Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Nov 8 01:41:03 docker2 sshd[1091781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3
Nov 8 01:41:05 docker2 sshd[1091781]: Failed password for invalid user term1 from 103.94.131.3 port 57262 ss ...
show moreNov 8 01:41:03 docker2 sshd[1091781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3
Nov 8 01:41:05 docker2 sshd[1091781]: Failed password for invalid user term1 from 103.94.131.3 port 57262 ssh2
Nov 8 01:44:52 docker2 sshd[1092048]: Invalid user magma from 103.94.131.3 port 47056
...
show less
Nov 8 01:18:45 docker2 sshd[1090165]: Failed password for invalid user temp from 103.94.131.3 port 56222 ssh2
Nov 8 01:22:31 docker2 sshd[1090428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3 ...
show moreNov 8 01:18:45 docker2 sshd[1090165]: Failed password for invalid user temp from 103.94.131.3 port 56222 ssh2
Nov 8 01:22:31 docker2 sshd[1090428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3 user=root
Nov 8 01:22:32 docker2 sshd[1090428]: Failed password for root from 103.94.131.3 port 58994 ssh2
...
show less
Nov 8 00:59:53 docker2 sshd[1087008]: Invalid user builder from 103.94.131.3 port 49886
Nov 8 00:59:53 docker2 sshd[1087008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3
Nov 8 00:59:56 dock ...
show moreNov 8 00:59:53 docker2 sshd[1087008]: Invalid user builder from 103.94.131.3 port 49886
Nov 8 00:59:53 docker2 sshd[1087008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3
Nov 8 00:59:56 docker2 sshd[1087008]: Failed password for invalid user builder from 103.94.131.3 port 49886 ssh2
...
show less
6 SSH sessions from SSH-2.0-libssh_0.9.6 in 25s. Tried postgres/123456, postgres/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQA ...
show more6 SSH sessions from SSH-2.0-libssh_0.9.6 in 25s. Tried postgres/123456, postgres/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. After access, ran cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx to overwrite the SSH authorized-keys area, then cd ~; chattr -ia .ssh; lockr -ia .ssh to remove immutable/append-only protections on .ssh. Observed activity focused on SSH credential abuse and persistence setup via unauthorized key installation and attribute tampering. No downloads, lateral movement, or dropped artifacts observed.
show less
Nov 5 23:53:00 ChazTelPlex sshd[280556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3
Nov 5 23:53:02 ChazTelPlex sshd[280556]: Failed password for invalid user gsk from 103.94.131.3 port 5399 ...
show moreNov 5 23:53:00 ChazTelPlex sshd[280556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.131.3
Nov 5 23:53:02 ChazTelPlex sshd[280556]: Failed password for invalid user gsk from 103.94.131.3 port 53994 ssh2
...
show less
