Loading...

91.213.203.203 is in , Norway

91.213.203.203 is known for DDOS, firewall alert, form post hijacking, fraud, HTTP fraud, phishing, ping of death, port scanning.

The report has been created on Feb 22, 2017 15:54:35
The IP address 91.213.203.203 belongs to Underworld ISP in (, ), Norway (62 and 10). The hostname is proxyscanner.underworld.no.
Norway (Kingdom of Norway, NOR) is a High income: OECD country in Europe & Central Asia. The currency is Norwegian krone.
As of Feb 22, 2017 15:54:35 we have 24 complaint(s) about 91.213.203.203. Based on our records, the 91.213.203.203 has been involved in DDOS, firewall alert, form post hijacking, fraud, HTTP fraud, phishing, ping of death, port scanning, etc.

91.213.203.203

IP Address Country:  Norway (NO)
IP Address Region:
IP Address City:
IP Postal Code
IP Address Area Code0
IP Metro Code0
IP Address Latitude:62
IP Address Longitude:10
IP Address ISP: Underworld
Organisation:
IP Address Proxy:
IP Address Host:proxyscanner.underworld.no
Map is loading...

If 91.213.203.203 is causing you trouble (doing SPAM, brute-force, DOS attack, phishing, or other fraud), you can report the abuser right here!



We have 24 complaints about 91.213.203.203


Anonymous user from 23.31.187.83 in United States
>1 month agoWadirumyoga.com - in Fraud
"Please do click on this site. It is a dangerous site full of ID theft links and spamming porn. Do not click your identity may be stolen. Phishing links, too."

Anonymous user from 23.31.187.83 in United States
>2 months agoMuchphrases.com,Metalblaze.com, ASCATRURAL.COM, Alaskashorex.com - in Form Post Hijacking
"Really bad sites. All are connested to Yeaahh.com, imitrk.com and others which steal people's identities, put false headings trying to get innocent people to click on them via other name or product urls. Please blacklist them. "

Anonymous user from 23.31.187.83 in United States
>2 months agoBergonna.com and Yeaahh.com - in Phishing
"Bergonna.com uses Yeaahh.com and Imitrk.com to hide it's phishing and fraudulent cyber criminal operations. Please do not look at their so-called free videos. You can have more probleMs with ID theft. This are really dangerous sites. Do not click on them."

Anonymous user from 23.31.187.83 in United States
>2 months agoImitrk.com - in HTTP Fraud
"Please do not click on this site. It is a really dangerous site run by major cyber scam erst. Ithe also is a dummy site for Bergonna.com & Yeaahh.com. It also spams nameso on the internet and downloads vicious code to steal your identities. "

Anonymous user from 23.31.187.83 in United States
>2 months agoFraud and Id theft - in HTTP Fraud
"Please do not click on this site. It is a dummy site for Yeaahh.com & Bergonna.com. These sites will entice you to post free videos, but in actuality they will steal your personal information for nefarious purposes a cause grave harm to you. Please avoid."

Anonymous user from 23.31.187.83 in United States
>2 months agoFraud and Id theft - in HTTP Fraud
"This site steals the identities of many innocent people & is a dummy site for Bergonna.com & Imitrk.com. Do not click, you can get malware and your identity and personal info can be stolen."

Anonymous user from 213.206.219.201 in Netherlands
>6 months agoTries Proxy CONNECT - in Port Scanning
"According to logs, it tries to scan for open http proxies:

Aug 22 10:41:08 [my IP hidden] haproxy[776]: 91.213.203.203:53208 [22/Aug/2016:10:41:08.524] www www/<NOSRV> -1/-1/-1/-1/0 503 213 - - SC-- 6/6/0/0/0 0/0 "CONNECT 91.213.203.203:6667 HTTP/1.0""

Anonymous user from 78.23.221.99 in Belgium
>1 year agocontinuous ping out of nowhere - in Firewall Alert
"my apachelogs show repeadetly HTTP Connect coming in. he doesnt even care about an answer -- he just keeps reconnecting."

