This IP address has been reported a total of
762
times from
330 distinct
sources.
101.96.202.48 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-05-07T16:46:18.987739+02:00 guestgw-router01.remscheid.de sshd-session[3486963]: Disconnected f ...
show more2026-05-07T16:46:18.987739+02:00 guestgw-router01.remscheid.de sshd-session[3486963]: Disconnected from authenticating user root 101.96.202.48 port 47080 [preauth]
2026-05-07T16:50:15.141619+02:00 guestgw-router01.remscheid.de sshd-session[3487541]: Disconnected from authenticating user root 101.96.202.48 port 59178 [preauth]
2026-05-07T16:51:07.286398+02:00 guestgw-router01.remscheid.de sshd-session[3487686]: Disconnected from authenticating user root 101.96.202.48 port 33806 [preauth]
2026-05-07T16:52:46.304302+02:00 guestgw-router01.remscheid.de sshd-session[3487925]: Connection closed by 101.96.202.48 port 40032 [preauth]
2026-05-07T16:54:42.454368+02:00 guestgw-router01.remscheid.de sshd-session[3488036]: Connection reset by 101.96.202.48 port 33264 [preauth]
show less
101.96.202.48 (CN/China/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Port ...
show more101.96.202.48 (CN/China/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: May 7 04:11:01 10854 sshd[31853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.96.202.48 user=root
May 7 04:11:03 10854 sshd[31853]: Failed password for root from 101.96.202.48 port 46808 ssh2
May 7 04:06:41 10854 sshd[31444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.145.246.44 user=root
May 7 04:06:43 10854 sshd[31444]: Failed password for root from 118.145.246.44 port 41140 ssh2
May 7 04:17:44 10854 sshd[32482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.145.246.44 user=root
IP Addresses Blocked:
show less
2026-05-07T00:06:06.878385-05:00 srvcarevalo sshd[1048]: pam_unix(sshd:auth): authentication failure ...
show more2026-05-07T00:06:06.878385-05:00 srvcarevalo sshd[1048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.96.202.48
2026-05-07T00:06:09.351348-05:00 srvcarevalo sshd[1048]: Failed password for invalid user erp from 101.96.202.48 port 42428 ssh2
2026-05-07T00:17:44.944660-05:00 srvcarevalo sshd[2264]: Invalid user username from 101.96.202.48 port 35366
...
show less
May 7 06:36:35 vps789833 sshd[795]: Failed password for root from 101.96.202.48 port 36414 ssh2
May ...
show moreMay 7 06:36:35 vps789833 sshd[795]: Failed password for root from 101.96.202.48 port 36414 ssh2
May 7 06:41:59 vps789833 sshd[872]: Failed password for root from 101.96.202.48 port 33372 ssh2
show less
Honeypot hit: Brute-force attack detected on 22/SSH
• Credential used: sysadmin:admin123
• Number of ...
show moreHoneypot hit: Brute-force attack detected on 22/SSH
• Credential used: sysadmin:admin123
• Number of login attempts: 1
• Client: SSH-2.0-libssh_0.12.0
show less
101.96.202.48 (CN/China/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Port ...
show more101.96.202.48 (CN/China/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: May 6 21:31:26 14048 sshd[29315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.96.202.48 user=root
May 6 21:27:31 14048 sshd[27723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.180.79.132 user=root
May 6 21:27:33 14048 sshd[27723]: Failed password for root from 158.180.79.132 port 58898 ssh2
May 6 21:20:08 14048 sshd[24009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.96.202.48 user=root
May 6 21:20:11 14048 sshd[24009]: Failed password for root from 101.96.202.48 port 45546 ssh2
IP Addresses Blocked:
show less
Brute-Force
SSH
Anonymous
May 7 04:19:14 sshd-session[10982]: User root from 101.96.202.48 not allowed because not listed in ...
show moreMay 7 04:19:14 sshd-session[10982]: User root from 101.96.202.48 not allowed because not listed in AllowUsers
May 7 04:19:15 sshd-session[10982]: Received disconnect from 101.96.202.48 port 44156:11: Bye Bye [preauth]
...
show less