Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-11-07T10:46:41.280856+01:00 milkyway sshd[2035015]: Invalid user alice from 120.48.11.149 port 47990
2026-11-07T10:46:41.283355+01:00 milkyway sshd[2035015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost ...
show more2026-11-07T10:46:41.280856+01:00 milkyway sshd[2035015]: Invalid user alice from 120.48.11.149 port 47990
2026-11-07T10:46:41.283355+01:00 milkyway sshd[2035015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.11.149
2026-11-07T10:46:42.837324+01:00 milkyway sshd[2035015]: Failed password for invalid user alice from 120.48.11.149 port 47990 ssh2
...
show less
2026-11-07T08:26:25.988413vm162835.hosted-by.qwins.co sshd[179889]: Invalid user lol from 120.48.11.149 port 37452
2026-11-07T08:26:25.990672vm162835.hosted-by.qwins.co sshd[179889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
show more2026-11-07T08:26:25.988413vm162835.hosted-by.qwins.co sshd[179889]: Invalid user lol from 120.48.11.149 port 37452
2026-11-07T08:26:25.990672vm162835.hosted-by.qwins.co sshd[179889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.11.149
2026-11-07T08:26:28.057753vm162835.hosted-by.qwins.co sshd[179889]: Failed password for invalid user lol from 120.48.11.149 port 37452 ssh2
...
show less
Nov 7 07:45:03 v22019038103785759 sshd\[20803\]: Invalid user azureuser from 120.48.11.149 port 48572
Nov 7 07:45:03 v22019038103785759 sshd\[20803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48 ...
show moreNov 7 07:45:03 v22019038103785759 sshd\[20803\]: Invalid user azureuser from 120.48.11.149 port 48572
Nov 7 07:45:03 v22019038103785759 sshd\[20803\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.11.149
Nov 7 07:45:05 v22019038103785759 sshd\[20803\]: Failed password for invalid user azureuser from 120.48.11.149 port 48572 ssh2
Nov 7 07:51:25 v22019038103785759 sshd\[21166\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.11.149 user=root
Nov 7 07:51:26 v22019038103785759 sshd\[21166\]: Failed password for root from 120.48.11.149 port 33844 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-11-07T06:12:52.004531+00:00 [masked] sshd-session[2105466]: Disconnected from authenticating user root 120.48.11.149 port 43106 [preauth]
2026-11-07T06:16:14.440801+00:00 [masked] sshd-session[2218469]: Invalid user deploy from 120.48.11.149 por ...
show more2026-11-07T06:12:52.004531+00:00 [masked] sshd-session[2105466]: Disconnected from authenticating user root 120.48.11.149 port 43106 [preauth]
2026-11-07T06:16:14.440801+00:00 [masked] sshd-session[2218469]: Invalid user deploy from 120.48.11.149 port 34318
2026-11-07T06:16:14.450282+00:00 [masked] sshd-session[2218469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.11.149
2026-11-07T06:16:16.899347+00:00 [masked] sshd-session[2218469]: Failed password for invalid user deploy from 120.48.11.149 port 34318 ssh2
2026-11-07T06:16:18.201559+00:00 [masked] sshd-session[2218469]: Disconnected from invalid user deploy 120.48.11.149 port 34318 [preauth]
...
show less
2026-11-07T06:15:25.727905+00:00 ubuntu sshd[1381453]: Invalid user deploy from 120.48.11.149 port 35360
2026-11-07T06:15:25.733072+00:00 ubuntu sshd[1381453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=12 ...
show more2026-11-07T06:15:25.727905+00:00 ubuntu sshd[1381453]: Invalid user deploy from 120.48.11.149 port 35360
2026-11-07T06:15:25.733072+00:00 ubuntu sshd[1381453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.11.149
2026-11-07T06:15:27.424971+00:00 ubuntu sshd[1381453]: Failed password for invalid user deploy from 120.48.11.149 port 35360 ssh2
...
show less
Nov 6 21:46:09 <server> sshd[2063422]: Invalid user super from 120.48.11.149 port 56982
Nov 6 21:49:18 <server> sshd[2063451]: Invalid user user from 120.48.11.149 port 36508
Nov 6 21:52:08 <server> sshd[2063479]: Invalid user temp from 120.48.11. ...
show moreNov 6 21:46:09 <server> sshd[2063422]: Invalid user super from 120.48.11.149 port 56982
Nov 6 21:49:18 <server> sshd[2063451]: Invalid user user from 120.48.11.149 port 36508
Nov 6 21:52:08 <server> sshd[2063479]: Invalid user temp from 120.48.11.149 port 37830
Nov 6 21:54:49 <server> sshd[2064005]: Invalid user webuser from 120.48.1
show less
2026-11-07T04:21:43.186106+00:00 edge-drt-atl01.int.pdx.net.uk sshd[3486771]: Invalid user ansible from 120.48.11.149 port 50498
2026-11-07T04:25:50.136880+00:00 edge-drt-atl01.int.pdx.net.uk sshd[3487258]: Invalid user dev from 120.48.11.149 port 49 ...
show more2026-11-07T04:21:43.186106+00:00 edge-drt-atl01.int.pdx.net.uk sshd[3486771]: Invalid user ansible from 120.48.11.149 port 50498
2026-11-07T04:25:50.136880+00:00 edge-drt-atl01.int.pdx.net.uk sshd[3487258]: Invalid user dev from 120.48.11.149 port 49162
2026-11-07T04:29:26.504890+00:00 edge-drt-atl01.int.pdx.net.uk sshd[3487664]: Invalid user sanket from 120.48.11.149 port 55320
...
show less
2026-11-07T03:57:48.695698+00:00 edge-gig-trf01.int.pdx.net.uk sshd[1107151]: Invalid user tech from 120.48.11.149 port 34722
2026-11-07T04:04:46.416464+00:00 edge-gig-trf01.int.pdx.net.uk sshd[1108358]: Invalid user dspace from 120.48.11.149 port 39 ...
show more2026-11-07T03:57:48.695698+00:00 edge-gig-trf01.int.pdx.net.uk sshd[1107151]: Invalid user tech from 120.48.11.149 port 34722
2026-11-07T04:04:46.416464+00:00 edge-gig-trf01.int.pdx.net.uk sshd[1108358]: Invalid user dspace from 120.48.11.149 port 39330
2026-11-07T04:06:14.626140+00:00 edge-gig-trf01.int.pdx.net.uk sshd[1108641]: Invalid user odoo from 120.48.11.149 port 59580
...
show less
SSH brute-force attack against bastion 187.85.177.19 (AlmaLinux 9.8). Multiple failed SSH authentication attempts detected on port 2202 within the last 24h. Source IP 120.48.11.149 attempted unauthorized access.
