Log in to view charts and search reports for this IP.
Log In
Reports Activity
Example preview
Report Categories (Last 60 Days)
Example preview
Top Reporter Countries (Last 60 Days)
Example preview
Account required for the enhanced features
Log inSign up
IP Abuse Reports for 103.2.225.225
This IP address has been reported a total of
217
times from
142 distinct
sources.
103.2.225.225 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 120
reports;
Germany
with 26
reports;
United Kingdom of Great Britain and Northern Ireland
with 17
reports.
The most common categories in these recent reports were:
Brute-Force
178
times;
SSH
170
times;
Port Scan
47
times;
Hacking
25
times;
Exploited Host
5
times;
Other
9
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
TCP portscan or auth bruteforce on ports: ms-wbt-server ssh :
Firewall: Within 2026-09-29 21:37:16 - ...
show moreTCP portscan or auth bruteforce on ports: ms-wbt-server ssh :
Firewall: Within 2026-09-29 21:37:16 - 2026-09-30 13:56:05 CEST(+0200) identified: unallowed access from 103.2.225.225/32 on uncommon port/s: 22(ssh),3389(ms-wbt-server) (2 trials)
Fail2ban: Within 2026-09-29 21:37:16 - 2026-09-30 13:56:05 CEST(+0200) banned: 8 times by fail2ban[firewall]; 8 times by fail2ban[recidive]
show less
Unwanted traffic detected by honeypot on September 30, 2026: port scans (5 port 22 scans), and brute ...
show moreUnwanted traffic detected by honeypot on September 30, 2026: port scans (5 port 22 scans), and brute force and hacking attacks (3 over ssh).
show less
Port Scan
Brute-Force
SSH
Anonymous
Repeated SSH brute force and user enumeration attempts against a secured server. Multiple failed aut ...
show moreRepeated SSH brute force and user enumeration attempts against a secured server. Multiple failed authentication attempts from this IP across an extended period.
show less
SSH brute force on port 22 -- 5 attempts, 1 successful. Credentials: root:Zaq!Wsx. Active: 2026-09-3 ...
show moreSSH brute force on port 22 -- 5 attempts, 1 successful. Credentials: root:Zaq!Wsx. Active: 2026-09-30T19:53 to 2026-09-30T21:55. Downloaded: http://5.189.149.171/f/b/m/.16_x86_64. Post-login: /usr/bin/gqtljatovd automount 3748799; /usr/bin/gqtljatovd [cpuhp/0] 3748799; /usr/bin/gqtljatovd [cryptd] 3748799. Malware: botnet (high); trojan (high); trojan (critical). Source: AS131423 Branch of Long Van System Solution JSC - Hanoi (Ho Chi Minh City, VN). Data from SSH honeypot — not a production system.
show less
Brute-Force
SSH
IoT Targeted
Anonymous
Sep 30 23:19:16 f2b auth.info sshd[137535]: Failed password for root from 103.2.225.225 port 51062 s ...
show moreSep 30 23:19:16 f2b auth.info sshd[137535]: Failed password for root from 103.2.225.225 port 51062 ssh2
Sep 30 23:19:30 f2b auth.info sshd[137537]: Failed password for root from 103.2.225.225 port 53210 ssh2
Sep 30 23:22:13 f2b auth.info sshd[137543]: Failed password for root from 103.2.225.225 port 50636 ssh2
...
show less
Single SSH session from SSH-2.0-Go using root/!qaz2Wsx. Activity was reconnaissance-focused: id, hos ...
show moreSingle SSH session from SSH-2.0-Go using root/!qaz2Wsx. Activity was reconnaissance-focused: id, hostname, env, history, cpu/version checks, ip addr show, and reads of /etc/passwd and /etc/shadow. The client wrote /tmp/test_1790809421, indicating filesystem write access and basic validation of shell control. No downloads, no additional tools, no persistence, no port forwarding, no lateral movement, and no artifacts or malware files were observed in this session.
show less
2026-09-30T21:49:32.835732+00:00 ubuntu sshd[1114674]: Failed password for root from 103.2.225.225 p ...
show more2026-09-30T21:49:32.835732+00:00 ubuntu sshd[1114674]: Failed password for root from 103.2.225.225 port 33282 ssh2
2026-09-30T23:01:36.825277+00:00 ubuntu sshd[1114889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.2.225.225 user=root
2026-09-30T23:01:38.560657+00:00 ubuntu sshd[1114889]: Failed password for root from 103.2.225.225 port 39708 ssh2
...
show less
2026-09-30T22:59:36.187534+00:00 instance-20241019-1127 sshd[3918936]: Connection closed by authenti ...
show more2026-09-30T22:59:36.187534+00:00 instance-20241019-1127 sshd[3918936]: Connection closed by authenticating user root 103.2.225.225 port 33786 [preauth]
...
show less
[bas-9] SSH abuse from 103.2.225.225: 3 x crowdsecurity/ssh-time-based-bf matched by the behaviour e ...
show more[bas-9] SSH abuse from 103.2.225.225: 3 x crowdsecurity/ssh-time-based-bf matched by the behaviour engine (automated sensor)
show less
