IP address

Search at other sites:

.006103.164.172.40

Shodan(more info)

Passive DNS

IP blacklists

Echelon VNC login

103.164.172.40 was recently listed on the Echelon VNC login blacklist, but currently it is not.

Description: IPs detected by Echelon sensors (honeypots) as performing this activity: VNC remote desktop login attempt on port 5900/5901
Type of feed: primary (feed detail page)

Last checked at: 2026-09-26 09:45:00.263000
Was present on blacklist at: 2026-09-12 09:45, 2026-09-13 09:45, 2026-09-14 09:45, 2026-09-15 09:45, 2026-09-16 09:45, 2026-09-17 09:45, 2026-09-18 09:45, 2026-09-23 09:45, 2026-09-24 09:45, 2026-09-25 09:45, 2026-09-26 09:45

Threat categories

TL	Role	Category	Details
25	src	login	protocol: vnc

---

OTX pulses

[6aa7e7020cafdfa51526c783] 2026-09-14 12:22:26.517000 | VNC honeypot logs for 2026/09/14

Author name:	jnazario
Pulse modified:	2026-09-14 12:22:26.517000
Indicator created:	2026-09-14 12:22:27
Indicator role:	None
Indicator title:
Indicator expiration:	2026-10-14 12:00:00

[6aa3f62a4f4aa15ee2b4ec2f] 2026-09-11 12:38:02.397000 | VNC honeypot logs for 2026/09/11

Author name:	jnazario
Pulse modified:	2026-09-11 12:38:02.397000
Indicator created:	2026-09-11 12:38:03
Indicator role:	None
Indicator title:
Indicator expiration:	2026-10-11 12:00:00

Origin AS

AS138131 - IDNIC-NATANET-AS-ID IDNIC-NATANET-AS-ID

BGP Prefix

103.164.172.0/24

geo

Indonesia, Jakarta

🕑 Asia/Jakarta

hostname

(null)

Address block ('inetnum' or 'NetRange' in whois database)

103.164.172.0 - 103.164.173.255

last_activity

2026-09-15 05:42:39.570000

rep

0.006402875363847649

reserved_range

0

Shodan's InternetDB

Open ports: 22, 8443

Tags: –

CPEs: cpe:/a:openbsd:openssh:10.2p1, cpe:/o:canonical:ubuntu_linux

ts_added

2026-09-12 09:45:01.558000

ts_last_update

2026-10-02 09:45:11.540000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses