 14 14:37:18 15292 sshd[7995]: Failed password for root from 49.228.239.106 port 48570 ssh2 Apr 14 14:37:55 15292 sshd[8003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.19.243.145 user=root Apr 14 14:37:57 15292 sshd[8003]: Failed password for root from 162.19.243.145 port 52394 ssh2 IP Addresses Blocked: show less	Brute-Force SSH

Showing 1 to 15 of 471 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 198.52.177.150

🇭🇰 152.32.239.90

🇻🇳 103.53.231.159

🇺🇸 45.92.229.23

🇧🇷 205.210.31.192

🇺🇦 194.44.140.187

🇸🇬 157.230.40.249

🇨🇳 121.41.31.208

🇫🇷 91.231.89.231

🇫🇷 91.231.89.79

🇨🇦 85.217.149.68

🇺🇸 54.226.29.111

🇺🇸 48.214.144.191

🇷🇺 45.155.146.33

🇮🇪 3.249.174.212

🇸🇬 2406:da18:a1e:c10e:7e94::b

🇹🇷 94.154.43.73

🇺🇸 91.230.168.135

🇯🇵 90.149.169.23

🇧🇷 45.157.156.222