This IP address has been reported a total of
18
times from
17 distinct
sources.
118.196.103.2 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 5
reports;
United States of America
with 3
reports;
Finland
with 2
reports.
The most common categories in these recent reports were:
SSH
17
times;
Brute-Force
17
times;
Port Scan
2
times;
Exploited Host
1
time;
IoT Targeted
1
time;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 26 20:53:15 mail sshd[30053]: Failed password for root from 118.196.103.2 port 47604 ssh2
Oct 26 ...
show moreOct 26 20:53:15 mail sshd[30053]: Failed password for root from 118.196.103.2 port 47604 ssh2
Oct 26 20:53:19 mail sshd[30058]: Failed password for root from 118.196.103.2 port 43508 ssh2
Oct 26 20:53:24 mail sshd[30061]: Failed password for root from 118.196.103.2 port 43510 ssh2
Oct 26 20:53:28 mail sshd[30064]: Failed password for root from 118.196.103.2 port 36598 ssh2
Oct 26 20:53:33 mail sshd[30066]: Failed password for root from 118.196.103.2 port 36614 ssh2
...
show less
SSH brute force on port 22 -- 2 attempts, 1 successful. Credentials: root:---fuck_you----. Active: 2 ...
show moreSSH brute force on port 22 -- 2 attempts, 1 successful. Credentials: root:---fuck_you----. Active: 2026-10-26T12:34 to 2026-10-26T12:34. Post-login: ausearch -i -k command --checkpoint /var/lib/honeypot/audit_; ausearch -i -m USER_LOGIN,USER_START --checkpoint /var/lib/h; /bin/sh -e /usr/lib/update-notifier/update-motd-reboot-requi. Malware: trojan (critical); botnet (high); miner (critical). Source: AS4811 China Telecom (Group) (Shanghai, CN). Data from SSH honeypot — not a production system.
show less
SSH tarpit on port 22: 1 connection(s) in the last 24h, held 1051 s in total, longest 1051 s. Unsoli ...
show moreSSH tarpit on port 22: 1 connection(s) in the last 24h, held 1051 s in total, longest 1051 s. Unsolicited SSH to a port with no SSH service: SSH client held by the tarpit (brute-force tool behavior). Automated endlessh tarpit report.
show less
SSH brute-force attempt detected from IP 118.196.103.2: 2026-10-26T08:46:39.277099+00:00 [redacted-h ...
show moreSSH brute-force attempt detected from IP 118.196.103.2: 2026-10-26T08:46:39.277099+00:00 [redacted-hostname] sshd[659804]: Failed password for invalid user root from 118.196.103.2 port 59832 ssh2 on 1793004406.
show less
Port Scan
Brute-Force
SSH
Anonymous
SSH brute force: repeated failed logins and invalid usernames. Reported by fail2ban.
Oct 26 07:51:30 QBDevServerMS2025 sshd[138471]: Failed password for root from 118.196.103.2 port 487 ...
show moreOct 26 07:51:30 QBDevServerMS2025 sshd[138471]: Failed password for root from 118.196.103.2 port 48742 ssh2
Oct 26 07:51:32 QBDevServerMS2025 sshd[138480]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.196.103.2 user=root
Oct 26 07:51:34 QBDevServerMS2025 sshd[138480]: Failed password for root from 118.196.103.2 port 48754 ssh2
Oct 26 07:51:37 QBDevServerMS2025 sshd[138500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.196.103.2 user=root
Oct 26 07:51:40 QBDevServerMS2025 sshd[138500]: Failed password for root from 118.196.103.2 port 37768 ssh2
Oct 26 07:51:42 QBDevServerMS2025 sshd[138514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.196.103.2 user=root
Oct 26 07:51:44 QBDevServerMS2025 sshd[138514]: Failed password for root from 118.196.103.2 port 37776 ssh2
...
show less
