This IP address has been reported a total of
2,861
times from
899 distinct
sources.
120.48.28.60 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[rede-arem1] (sshd) Failed SSH login from 120.48.28.60 (CN/China/-): 5 in the last 3600 secs; Ports: ...
show more[rede-arem1] (sshd) Failed SSH login from 120.48.28.60 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 5 00:12:01 sshd[16417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.28.60 user=[USERNAME]
Jun 5 00:12:03 sshd[16417]: Failed password for [USERNAME] from 120.48.28.60 port 38398 ssh2
Jun 5 00:18:53 sshd[16581]: Invalid user [USERNAME] from 120.48.28.60 port 32804
Jun 5 00:18:55 sshd[16581]: Failed password for invalid user [USERNAME] from 120.48.28.60 port 32804 ssh2
Jun 5 00:20:37 sshd[16652]: pam_unix(sshd:auth): authentication failu
show less
(sshd) Failed SSH login from 120.48.28.60 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction ...
show more(sshd) Failed SSH login from 120.48.28.60 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun 5 04:47:36 zone sshd[3591272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.28.60 user=root
Jun 5 04:47:38 zone sshd[3591272]: Failed password for root from 120.48.28.60 port 60146 ssh2
Jun 5 05:10:58 zone sshd[3595661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.28.60 user=root
Jun 5 05:10:59 zone sshd[3595661]: Failed password for root from 120.48.28.60 port 59302 ssh2
Jun 5 05:14:27 zone sshd[3596343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.28.60 user=root
show less
Funeypot detected 5 ssh attempts in 36m14s. Last by user "socks", password "1***5", client "libssh_0 ...
show moreFuneypot detected 5 ssh attempts in 36m14s. Last by user "socks", password "1***5", client "libssh_0.9.6".
show less
Report 2432214 with IP 3067359 for SSH brute-force attack by source 3157730 via ssh-honeypot/0.2.0+h ...
show moreReport 2432214 with IP 3067359 for SSH brute-force attack by source 3157730 via ssh-honeypot/0.2.0+http
show less
2026-06-04T17:21:58.463427+00:00 r1.sp1.as64172.enrut.ar sshd[3749083]: pam_unix(sshd:auth): authent ...
show more2026-06-04T17:21:58.463427+00:00 r1.sp1.as64172.enrut.ar sshd[3749083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.28.60
2026-06-04T17:22:00.261605+00:00 r1.sp1.as64172.enrut.ar sshd[3749083]: Failed password for invalid user ubuntu from 120.48.28.60 port 54644 ssh2
2026-06-04T17:24:48.628212+00:00 r1.sp1.as64172.enrut.ar sshd[3749128]: Invalid user an from 120.48.28.60 port 44292
...
show less
2026-06-04T19:21:43.999900+02:00 jantje sshd[23502]: pam_unix(sshd:auth): authentication failure; lo ...
show more2026-06-04T19:21:43.999900+02:00 jantje sshd[23502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.28.60
2026-06-04T19:21:45.738427+02:00 jantje sshd[23502]: Failed password for invalid user ubuntu from 120.48.28.60 port 52728 ssh2
2026-06-04T19:21:47.344729+02:00 jantje sshd[23502]: Disconnected from invalid user ubuntu 120.48.28.60 port 52728 [preauth]
...
show less
This IP was detected by CrowdSec triggering crowdsecurity/ssh-bf
SSH
Brute-Force
Anonymous
Jun 4 08:27:58 f2b auth.info sshd[97565]: Invalid user postgres from 120.48.28.60 port 43618
Jun 4 ...
show moreJun 4 08:27:58 f2b auth.info sshd[97565]: Invalid user postgres from 120.48.28.60 port 43618
Jun 4 08:27:58 f2b auth.info sshd[97565]: Failed password for invalid user postgres from 120.48.28.60 port 43618 ssh2
Jun 4 08:27:58 f2b auth.info sshd[97565]: Disconnected from invalid user postgres 120.48.28.60 port 43618 [preauth]
...
show less
Jun 3 19:27:33 flappy sshd[1013628]: Invalid user epadmin from 120.48.28.60 port 36638
Jun 3 19:32 ...
show moreJun 3 19:27:33 flappy sshd[1013628]: Invalid user epadmin from 120.48.28.60 port 36638
Jun 3 19:32:22 flappy sshd[1013930]: Invalid user mango from 120.48.28.60 port 34304
Jun 3 19:39:01 flappy sshd[1014296]: Invalid user admin from 120.48.28.60 port 35074
Jun 3 19:46:37 flappy sshd[1014701]: Invalid user nikolay from 120.48.28.60 port 59796
...
show less
2026-06-04T04:29:39.751675+02:00 axisverse sshd-session[1384717]: Invalid user epadmin from 120.48.2 ...
show more2026-06-04T04:29:39.751675+02:00 axisverse sshd-session[1384717]: Invalid user epadmin from 120.48.28.60 port 58014
2026-06-04T04:32:50.862705+02:00 axisverse sshd-session[1389471]: Invalid user mango from 120.48.28.60 port 52500
2026-06-04T04:34:32.480140+02:00 axisverse sshd-session[1392238]: Invalid user lab from 120.48.28.60 port 35316
...
show less
2026-06-04T04:22:20.208841+03:00 kotia sshd-session[186623]: Invalid user au from 120.48.28.60 port ...
show more2026-06-04T04:22:20.208841+03:00 kotia sshd-session[186623]: Invalid user au from 120.48.28.60 port 54678
...
show less
2026-06-04T02:23:03.189288+02:00 vlinux sshd-session[700678]: Invalid user oracle from 120.48.28.60 ...
show more2026-06-04T02:23:03.189288+02:00 vlinux sshd-session[700678]: Invalid user oracle from 120.48.28.60 port 42366
2026-06-04T02:27:44.713028+02:00 vlinux sshd-session[700789]: Invalid user ldap from 120.48.28.60 port 43460
2026-06-04T02:30:06.818042+02:00 vlinux sshd-session[701065]: Invalid user testsftp from 120.48.28.60 port 49904
...
show less
Brute-Force
SSH
Showing 1 to
15
of 2861 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