This IP address has been reported a total of
31
times from
30 distinct
sources.
120.70.96.125 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-08-24T02:10:17.159940+02:00 vm986549.cloud.nuxt.network sshd-session[5035]: Failed password for ...
show more2026-08-24T02:10:17.159940+02:00 vm986549.cloud.nuxt.network sshd-session[5035]: Failed password for root from 120.70.96.125 port 38870 ssh2
2026-08-24T02:10:26.829260+02:00 vm986549.cloud.nuxt.network sshd-session[5038]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.70.96.125 user=root
2026-08-24T02:10:28.692867+02:00 vm986549.cloud.nuxt.network sshd-session[5038]: Failed password for root from 120.70.96.125 port 41256 ssh2
...
show less
Automated report: SSH brute force detected. This IP exceeded the allowed number of failed login atte ...
show moreAutomated report: SSH brute force detected. This IP exceeded the allowed number of failed login attempts (3 attempts).
show less
2026-08-23T07:09:22.077816+02:00 srv03 sshd-session[82094]: Failed password for root from 120.70.96. ...
show more2026-08-23T07:09:22.077816+02:00 srv03 sshd-session[82094]: Failed password for root from 120.70.96.125 port 57448 ssh2
2026-08-23T07:09:25.591390+02:00 srv03 sshd-session[82132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.70.96.125 user=root
2026-08-23T07:09:28.072696+02:00 srv03 sshd-session[82132]: Failed password for root from 120.70.96.125 port 59278 ssh2
...
show less
SSH brute force on port 22 -- 4 attempts, 1 successful. Credentials: root:5nWt3P-fF4WosQm5O. Active: ...
show moreSSH brute force on port 22 -- 4 attempts, 1 successful. Credentials: root:5nWt3P-fF4WosQm5O. Active: 2026-08-22T12:41 to 2026-08-22T12:42. Post-login: ausearch -i -k command --checkpoint /var/lib/honeypot/audit_; ausearch -i -m USER_LOGIN,USER_START --checkpoint /var/lib/h; /bin/sh -c /etc/cron.hourly/gcc.sh. Malware: botnet (high); miner (critical); trojan (high). Source: AS137695 CHINATELECOM Xinjiang Wulumuqi MAN network (Ürümqi, CN). Data from SSH honeypot — not a production system.
show less
2026-08-22T12:39:27.746948vm15904.akenai.host sshd[102842]: Failed password for root from 120.70.96. ...
show more2026-08-22T12:39:27.746948vm15904.akenai.host sshd[102842]: Failed password for root from 120.70.96.125 port 43136 ssh2
2026-08-22T12:40:06.393402vm15904.akenai.host sshd[102844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.70.96.125 user=root
2026-08-22T12:40:08.471862vm15904.akenai.host sshd[102844]: Failed password for root from 120.70.96.125 port 44612 ssh2
...
show less
2026-08-22T06:15:17.523687whm12.palvelukanava.fi sshd[1296718]: Failed password for root from 120.70 ...
show more2026-08-22T06:15:17.523687whm12.palvelukanava.fi sshd[1296718]: Failed password for root from 120.70.96.125 port 44352 ssh2
2026-08-22T06:15:21.776493whm12.palvelukanava.fi sshd[1296723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.70.96.125 user=root
2026-08-22T06:15:23.697146whm12.palvelukanava.fi sshd[1296723]: Failed password for root from 120.70.96.125 port 45932 ssh2
...
show less