JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 161.248.37.160

161.248.37.160

Recent Activity

777 reports found in our database

100% ▲ ▲ ▲ Critical

Abuse confidence score ?

ISP

Imegh Private Limited

Usage Type

Data Center/Web Hosting/Transit

ASN

AS153328

Domain Name

emegh.com

Country

🇮🇳 India

City

Delhi, Delhi

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 161.248.37.160:

This IP address has been reported a total of 777 times from 84 distinct sources. 161.248.37.160 was first reported on August 30th 2026, and the most recent report was 12 minutes ago. In the last 60 days, the top reporter locations were: United States of America with 759 reports; Korea (the Democratic People's Republic of) with 5 reports; Germany with 4 reports. The most common categories in these recent reports were: SSH 758 times; Brute-Force 708 times; Port Scan 70 times; Hacking 25 times; FTP Brute-Force 5 times; Other 9 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 psh-ack	2026-09-05 06:15:23 (12 minutes ago)	Automated SSH brute force via Go-based client (likely botnet). Creds attempted: root/@dmiN123, root/ ... show more Automated SSH brute force via Go-based client (likely botnet). Creds attempted: root/@dmiN123, root/admiN123! across 2 sessions. Post-auth recon: enumerated CPU model, kernel version, /proc filesystem, passwd/shadow, checked id, dumped env vars, reviewed shell history. Wrote timestamped test files to /tmp (test_1788588293, test_1788588695) indicating host detection/system probing. No malware dl, persistence, or lateral movement observed. Attack pattern consistent with automated scanning for vulnerable targets and fingerprinting prior to payload deployment. Go SSH client suggests organized infrastructure rather than script-kiddie activity. High confidence this IP is part of active botnet conducting credential stuffing against SSH services. show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-05 05:45:11 (42 minutes ago)	SSH brute-force (3 sessions, 14 min) w/ creds: root/1234567@A, root/AdmiN123, root/Admin123!. Post-a ... show more SSH brute-force (3 sessions, 14 min) w/ creds: root/1234567@A, root/AdmiN123, root/Admin123!. Post-access: 37 unique cmds across 105 invocations for recon. Enumerated /etc/passwd, /etc/shadow, /proc/cpuinfo, /proc/version. Tested /tmp write perms (test_1788586252, test_1788586660, test_1788587063). Dumped env vars, cmd history, hostname, network config (ip addr, ip route). Checked user accts (id, w, whoami), sudo privs, processes (ps aux), netstat, cron, SSH config, packages (apt list, dpkg), systemd, home dirs, logs (auth.log, syslog), file perms, mounts, shell access. No malware dl, lateral movement, persistence, or port fwd observed. Automated system profiling to map target characteristics, privilege level, exploitation surface pre-payload/persistence. show less	Brute-Force SSH
🇺🇸 chrisj	2026-09-05 05:40:54 (47 minutes ago)	2026-09-05T05:34:06.857050+00:00 aws.vandogh.org sshd-session[1694103]: Failed password for invalid ... show more 2026-09-05T05:34:06.857050+00:00 aws.vandogh.org sshd-session[1694103]: Failed password for invalid user root from 161.248.37.160 port 51604 ssh2 2026-09-05T05:40:51.283681+00:00 aws.vandogh.org sshd-session[1694219]: User root from 161.248.37.160 not allowed because not listed in AllowUsers 2026-09-05T05:40:51.593730+00:00 aws.vandogh.org sshd-session[1694219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T05:40:53.859443+00:00 aws.vandogh.org sshd-session[1694219]: Failed password for invalid user root from 161.248.37.160 port 46750 ssh2 ... show less	Brute-Force SSH
