91.207.248.75
Activity Trending Down
This IP hasn't received reports recently, which causes the score to decay.
- ISP
- SERVERNET INTERNET LIMITED
- Usage Type
- Data Center/Web Hosting/Transit
- ASN
- AS60439
- Domain Name
- server.net
- Country
- 🇳🇱 Netherlands
- City
- Amsterdam, North Holland
No reports in the last 60 days
91.207.248.75 has been reported 77 times. The most recent report is from .
The full history is preserved below and remains searchable. A 22% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.
Abuse Reports
Total reports
77 from
35 distinct
reporters
First reported
Most recent report
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇭🇰 sandra361 |
Port scan detected: 10 attempts across 1 port (3389). | Evidence: REAPER_TARPIT: IN=eth0 SRC=91.207.248.75 LEN=40 TOS=0x14 PREC=0x00 TTL=112 ID=26220 DF PROTO=TCP SPT=62745 DPT=3389 WINDOW=65392 RES=0x00 ACK FIN URGP=0
|
Port Scan | |
| 🇺🇸 drewf.ink |
[14:21] Connected to RDP honeypot
|
Brute-Force Hacking | |
| 🇳🇱 Tsumugi Kotobuki |
Port Scan on Honeypot | Ports: 3389/RDP | Proto: TCP(1) | Flags: all SYN | TTL: 244 | Len: 44B | Win: 1024(1) | F2B/ufw-honeypot@2026-09-13T14:08:35Z
|
Port Scan Hacking | |
| 🇺🇸 MPL |
tcp/3389 (54 or more attempts)
|
Port Scan | |
| 🇺🇸 NetVexor |
Attack source identified and submitted via NetVexor BGP Blackhole Network
|
Port Scan Hacking Brute-Force | |
| 🇧🇷 noconex |
Wazuh Alert | Rule ID: 100199 | Desc: Suricata: (ET SCAN Behavioral Unusually fast Terminal Server Traffic Potential Scan or Infection (Inbound)) detectado de 91.207.248.75
|
Port Scan Brute-Force SSH | |
| 🇺🇸 schematics.cc |
Blocked by on honeypot2 [3389/tcp] | SPT: 46240 | TTL: 240 | LEN: 40 | TOS: 0x00 • Reported by: abuse.terraforge.fun
|
Port Scan | |
| 🇳🇱 wlt-blocker |
Illegal port scans
|
Port Scan | |
| Anonymous |
3389/tcp (1 or more attempts)
|
Port Scan | |
| 🇺🇸 mibbsdevs |
(ric-sv) CoffeePot: Connection attempt detected on closed service bait ports (22/23/3306/3389/5432).
|
Port Scan | |
| 🇭🇰 sandra361 |
Port scan detected: 5 attempts across 1 port (3389). | Evidence: GHOST_SCAN: IN=eth0 SRC=91.207.248.75 LEN=52 TOS=0x14 PREC=0x00 TTL=112 ID=32520 DF PROTO=TCP SPT=52179 DPT=3389 WINDOW=64240 RES=0x00 SYN URGP=0
|
Port Scan | |
| 🇫🇷 thecocasio |
PortSentry honeypot: unsolicited TCP connection to closed decoy port 3389 (RDP) on a host running no such service. Automated port-scan detection at 2026-08-25T16:52:27Z.
|
Port Scan | |
| Anonymous |
|
Port Scan Brute-Force | |
| Anonymous |
3389/tcp (1 or more attempts)
|
Port Scan | |
| 🇫🇷 Entalpi.net |
Tried to hit sensible closed port commonly used in attacks
|
Port Scan Hacking |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown