This IP address has been reported a total of
157
times from
128 distinct
sources.
144.48.118.52 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
France
with 35
reports;
United States of America
with 32
reports;
Germany
with 30
reports.
The most common categories in these recent reports were:
Brute-Force
137
times;
SSH
134
times;
Hacking
13
times;
Port Scan
8
times;
Exploited Host
4
times;
Other
7
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Auto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — SSH (36 events in ...
show moreAuto-blocked by Seczar SecureOps — High-Risk Port Probe (admin-managed entries) — SSH (36 events in 5min) at 2026-10-15 01:52
show less
2 SSH sessions used valid-looking logins: mailadmin/MhS+xYL#-OpmE0@ and test/77hfr$Cd=Z$=sM!. The ac ...
show more2 SSH sessions used valid-looking logins: mailadmin/MhS+xYL#-OpmE0@ and test/77hfr$Cd=Z$=sM!. The actor ran recon commands uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and a shell loop to find writable directories. They then staged /tmp/w.sh, made it executable, and dropped artifact w.sh (script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28). Persistence attempts included checking crontab and adding an @reboot entry for /tmp/w.sh, plus creating ~/.config/systemd/user/watcher-netai.service and running systemctl --user daemon-reload and enable --now. No downloads, lateral movement, or additional payloads were observed.
show less
Single SSH session using valid creds mailadmin/MhS+xYL#-OpmE0@ from SSH-2.0-Go. Attacker checked CPU ...
show moreSingle SSH session using valid creds mailadmin/MhS+xYL#-OpmE0@ from SSH-2.0-Go. Attacker checked CPU count, listed top processes, and searched writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /). In /tmp they prepared to create and chmod +x w.sh, then attempted persistence via a crontab @reboot entry referencing /tmp/w.sh and via a user systemd service at ~/.config/systemd/user/watcher-netai.service with systemctl --user daemon-reload and enable --now. No download command, malware file, lateral movement, or port forwarding observed.
show less
Single SSH session using test/77hfr$Cd=Z$=sM! from SSH-2.0-Go. Commands show host recon and persiste ...
show moreSingle SSH session using test/77hfr$Cd=Z$=sM! from SSH-2.0-Go. Commands show host recon and persistence setup: uname -a, cpu count via /proc/cpuinfo, and top process listing. The actor checked writable locations, then cd "/tmp" and created /tmp/w.sh with chmod +x. They queried crontab and attempted to add an @reboot entry to run /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". No downloads, file drops, lateral movement, or other payload execution were observed in this session.
show less
2026-10-14T21:48:46.522175+08:00 us21.cdn.420422709.xyz sshd-session[100161]: Invalid user pi from 1 ...
show more2026-10-14T21:48:46.522175+08:00 us21.cdn.420422709.xyz sshd-session[100161]: Invalid user pi from 144.48.118.52 port 58408
2026-10-14T21:48:46.761109+08:00 us21.cdn.420422709.xyz sshd-session[100161]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=144.48.118.52
2026-10-14T21:48:49.016296+08:00 us21.cdn.420422709.xyz sshd-session[100161]: Failed password for invalid user pi from 144.48.118.52 port 58408 ssh2
...
show less
Report 2746871 with IP 3794440 for SSH brute-force attack by source 3789096 via ssh-honeypot/0.2.0+h ...
show moreReport 2746871 with IP 3794440 for SSH brute-force attack by source 3789096 via ssh-honeypot/0.2.0+http
show less