🇺🇸 decisionconcepts	2026-09-05 05:24:09 (1 hour ago)	2026-09-05T05:17:27.805191+00:00 racknerd-0410d2 sshd[105678]: pam_unix(sshd:auth): authentication f ... show more 2026-09-05T05:17:27.805191+00:00 racknerd-0410d2 sshd[105678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T05:17:30.139242+00:00 racknerd-0410d2 sshd[105678]: Failed password for root from 161.248.37.160 port 50912 ssh2 2026-09-05T05:24:05.988033+00:00 racknerd-0410d2 sshd[107180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T05:24:07.959733+00:00 racknerd-0410d2 sshd[107180]: Failed password for root from 161.248.37.160 port 51562 ssh2 ... show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-05 05:15:13 (1 hour ago)	Credential brute-force via Go SSH client using weak defaults: root/12345678@a, root/1234567@a. 2 ses ... show more Credential brute-force via Go SSH client using weak defaults: root/12345678@a, root/1234567@a. 2 sessions established in 8min window. Recon phase: 35 unique cmd executed targeting system enumeration (/proc/version, /proc/cpuinfo, /etc/passwd, /etc/shadow, env vars, cmd history, hostname, id, whoami, uptime, uname, df, ps, netstat, ifconfig, iptables, kernel modules, sudo/SSH daemon inspection). Temp test files created in /tmp (timestamps 1788584659, 1788585061) for write-access verification. No malware payloads dl'd, no persistence mechanisms installed, no reverse shells/lateral movement observed. Attack pattern consistent with automated recon tooling targeting Linux hosts w/ trivial credentials. System info gathering suggests follow-up payload delivery or privilege escalation attempts likely. show less	Brute-Force SSH
🇺🇸 Velocity50	2026-09-05 05:14:56 (1 hour ago)	Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2026-09-05T04:15:34Z and 2026-09- ... show more Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2026-09-05T04:15:34Z and 2026-09-05T05:14:55Z show less	Brute-Force SSH
🇺🇸 paradoxnetworks	2026-09-05 04:47:07 (1 hour ago)	2026-09-05T04:40:31.948055+00:00 edge-con-mia01.int.pdx.net.uk sshd[786158]: Failed password for roo ... show more 2026-09-05T04:40:31.948055+00:00 edge-con-mia01.int.pdx.net.uk sshd[786158]: Failed password for root from 161.248.37.160 port 35196 ssh2 2026-09-05T04:47:03.376962+00:00 edge-con-mia01.int.pdx.net.uk sshd[787160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T04:47:05.628111+00:00 edge-con-mia01.int.pdx.net.uk sshd[787160]: Failed password for root from 161.248.37.160 port 56658 ssh2 ... show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-05 04:45:09 (1 hour ago)	Brute-force SSH attack targeting root creds: A@1234567, a@12345678, a@123456789 over 14min using Go ... show more Brute-force SSH attack targeting root creds: A@1234567, a@12345678, a@123456789 over 14min using Go SSH client. Successful auth achieved. Post-compromise recon executed: extracted /etc/passwd, /etc/shadow, /proc/cpuinfo, /proc/version, env vars, cmd history, hostname. Created temp test files /tmp/test_1788582675, test_1788583077, test_1788583466. Additional enumeration: disk usage, network interfaces, processes, users/groups, sudo perms. 105 total cmd execs across 37 unique cmds. No malware dl, no persistence, no lateral movement, no port fwd. Systematic fingerprinting/profiling attack consistent w/ automated scanning tool. Weak password patterns exploited. show less	Brute-Force SSH
🇺🇸 chrisj	2026-09-05 04:27:54 (2 hours ago)	2026-09-05T04:21:16.667914+00:00 aws.vandogh.org sshd-session[1693237]: Failed password for invalid ... show more 2026-09-05T04:21:16.667914+00:00 aws.vandogh.org sshd-session[1693237]: Failed password for invalid user root from 161.248.37.160 port 42826 ssh2 2026-09-05T04:27:51.057305+00:00 aws.vandogh.org sshd-session[1693274]: User root from 161.248.37.160 not allowed because not listed in AllowUsers 2026-09-05T04:27:51.715798+00:00 aws.vandogh.org sshd-session[1693274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T04:27:53.533535+00:00 aws.vandogh.org sshd-session[1693274]: Failed password for invalid user root from 161.248.37.160 port 58022 ssh2 ... show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-05 04:15:03 (2 hours ago)	Two SSH sessions via Go-based client attempted weak creds (root/123ABCabc, root/123abcABC). Post-aut ... show more Two SSH sessions via Go-based client attempted weak creds (root/123ABCabc, root/123abcABC). Post-auth recon: queried /etc/passwd, /etc/shadow, CPU model, kernel version, executed hostname/id/env cmds, reviewed bash history. Created temp test files in /tmp (test_1788581103, test_1788581512) for write permission testing. 25+ unique cmds executed indicate systematic fingerprinting of target config, mapping capabilities for exploitation/payload deployment. No malware dl, lateral movement, or persistence observed. Pattern consistent with automated recon scanning or early-stage botnet probing using programmatic SSH client. Weak passwords suggest dict/brute-force capability. 8-min session duration indicates recon phase only—follow-up activity expected if creds remain valid. show less	Brute-Force SSH
🇺🇸 r	2026-09-05 04:05:54 (2 hours ago)	Sep 5 04:05:52 vpn sshd[4031942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid= ... show more Sep 5 04:05:52 vpn sshd[4031942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root Sep 5 04:05:53 vpn sshd[4031942]: Failed password for root from 161.248.37.160 port 36042 ssh2 ... show less	Brute-Force SSH
🇺🇸 decisionconcepts	2026-09-05 03:58:18 (2 hours ago)	2026-09-05T03:51:47.436098+00:00 racknerd-0410d2 sshd[85021]: pam_unix(sshd:auth): authentication fa ... show more 2026-09-05T03:51:47.436098+00:00 racknerd-0410d2 sshd[85021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T03:51:49.469676+00:00 racknerd-0410d2 sshd[85021]: Failed password for root from 161.248.37.160 port 41798 ssh2 2026-09-05T03:58:15.264635+00:00 racknerd-0410d2 sshd[86525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T03:58:17.232649+00:00 racknerd-0410d2 sshd[86525]: Failed password for root from 161.248.37.160 port 35640 ssh2 ... show less	Brute-Force SSH
🇺🇸 psh-ack	2026-09-05 03:44:54 (2 hours ago)	Reconnaissance via Go SSH client using weak creds root/123456@Ab and root/123456@ab across 2 session ... show more Reconnaissance via Go SSH client using weak creds root/123456@Ab and root/123456@ab across 2 sessions. Enumeration: /etc/passwd, /etc/shadow access attempts, CPU model, kernel version, env vars. Test files written to /tmp (test_1788579117, test_1788579518) showing write capability. Executed: whoami, id, hostname, history, uname -a, /proc/cpuinfo, pwd, ls variants, bash/sh, echo. Probed: crontab -l, cat /etc/passwd, getent passwd, sudo -l, ps aux, /var/log/auth.log, /var/log/secure, dmesg. No successful malware dl, lateral movement, persistence mechanisms (cron, SSH keys, reverse shells). Pattern consistent w/ automated scanning/botnet credential spray assessing system config and privilege level. Go SSH client indicates programmatic mass scanning tool. Recommend: block root SSH login, enforce strong passwords, monitor successful auth attempts w/ these creds. show less	Brute-Force SSH
🇺🇸 schematics.cc	2026-09-05 03:37:31 (2 hours ago)	Blocked by on honeypot2 [22/tcp] \| SPT: 41990 \| TTL: 52 \| LEN: 60 \| TOS: 0x00 • Reported by: abuse.t ... show more Blocked by on honeypot2 [22/tcp] \| SPT: 41990 \| TTL: 52 \| LEN: 60 \| TOS: 0x00 • Reported by: abuse.terraforge.fun show less	Port Scan SSH
🇺🇸 chrisj	2026-09-05 03:15:06 (3 hours ago)	2026-09-05T03:08:33.342135+00:00 aws.vandogh.org sshd-session[1692414]: Failed password for invalid ... show more 2026-09-05T03:08:33.342135+00:00 aws.vandogh.org sshd-session[1692414]: Failed password for invalid user root from 161.248.37.160 port 35076 ssh2 2026-09-05T03:15:02.329836+00:00 aws.vandogh.org sshd-session[1692525]: User root from 161.248.37.160 not allowed because not listed in AllowUsers 2026-09-05T03:15:03.103791+00:00 aws.vandogh.org sshd-session[1692525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.248.37.160 user=root 2026-09-05T03:15:05.662997+00:00 aws.vandogh.org sshd-session[1692525]: Failed password for invalid user root from 161.248.37.160 port 43626 ssh2 ... show less	Brute-Force SSH

Showing 1 to 15 of 777 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 200.81.189.172

🇺🇸 195.184.76.117

🇺🇸 195.184.76.16

🇳🇱 185.226.197.67

🇵🇱 149.13.96.133

🇸🇬 128.199.145.5

🇷🇴 92.118.39.50

🇦🇪 92.97.159.27

🇺🇸 87.56.23.71

🇸🇬 84.75.150.236

🇫🇷 77.239.124.130

🇺🇸 65.111.15.127

🇳🇱 45.148.10.125

🇬🇧 2a06:4880:8000::ad

🇺🇿 195.158.14.232

🇷🇴 193.46.255.86

🇨🇱 186.189.111.27

🇨🇳 180.212.92.208

🇸🇬 172.71.124.246

🇫🇷 91.231.89.121