JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

91.247.144.13

Neutral Activity

Abuse confidence score ?

0% Low Risk

12 reports

10 reporters · latest 1 month ago

ISP	Niddatal
Usage Type	Data Center/Web Hosting/Transit
ASN	AS25504
Hostname(s)	bjrnborn-1.vautronserver.de
Domain Name	botech-edv.de
Country	🇩🇪 Germany
City	Florstadt, Hesse

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 91.247.144.13

Export CSV

This IP address has been reported a total of 12 times from 10 distinct sources. 91.247.144.13 was first reported on May 30th 2023, and the most recent report was 1 month ago. In the last 60 days, the only reporter location was: Canada with 2 reports. The most common categories in these recent reports were: Brute-Force 2 times; SSH 2 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 Luhte	2026-08-09 17:57:15 (1 month ago)	Unauthorised SSH/Telnet login attempt with user "root" at 2026-08-09T17:57:15Z	Brute-Force SSH
🇨🇦 Luhte	2026-08-08 13:49:23 (1 month ago)	Unauthorised SSH/Telnet login attempt with user "root" at 2026-08-08T13:49:23Z	Brute-Force SSH
🇺🇸 SIGSEC	2026-08-01 23:17:15 (2 months ago)	Repeated unauthorized SSH access + malicious script deployment, seen on an SSH honeypot across 18 co ... show more Repeated unauthorized SSH access + malicious script deployment, seen on an SSH honeypot across 18 connections / 17 sessions, 2026-07-29 to 2026-08-01 UTC. Logs in as root (credential "tequiero", client "SSH-2.0-OpenSSH_9.6p1"), SCPs a Perl script to /var/tmp/clamav.pl -- masquerading as antivirus -- then runs and deletes it: scp -t /var/tmp/clamav.pl perl /var/tmp/clamav.pl 2>/dev/null; rm -rf /var/tmp/clamav.pl Script SHA-256 3e7f7cdc5b44a7a47be3043847b0efe51a6c37fca4b9c2770aa305c1ba3a5927. From the captured source it: unlink($0)s itself on start to frustrate forensics; searches the whole filesystem for credential-harvest files (vuln.txt, trueusers.txt, cracked.txt, sparte.txt, gasite.txt, su-goods.txt); copies findings to /var/tmp/quWhdys/; then DELETES the originals from the host. Destructive -- it removes data after copying it. Repeated 07-29, 07-30 (x3), 07-31, 08-01; ongoing. Automated honeypot report. No response required. show less	Hacking SSH
🇨🇭 ScanThe.Net	2026-07-23 22:02:14 (2 months ago)	ID: 5359538943 \| PORT: 2497 \| https://91-247-144-13.scanthe.net	Port Scan
🇫🇷 oonux.net	2023-09-17 02:48:40 (3 years ago)	RouterOS: Scanning detected TCP 91.247.144.13:35366 > x.x.x.x:22	Port Scan
🇬🇧 ASPAN	2023-09-16 21:38:15 (3 years ago)	Unsolicited connection attempt(s), port:22.	Port Scan
🇨🇿 lp	2023-09-15 05:42:50 (3 years ago)	SSH Brute force: 1 attempts were recorded from 91.247.144.13 2023-09-15T07:11:39+02:00 Invalid user ... show more SSH Brute force: 1 attempts were recorded from 91.247.144.13 2023-09-15T07:11:39+02:00 Invalid user NL5xUDpV2xRa from 91.247.144.13 port 36196 show less	Brute-Force SSH
🇺🇸 yvoictra	2023-09-14 07:45:26 (3 years ago)	Sep 14 09:45:26 lamvda sshd[2092390]: Invalid user NL5xUDpV2xRa from 91.247.144.13 port 53656 ...	Brute-Force SSH
Anonymous	2023-09-14 06:12:33 (3 years ago)	Scanning	Port Scan
🇫🇷 oonux.net	2023-09-13 02:47:58 (3 years ago)	RouterOS: Scanning detected TCP 91.247.144.13:40194 > x.x.x.x:22	Port Scan
🇭🇰 seadog007	2023-06-04 01:14:45 (3 years ago)	May 30 13:48:59 swarmbyte sshd[2090421]: Invalid user wqmarlduiqkmgs from 91.247.144.13 port 32962 J ... show more May 30 13:48:59 swarmbyte sshd[2090421]: Invalid user wqmarlduiqkmgs from 91.247.144.13 port 32962 Jun 4 01:14:45 swarmbyte sshd[3190081]: Invalid user wqmarlduiqkmgs from 91.247.144.13 port 44366 ... show less	Brute-Force SSH
🇩🇪 derLoosi	2023-05-30 17:18:50 (3 years ago)	HV1.1 Blocked by UFW	Port Scan

Showing 1 to 12 of 12 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 106.201.232.211

🇩🇪 217.60.196.126

🇺🇸 205.210.31.80

🇦🇷 181.174.128.200

🇺🇸 172.202.107.34

🇨🇦 152.236.14.117

🇸🇬 145.223.134.197

🇳🇱 109.160.32.105

🇷🇺 95.154.150.211

🇪🇸 81.43.2.24

🇺🇸 70.184.72.152

🇹🇭 49.0.67.45

🇺🇸 35.185.20.188

🇹🇷 31.145.131.202

🇺🇸 24.89.134.244

🇧🇬 5.188.206.30

🇷🇺 5.129.178.133

🇷🇴 2.57.121.112

🇺🇸 216.180.246.31

🇺🇸 216.25.89.119