This IP address has been reported a total of
55
times from
38 distinct
sources.
149.88.104.20 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
monitor: on VM-0-7-ubuntu | port: 11302 | ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporte ...
show moremonitor: on VM-0-7-ubuntu | port: 11302 | ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
Anonymous
Automated Apache web application probing in selected 24h window; attempts=24, unique_paths=5, error_ ...
show moreAutomated Apache web application probing in selected 24h window; attempts=24, unique_paths=5, error_responses=21; targets include WordPress, .env/.git, phpMyAdmin, autodiscover, wpad.dat and related probe paths.
show less
(bad_user_agent) srv101 Bad User-Agent 149.88.104.20 (CL/Chile/unn-149-88-104-20.datapacket.com): 10 ...
show more(bad_user_agent) srv101 Bad User-Agent 149.88.104.20 (CL/Chile/unn-149-88-104-20.datapacket.com): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
SSH brute force on port 22 -- 4 attempts, 1 successful. Credentials: root:root. Active: 2026-07-04T1 ...
show moreSSH brute force on port 22 -- 4 attempts, 1 successful. Credentials: root:root. Active: 2026-07-04T16:30 to 2026-07-15T05:49. Post-login: /usr/bin/dwcbqnllso automount 3069724; /usr/bin/dwcbqnllso [rcu_gp] 3069724; /usr/bin/dwcbqnllso [cpuhp/0] 3069724. Malware: trojan (high); trojan (critical); miner (critical). Source: AS212238 Datacamp Limited (Santiago, CL). Data from SSH honeypot — not a production system.
show less
Two SSH sessions established using credentials administrator/1234 via OpenSSH client version 10.0-hp ...
show moreTwo SSH sessions established using credentials administrator/1234 via OpenSSH client version 10.0-hpn14v15. No commands were executed on the system; however, the attacker attempted port forwarding to multiple external destinations on ports 80 and 443, suggesting reconnaissance or preparation for lateral movement or data exfiltration. No malware artifacts or persistence mechanisms were detected.
show less