Anonymous user from 80.133.2.148 in Germany
>1 year agosyn flood to host from 91.213.203.203 - in Ping Of Death
""Subject. I don't know who or why, but I'm getting syn flood to host from the above IP address. It's really immature.""
>2 years agoEXPLOIT LOIC Low Orbit Ion Cannon Exploit 6 - in DDOS
"Continuous EXPLOIT LOIC Low Orbit Ion Cannon Exploit 6 attacks from 91.213.203.203

"

Anonymous user from 184.56.84.41 in United States
>2 years agoGetting port scanned - in Port Scanning
"Subject. I don't know who or why, but I'm getting port scanned from the above IP address. It's really immature."

Anonymous user from 98.238.236.61 in United States
>2 years agoDDOS for weeks - in DDOS
"http://gyazo.com/f043d3d3423a33848f27873847901d00
All the ports this person has been dosing, very annoying and has been continuing for several weeks continuously something must be done to this person."

Anonymous user from 213.238.85.11 in Poland
>2 years agoPort Scanning - in Port Scanning
"Log from my router:
Sat, 2014-08-09 19:59:38 - TCP Packet - Source:91.213.203.203 Destination:192.168.0.7 - [PORT SCAN]
Sun, 2014-08-10 22:01:21 - TCP Packet - Source:91.213.203.203 Destination:192.168.0.7 - [PORT SCAN]"

Anonymous user from 76.125.86.149 in United States
>2 years agoPort Scanning - in Port Scanning
"91.213.203.203 was scanning my ports without my permission!

A portscan was detected. Details about the event:

Time.............: 2014-07-13 00:57:26

Source IP address: 91.213.203.203 (proxyscanner.underworld.no)"

Anonymous user from 82.47.117.67 in United Kingdom
>2 years agoPort Scanning - in Port Scanning
"BitDefender has reported several port scans from this IP. (Filling out the 25 word requirement.. So how is life for everyone?)"

Anonymous user from 217.253.218.45 in Germany
>3 years ago91.213.203.203 - in Port Scanning
"Jan 25 13:46:45 user kernel: Intrusion -> IN=ppp_0_1_32_1 OUT= MAC= SRC=91.213.203.203 DST=217.253.218.45 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=38033 DF PROTO=TCP SPT=43480 DPT=8008 WINDOW=5840 RES=0x00 SYN URGP=0
..."

Anonymous user from 184.90.177.51 in United States
>3 years agoport scanning - in Port Scanning
"2013-11-20 20:20:40.00 [PORT SCAN]
2013-11-21 21:13:17.00 [PORT SCAN]
2013-11-23 00:31:01.00 [PORT SCAN]
2013-11-24 02:06:20.00 [PORT SCAN]
2013-11-29 15:58:25.00 [PORT SCAN]
2013-11-29 15:58:25.00 [PORT SCAN] TCP Packet - Source:91.213.203.203"

Anonymous user from 81.34.167.204 in Spain
>4 years ago91.213.203.203 - in Port Scanning
"This ip has been scannig my ports 4 days in a row, yet.

Some router log:

10/05/2012 01:56:13 ports scan TCP from 91.213.203.203:60283 to 81.xx.xxx.xx:1080 ATTACK

10/05/2012 01:56:13 ports scan TCP from 91.213.203.203:46202 to 81.xx.xxx.xx:9999 ATTACK

10/05/2012 01:56:13 ports scan TCP from 91.213.203.203:56183 to 81.xx.xxx.xx:8081 ATTACK

and so on up to 113 attacks...
"
>4 years ago91.213.203.203 - in Port Scanning
"Did a port scan attack. Read that it's IRC related. What's the deal? I love how this has to be 25 words or more. :-P"
>4 years agoAbuse - in DDOS
"Tried to ddos me ... and really I need 25 words ? like what the hell is that. There is something wrong with this world."

