134.199.201.185

Phishing impersonating Bitwarden, confirmed by the reporting analyst. Associated URL(s): https://134.199.201.185/. Observation date confirmed by analyst: 2026-10-22; exact observation time not recorded.

Phishing activity observed at https://134.199.201.185/

The reported IP addresses are hosting phishing pages that impersonate Bitwarden by mimicking its official login interface to trick users into entering sensitive credentials. This activity involves credential harvesting, unauthorized use of Bitwarden’ ... show more The reported IP addresses are hosting phishing pages that impersonate Bitwarden by mimicking its official login interface to trick users into entering sensitive credentials. This activity involves credential harvesting, unauthorized use of Bitwarden’s branding, and poses a serious risk of account compromise and data theft. Immediate investigation and takedown are requested. show less

Fail2ban automated report

list.rtbh.com.tr report: tcp/0

Cowrie honeypot hit at 2026-03-05T17:43:04.400196Z

Fail2ban automated report

Failed password for root Mar 05 18:43:58 port 47816

Brute force activities detected and blocked

2026-03-05T18:27:44.248825+00:00 scw-zen-shannon sshd-session[1432571]: Invalid user admin from 134.199.201.185 port 59954 2026-03-05T18:28:20.667114+00:00 scw-zen-shannon sshd-session[1432611]: Invalid user admin from 134.199.201.185 port 60264 2026 ... show more 2026-03-05T18:27:44.248825+00:00 scw-zen-shannon sshd-session[1432571]: Invalid user admin from 134.199.201.185 port 59954 2026-03-05T18:28:20.667114+00:00 scw-zen-shannon sshd-session[1432611]: Invalid user admin from 134.199.201.185 port 60264 2026-03-05T18:28:56.419960+00:00 scw-zen-shannon sshd-session[1432633]: Invalid user admin from 134.199.201.185 port 53486 ... show less

2026-03-05T19:27:37.981878+01:00 [server] sshd-session[3974757]: Invalid user admin from 134.199.201.185 port 43148 2026-03-05T19:28:14.300108+01:00 [server] sshd-session[3974824]: Invalid user admin from 134.199.201.185 port 41932 2026-03-05T19:28:5 ... show more 2026-03-05T19:27:37.981878+01:00 [server] sshd-session[3974757]: Invalid user admin from 134.199.201.185 port 43148 2026-03-05T19:28:14.300108+01:00 [server] sshd-session[3974824]: Invalid user admin from 134.199.201.185 port 41932 2026-03-05T19:28:50.834530+01:00 [server] sshd-session[3974924]: Invalid user admin from 134.199.201.185 port 57914 ... show less

Mar 5 19:27:41 s1-4-gra7 sshd[910396]: Invalid user admin from 134.199.201.185 port 44376 Mar 5 19:28:17 s1-4-gra7 sshd[910435]: Invalid user admin from 134.199.201.185 port 34010

Brute-force SSH server detected by Fail2ban

2026-03-05T18:27:47.045926+00:00 sgb-01 sshd-session[1590301]: Invalid user admin from 134.199.201.185 port 57092 ...

2026-03-05T19:12:09.824191+01:00 vps643776 sshd[53689]: Failed password for root from 134.199.201.185 port 42272 ssh2 2026-03-05T19:12:48.718172+01:00 vps643776 sshd[53702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r ... show more 2026-03-05T19:12:09.824191+01:00 vps643776 sshd[53689]: Failed password for root from 134.199.201.185 port 42272 ssh2 2026-03-05T19:12:48.718172+01:00 vps643776 sshd[53702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.199.201.185 user=root 2026-03-05T19:12:50.647300+01:00 vps643776 sshd[53702]: Failed password for root from 134.199.201.185 port 53388 ssh2 2026-03-05T19:13:29.202063+01:00 vps643776 sshd[53715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.199.201.185 user=root 2026-03-05T19:13:31.758902+01:00 vps643776 sshd[53715]: Failed password for root from 134.199.201.185 port 38246 ssh2 ... show less