Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-11-02T10:46:34.498227+00:00 g1 sshd-session[350360]: Invalid user pi from 14.193.81.11 port 48130
2026-11-02T10:46:34.583280+00:00 g1 sshd-session[350360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1 ...
show more2026-11-02T10:46:34.498227+00:00 g1 sshd-session[350360]: Invalid user pi from 14.193.81.11 port 48130
2026-11-02T10:46:34.583280+00:00 g1 sshd-session[350360]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.193.81.11
2026-11-02T10:46:36.432588+00:00 g1 sshd-session[350360]: Failed password for invalid user pi from 14.193.81.11 port 48130 ssh2
...
show less
2026-10-31T20:58:05.411210+01:00 eproxy sshd[1280583]: Invalid user pi from 14.193.81.11 port 53192
2026-10-31T20:58:05.494791+01:00 eproxy sshd[1280585]: Invalid user pi from 14.193.81.11 port 53204
...
Four SSH sessions in 6 seconds with brute-force login attempts using pi/raspberry and pi/raspberryraspberry993311. After login, the actor staged and executed a payload in /tmp: scp -t /tmp/NiHfe8s9, then cd /tmp && chmod +x NiHfe8s9 && bash -c ./NiHf ...
show moreFour SSH sessions in 6 seconds with brute-force login attempts using pi/raspberry and pi/raspberryraspberry993311. After login, the actor staged and executed a payload in /tmp: scp -t /tmp/NiHfe8s9, then cd /tmp && chmod +x NiHfe8s9 && bash -c ./NiHfe8s9. Recovered artifact: NiHfe8s9, file, 4.6 KB, sha256:6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b. No other commands, persistence, lateral movement, or additional downloads were observed.
show less
Attempted SSH login with pi/raspberry and pi/raspberryraspberry993311 using SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2+rpt1. After login, the actor staged a payload transfer with scp -t /tmp/NiHfe8s9, then changed into /tmp, set execute permission on ...
show moreAttempted SSH login with pi/raspberry and pi/raspberryraspberry993311 using SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2+rpt1. After login, the actor staged a payload transfer with scp -t /tmp/NiHfe8s9, then changed into /tmp, set execute permission on NiHfe8s9, and executed it with bash -c ./NiHfe8s9. This shows direct payload upload and execution in /tmp. No additional commands, persistence, lateral movement, or dropped-file artifacts were observed in the session.
show less
Brute-Force
SSH
Anonymous
2026-10-29T16:00:24.405543 mail2.akcurate.de sshd-session[209322]: Invalid user pi from 14.193.81.11 port 50760
2026-10-29T16:00:24.629908 mail2.akcurate.de sshd-session[209323]: Invalid user pi from 14.193.81.11 port 50778
2026-10-29T16:00:24.658628 ...
show more2026-10-29T16:00:24.405543 mail2.akcurate.de sshd-session[209322]: Invalid user pi from 14.193.81.11 port 50760
2026-10-29T16:00:24.629908 mail2.akcurate.de sshd-session[209323]: Invalid user pi from 14.193.81.11 port 50778
2026-10-29T16:00:24.658628 mail2.akcurate.de sshd-session[209322]: Connection closed by invalid user pi 14.193.81.11 port 50760 [preauth]
...
show less
SSH Brute force: 2 attempts were recorded from 14.193.81.11
2026-10-27T08:49:33+0100 Invalid user pi from 14.193.81.11
2026-10-27T08:49:33+0100 Invalid user pi from 14.193.81.11
Failed password for pi from 14.193.81.11 port 36020 ssh2
Failed password for pi from 14.193.81.11 port 36018 ssh2
Connection closed by pi 14.193.81.11 port 36018 [preauth]
SSH
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown