Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.
Nov 5 23:28:03 mail sshd[773138]: Failed password for invalid user jj from 120.48.175.248 port 35158 ssh2
Nov 5 23:30:23 mail sshd[811163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248 user ...
show moreNov 5 23:28:03 mail sshd[773138]: Failed password for invalid user jj from 120.48.175.248 port 35158 ssh2
Nov 5 23:30:23 mail sshd[811163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248 user=root
Nov 5 23:30:25 mail sshd[811163]: Failed password for root from 120.48.175.248 port 46244 ssh2
...
show less
2026-11-05T22:58:44.745277+01:00 akvorado sshd-session[1704792]: Failed password for invalid user desktop from 120.48.175.248 port 41438 ssh2
2026-11-05T22:58:46.494260+01:00 akvorado sshd-session[1704792]: Disconnected from invalid user desktop 120. ...
show more2026-11-05T22:58:44.745277+01:00 akvorado sshd-session[1704792]: Failed password for invalid user desktop from 120.48.175.248 port 41438 ssh2
2026-11-05T22:58:46.494260+01:00 akvorado sshd-session[1704792]: Disconnected from invalid user desktop 120.48.175.248 port 41438 [preauth]
2026-11-05T23:08:28.154906+01:00 akvorado sshd-session[1719458]: Invalid user test from 120.48.175.248 port 51518
2026-11-05T23:08:28.159319+01:00 akvorado sshd-session[1719458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248
2026-11-05T23:08:30.257578+01:00 akvorado sshd-session[1719458]: Failed password for invalid user test from 120.48.175.248 port 51518 ssh2
...
show less
(sshd) Failed SSH login from 120.48.175.248 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov 5 16:16:02 web02 sshd[39270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser ...
show more(sshd) Failed SSH login from 120.48.175.248 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov 5 16:16:02 web02 sshd[39270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248 user=root
Nov 5 16:16:03 web02 sshd[39270]: Failed password for root from 120.48.175.248 port 46502 ssh2
Nov 5 16:30:52 web02 sshd[42969]: Invalid user ubuntu from 120.48.175.248 port 35290
Nov 5 16:30:53 web02 sshd[42969]: Failed password for invalid user ubuntu from 120.48.175.248 port 35290 ssh2
Nov 5 17:04:19 web02 sshd[50664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248 user=root
show less
SSH Brute force: 1 attempts were recorded from 120.48.175.248
2026-11-05T13:05:38+0100 Connection closed by authenticating user root 120.48.175.248 [preauth]
2026-11-05T07:22:31.773978+00:00 waf sshd-session[3863289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248
2026-11-05T07:22:34.461377+00:00 waf sshd-session[3863289]: Failed password for invalid ...
show more2026-11-05T07:22:31.773978+00:00 waf sshd-session[3863289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.175.248
2026-11-05T07:22:34.461377+00:00 waf sshd-session[3863289]: Failed password for invalid user ec2-user from 120.48.175.248 port 55756 ssh2
2026-11-05T07:25:39.062346+00:00 waf sshd-session[3863693]: Invalid user user from 120.48.175.248 port 39124
...
show less
