JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.48.139.154

120.48.139.154 was found in our database!

This IP was reported 51 times. Confidence of Abuse is 100%: ?

100%

ISP	Beijing Baidu Netcom Science and Technology Co., Ltd.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS38365
Domain Name	baidu.com
Country	🇨🇳 China
City	Beijing, Beijing

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.48.139.154

Whois 120.48.139.154

IP Abuse Reports for 120.48.139.154:

This IP address has been reported a total of 51 times from 45 distinct sources. 120.48.139.154 was first reported on July 23rd 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 gbzret4d	2026-07-26 11:09:56 (1 hour ago)	Honeypot [uk-production01]: Empty payload (likely service probe); 2223 [1] TCP	Port Scan
🇧🇬 focusnic.com	2026-07-26 10:55:26 (1 hour ago)	Multiple SSH login attempts from 120.48.139.154 targeting user(s): root \| Server Managed by Focusnic	Brute-Force SSH
🇺🇸 m2jest1c	2026-07-26 10:35:18 (2 hours ago)	Jul 26 10:35:17 instance1 sshd[2141665]: Connection closed by authenticating user root 120.48.139.15 ... show more Jul 26 10:35:17 instance1 sshd[2141665]: Connection closed by authenticating user root 120.48.139.154 port 33084 [preauth] ... show less	Brute-Force SSH
🇪🇸 h3st4k3r	2026-07-26 09:51:20 (2 hours ago)	Malicious activity detected from this IP during SSH attempts. VPN: No, Datacenter: No, Organization: ... show more Malicious activity detected from this IP during SSH attempts. VPN: No, Datacenter: No, Organization: AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd., Region: Beijing, Log: 2026-07-26T11:51:19.215948 02:00 Administracion sshd[3215713]: Connection closed by authenticating user root 120.48.139.154 port 41046 [preauth], Abuse Score: 100, Total Reports: 46 show less	SSH
🇺🇸 MPL	2026-07-26 09:40:23 (2 hours ago)	tcp/22 (14 or more attempts)	Port Scan
🇺🇸 paradoxnetworks	2026-07-26 07:21:32 (5 hours ago)	2026-07-26T07:15:12.861024+00:00 edge-noc-mci01.int.pdx.net.uk sshd[2395533]: Invalid user user from ... show more 2026-07-26T07:15:12.861024+00:00 edge-noc-mci01.int.pdx.net.uk sshd[2395533]: Invalid user user from 120.48.139.154 port 45716 2026-07-26T07:19:23.249515+00:00 edge-noc-mci01.int.pdx.net.uk sshd[2396341]: Invalid user user from 120.48.139.154 port 49020 2026-07-26T07:21:31.909632+00:00 edge-noc-mci01.int.pdx.net.uk sshd[2396731]: Invalid user user from 120.48.139.154 port 47294 ... show less	Brute-Force SSH
🇺🇸 drewf.ink	2026-07-26 04:57:36 (7 hours ago)	[04:57] Attempted SSH login with credentials root:u****u	Brute-Force SSH
🇮🇹 CoreTech srl	2026-07-26 02:53:56 (9 hours ago)	[DC: IP:151.1.252.27] ntopng alert: blacklisted_client_contact	Hacking
🇬🇧 benji07	2026-07-26 02:30:55 (10 hours ago)	2026-07-26T03:27:52.520458+01:00 homepi sshd[2465474]: pam_unix(sshd:auth): authentication failure; ... show more 2026-07-26T03:27:52.520458+01:00 homepi sshd[2465474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.139.154 user=root 2026-07-26T03:27:54.849086+01:00 homepi sshd[2465474]: Failed password for root from 120.48.139.154 port 60230 ssh2 2026-07-26T03:30:04.503427+01:00 homepi sshd[2468024]: Connection from 120.48.139.154 port 53782 on 192.168.0.38 port 22 rdomain "" 2026-07-26T03:30:53.181863+01:00 homepi sshd[2468024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.139.154 user=root 2026-07-26T03:30:54.689929+01:00 homepi sshd[2468024]: Failed password for root from 120.48.139.154 port 53782 ssh2 ... show less	Brute-Force SSH
🇰🇷 Woodie	2026-07-26 01:49:33 (10 hours ago)	2026-07-25T21:48:35.097616-04:00 debian sshd[4096178]: Failed password for root from 120.48.139.154 ... show more 2026-07-25T21:48:35.097616-04:00 debian sshd[4096178]: Failed password for root from 120.48.139.154 port 54224 ssh2 2026-07-25T21:48:37.569044-04:00 debian sshd[4096323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.139.154 user=root 2026-07-25T21:48:39.930316-04:00 debian sshd[4096323]: Failed password for root from 120.48.139.154 port 37582 ssh2 2026-07-25T21:49:30.925063-04:00 debian sshd[4096425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.139.154 user=root 2026-07-25T21:49:32.560755-04:00 debian sshd[4096425]: Failed password for root from 120.48.139.154 port 38148 ssh2 ... show less	Brute-Force SSH
🇩🇰 Deveroonie	2026-07-26 01:15:12 (11 hours ago)	2026-07-26T02:13:03.361970+01:00 server-1 sshd[1947714]: Connection closed by authenticating user ro ... show more 2026-07-26T02:13:03.361970+01:00 server-1 sshd[1947714]: Connection closed by authenticating user root 120.48.139.154 port 42174 [preauth] 2026-07-26T02:15:11.770732+01:00 server-1 sshd[1948187]: Connection closed by authenticating user root 120.48.139.154 port 53964 [preauth] ... show less	Hacking Brute-Force SSH
🇷🇸 Scan	2026-07-26 00:31:53 (12 hours ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇦🇹 urnilxfgbez	2026-07-25 22:45:00 (13 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 vertali	2026-07-25 18:52:59 (17 hours ago)	CSF/LFD blocked 120.48.139.154 after LF_SSHD on * (inout, perm=1, ttl=1s). Reason: (sshd) Failed SSH ... show more CSF/LFD blocked 120.48.139.154 after LF_SSHD on * (inout, perm=1, ttl=1s). Reason: (sshd) Failed SSH login from 120.48.139.154 (CN/China/-): 5 in the last 3600 secs. Evidence: Jul 25 13:52:42 paladin sshd-session[875841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.139.154 user=root show less	Brute-Force SSH
🇩🇪 Ilop	2026-07-25 16:39:10 (19 hours ago)	[honeypot-fra] 6 unsolicited packets to honeypot ports 22 (OCI DShield sensor)	Port Scan

Showing 1 to 15 of 51 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 213.33.182.183

🇺🇸 198.57.219.18

🇨🇱 159.112.138.47

🇨🇳 220.178.152.186

🇰🇷 220.127.148.6

🇲🇽 189.192.90.192

🇩🇪 167.94.146.70

🇺🇸 162.216.149.98

🇫🇷 91.196.152.34

🇺🇸 20.109.157.99

🇮🇪 3.250.128.251

🇩🇪 194.36.32.205

🇺🇸 143.198.63.96

🇨🇳 125.104.161.17

🇺🇸 104.248.238.232

🇳🇵 103.86.57.76

🇺🇸 54.200.88.181

🇬🇧 35.203.210.4

🇨🇳 8.163.108.131

🇲🇽 200.68.181.169