Anonymous user from 178.192.47.233 in Switzerland
>4 years ago91.213.203.203 - in Port Scanning
"Firewall has warned me, that 91.213.203.203 is portscanning my network, without being autorized for it. detected as portscanning, please stop!

why the hell do i need 25 words to complain an abuser??"

Anonymous user from 81.231.108.115 in Sweden
>4 years ago91.213.203.203 misbehaving - in Port Scanning
"Continuous Port scannings. Several a week. also involved in massive (25) attack from at least 25 different sources about a week ago. Please stop !!"

Anonymous user from 86.45.4.118 in Ireland
>4 years agoscanned ports - in Port Scanning
"Router warned me that
06/18/2012 03:32:05 ports scan TCP 91.213.203.203:4028 ATTACK

also scanned day before at 7 am.

I really do not see why I need to write 25 words the complaint is simple."

Anonymous user from 77.54.91.248 in Portugal
>4 years agoAbuse - in Firewall Alert
"fragment_out-of-order 9956
i have the report in my Intrusion Detection.

"IDS scan parser : tcp syn scan: 91.213.203.203 scanned at least 20 ports at xxx.xx.xxx.x (1 of 1) : 91.213.203.203 xx.xxx.xx.x 0060 TCP 58431->8008 [S.....] seq 1133890846 win 5840""

WHOIS for 91.213.203.203

[Querying whois.ripe.net]
[whois.ripe.net]
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '91.213.203.0 - 91.213.203.255'

inetnum: 91.213.203.0 - 91.213.203.255
netname: NO-UNDERWORLD-USN
descr: Underworld
remarks: Underworld services network, Norway
country: NO
org: ORG-UA154-RIPE
admin-c: UWNO-RIPE
tech-c: UWNO-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: AS50213-MNT
mnt-routes: AS50213-MNT
mnt-domains: AS50213-MNT
mnt-lower: RIPE-NCC-END-MNT
source: RIPE # Filtered

organisation: ORG-UA154-RIPE
org-name: Underworld
admin-c: AKAI-RIPE
admin-c: HRDY-RIPE
tech-c: AKAI-RIPE
tech-c: HRDY-RIPE
org-type: OTHER
address: Underworld Network Operations Center
PB 1275 Sluppen
NO-7462 Trondheim
Norway
mnt-ref: ITSJEFEN-LIR
mnt-by: ITSJEFEN-LIR
source: RIPE # Filtered

role: Underworld NOC Team
address: PB 1275 Sluppen
NO-7462 Trondheim
Norway
admin-c: AKAI-RIPE
admin-c: HRDY-RIPE
tech-c: AKAI-RIPE
tech-c: HRDY-RIPE
tech-c: DAWG-RIPE
tech-c: SWFT-RIPE
tech-c: QUAI-RIPE
tech-c: MAVI-RIPE
nic-hdl: UWNO-RIPE
mnt-by: AS50213-MNT
source: RIPE # Filtered

% Information related to '91.213.203.0/24AS50213'

route: 91.213.203.0/24
descr: AS-UWORLD-NO
origin: AS50213
mnt-by: AS50213-MNT
mnt-routes: AS50213-MNT
source: RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.9.7 (WHOIS2)

Other DDOS, Firewall Alert, Form Post Hijacking, Fraud, HTTP Fraud, Phishing, Ping Of Death, Port Scanning Complaints

1 days  ago United States209.126.111.22"Portscannig From 209.126.11.22"
2 days  ago China211.137.82.38"UDP port scanning to 1434 2/17/2017 9:37pm"
9 days  ago Venezuela186.93.226.192"Fraudulent credit card order"
9 days  ago Netherlands91.224.160.192"Network Treats attempt to connect"
11 days  ago United States52.172.176.103"du Pont - port scanning"
14 days  ago Netherlands91.224.160.192"Network Treats attempt to connect"
15 days  ago United States66.150.223.111"Constant port scanning"
17 days  ago United States52.86.12.124"Trying to connect to me"
19 days  ago Netherlands82.74.157.199"Name Defamation "
19 days  ago Netherlands91.224.160.154"Bergdorf-Group = Hackers"