This IP address has been reported a total of
108
times from
85 distinct
sources.
120.52.92.223 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
SSH Brute Force (3 attempts). Evidence: sshd-session[214101]: Connection closed by 120.52.92.223 por ...
show moreSSH Brute Force (3 attempts). Evidence: sshd-session[214101]: Connection closed by 120.52.92.223 port 51283 [preauth];sshd-session[214104]: Connection closed by 120.52.92.223 port 2002 [preauth]
show less
2026-07-24T22:06:15.997027+02:00 rahona.network sshd-session[562567]: Failed password for invalid us ...
show more2026-07-24T22:06:15.997027+02:00 rahona.network sshd-session[562567]: Failed password for invalid user hadoop from 120.52.92.223 port 54912 ssh2
2026-07-24T22:16:22.570491+02:00 rahona.network sshd-session[563516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.52.92.223 user=root
2026-07-24T22:16:24.198122+02:00 rahona.network sshd-session[563516]: Failed password for root from 120.52.92.223 port 6596 ssh2
2026-07-24T22:25:01.885371+02:00 rahona.network sshd-session[564382]: Invalid user www from 120.52.92.223 port 61042
show less
Failed password for eric from 120.52.92.223 port 20938 ssh2
Failed password for root from 120.52.92. ...
show moreFailed password for eric from 120.52.92.223 port 20938 ssh2
Failed password for root from 120.52.92.223 port 62263 ssh2
show less
2026-07-24T18:31:54.089737+02:00 gw-de17-01.guestgw.net sshd[926298]: Disconnected from authenticati ...
show more2026-07-24T18:31:54.089737+02:00 gw-de17-01.guestgw.net sshd[926298]: Disconnected from authenticating user root 120.52.92.223 port 5855 [preauth]
2026-07-24T18:41:48.875248+02:00 gw-de17-01.guestgw.net sshd[929262]: Connection closed by 120.52.92.223 port 27905 [preauth]
2026-07-24T18:42:15.171845+02:00 gw-de17-01.guestgw.net sshd[929662]: Disconnected from authenticating user root 120.52.92.223 port 54553 [preauth]
2026-07-24T18:43:22.316539+02:00 gw-de17-01.guestgw.net sshd[930000]: Invalid user eric from 120.52.92.223 port 16055
2026-07-24T18:43:22.618396+02:00 gw-de17-01.guestgw.net sshd[930000]: Disconnected from invalid user eric 120.52.92.223 port 16055 [preauth]
show less
CSF/LFD blocked 120.52.92.223 after LF_SSHD on * (inout, perm=1, ttl=1s). Reason: (sshd) Failed SSH ...
show moreCSF/LFD blocked 120.52.92.223 after LF_SSHD on * (inout, perm=1, ttl=1s). Reason: (sshd) Failed SSH login from 120.52.92.223 (CN/China/-): 5 in the last 3600 secs. Evidence: Jul 24 05:39:17 paladin sshd-session[525925]: Invalid user ubuntu from 120.52.92.223 port 57131
show less
2026-07-24T04:49:28.724924+02:00 rt-cs-302160.rt.pbx-host.com sshd-session[458558]: Disconnected fro ...
show more2026-07-24T04:49:28.724924+02:00 rt-cs-302160.rt.pbx-host.com sshd-session[458558]: Disconnected from invalid user ubuntu 120.52.92.223 port 28901 [preauth]
2026-07-24T04:56:00.382040+02:00 rt-cs-302160.rt.pbx-host.com sshd-session[459702]: Connection closed by 120.52.92.223 port 33211 [preauth]
2026-07-24T05:04:31.215205+02:00 rt-cs-302160.rt.pbx-host.com sshd-session[461209]: Invalid user rabbitmq from 120.52.92.223 port 22161
2026-07-24T05:04:31.467621+02:00 rt-cs-302160.rt.pbx-host.com sshd-session[461209]: Disconnected from invalid user rabbitmq 120.52.92.223 port 22161 [preauth]
2026-07-24T05:05:39.173457+02:00 rt-cs-302160.rt.pbx-host.com sshd-session[461405]: Disconnected from authenticating user root 120.52.92.223 port 27407 [preauth]
show less
Detected multiple authentication failures and invalid user attempts from IP address 120.52.92.223 on ...
show moreDetected multiple authentication failures and invalid user attempts from IP address 120.52.92.223 on [PT] GM-Lis-1 Node.
show less
2026-07-23T19:39:29.248211+02:00 vmi768479 sshd[3254924]: Invalid user prod from 120.52.92.223 port ...
show more2026-07-23T19:39:29.248211+02:00 vmi768479 sshd[3254924]: Invalid user prod from 120.52.92.223 port 14144
2026-07-23T19:39:29.520000+02:00 vmi768479 sshd[3254924]: Disconnected from invalid user prod 120.52.92.223 port 14144 [preauth]
2026-07-23T19:45:27.130019+02:00 vmi768479 sshd[3254942]: Connection closed by 120.52.92.223 port 50656 [preauth]
...
show less
Brute-Force
SSH
Showing 1 to
15
of 108 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