151.59.159.41

Confirmed malicious by STILWaters CTI platform (score=100, sources=1)

Confirmed malicious by STILWaters CTI platform (score=100, sources=1)

Confirmed malicious by STILWaters CTI platform (score=100, sources=1)

Confirmed malicious by STILWaters CTI platform (score=100, sources=1)

Confirmed malicious by STILWaters CTI platform (score=100, sources=1)

Automated report from fail2ban jail: sshd

Jul 9 16:17:00 mazenhost-ddosalerts sshd[822787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.59.159.41 Jul 9 16:17:03 mazenhost-ddosalerts sshd[822787]: Failed password for invalid user admin from 1 ... show more Jul 9 16:17:00 mazenhost-ddosalerts sshd[822787]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.59.159.41 Jul 9 16:17:03 mazenhost-ddosalerts sshd[822787]: Failed password for invalid user admin from 151.59.159.41 port 59382 ssh2 Jul 9 16:18:56 mazenhost-ddosalerts sshd[822792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.59.159.41 user=root Jul 9 16:18:58 mazenhost-ddosalerts sshd[822792]: Failed password for root from 151.59.159.41 port 54128 ssh2 Jul 9 16:20:55 mazenhost-ddosalerts sshd[822797]: Invalid user clement from 151.59.159.41 port 58876 Jul 9 16:20:55 mazenhost-ddosalerts sshd[822797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.59.159.41 Jul 9 16:20:58 mazenhost-ddosalerts sshd[822797]: Failed password for invalid user clement from 151.59.159.41 port 58876 ssh2 ... show less

SSH abuse or brute-force attack detected by Fail2Ban in ssh jail

2026-07-09T14:00:36.590063+02:00 rpi4 sshd[2012789]: Invalid user tk from 151.59.159.41 port 57268 2026-07-09T14:07:37.233186+02:00 rpi4 sshd[2014150]: Invalid user fastuser from 151.59.159.41 port 39660 2026-07-09T14:09:52.434659+02:00 rpi4 sshd[201 ... show more 2026-07-09T14:00:36.590063+02:00 rpi4 sshd[2012789]: Invalid user tk from 151.59.159.41 port 57268 2026-07-09T14:07:37.233186+02:00 rpi4 sshd[2014150]: Invalid user fastuser from 151.59.159.41 port 39660 2026-07-09T14:09:52.434659+02:00 rpi4 sshd[2014541]: Invalid user user2 from 151.59.159.41 port 46050 2026-07-09T14:12:00.673715+02:00 rpi4 sshd[2014995]: Invalid user debianuser from 151.59.159.41 port 58424 2026-07-09T14:14:18.100300+02:00 rpi4 sshd[2015434]: Invalid user d from 151.59.159.41 port 39124 ... show less

Jul 9 15:07:03 mazenhost-ddosalerts sshd[822412]: Failed password for invalid user fastuser from 151.59.159.41 port 43652 ssh2 Jul 9 15:09:21 mazenhost-ddosalerts sshd[822472]: Invalid user user2 from 151.59.159.41 port 38566 Jul 9 15:09:21 mazenh ... show more Jul 9 15:07:03 mazenhost-ddosalerts sshd[822412]: Failed password for invalid user fastuser from 151.59.159.41 port 43652 ssh2 Jul 9 15:09:21 mazenhost-ddosalerts sshd[822472]: Invalid user user2 from 151.59.159.41 port 38566 Jul 9 15:09:21 mazenhost-ddosalerts sshd[822472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.59.159.41 Jul 9 15:09:22 mazenhost-ddosalerts sshd[822472]: Failed password for invalid user user2 from 151.59.159.41 port 38566 ssh2 Jul 9 15:11:28 mazenhost-ddosalerts sshd[822520]: Invalid user debianuser from 151.59.159.41 port 53098 Jul 9 15:11:28 mazenhost-ddosalerts sshd[822520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=151.59.159.41 Jul 9 15:11:30 mazenhost-ddosalerts sshd[822520]: Failed password for invalid user debianuser from 151.59.159.41 port 53098 ssh2 ... show less

2026-07-09T13:55:44.328345+02:00 hz-dedi-sx134-fsn sshd-session[2411538]: Invalid user tk from 151.59.159.41 port 51844 2026-07-09T14:06:45.869385+02:00 hz-dedi-sx134-fsn sshd-session[2420120]: Invalid user fastuser from 151.59.159.41 port 50380 2026 ... show more 2026-07-09T13:55:44.328345+02:00 hz-dedi-sx134-fsn sshd-session[2411538]: Invalid user tk from 151.59.159.41 port 51844 2026-07-09T14:06:45.869385+02:00 hz-dedi-sx134-fsn sshd-session[2420120]: Invalid user fastuser from 151.59.159.41 port 50380 2026-07-09T14:09:07.110311+02:00 hz-dedi-sx134-fsn sshd-session[2421955]: Invalid user user2 from 151.59.159.41 port 39680 ... show less

Observed automated SSH brute-force activity. Attempts: 5 | Failed password: 3 | Invalid user: 2 First seen: 2026-07-09 11:54:03 UTC Last seen: 2026-07-09 12:06:30 UTC Source: Linux OpenSSH journalctl telemetry from OVH-hosted Debian server.

Credential stuffing via libssh 0.9.6. Three login attempts in 8 sec: 345gs5662d34/345gs5662d34, tk/3245gs5662d34, tk/tk. Post-auth cmds executed: (1) cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7Vv ... show more Credential stuffing via libssh 0.9.6. Three login attempts in 8 sec: 345gs5662d34/345gs5662d34, tk/3245gs5662d34, tk/tk. Post-auth cmds executed: (1) cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx — removes .ssh, injects SSH pubkey for persistence. (2) cd ~; chattr -ia .ssh; lockr -ia .ssh — removes immutable/append-only attrs, reapplies via lockr tool to prevent key deletion. Attack establishes SSH persistence through authorized_keys manipulation and file attribute hardening. Consistent with botnet activity or automated intrusion infrastructure. Indicates reconnaissance or lateral movement from compromised host. show less

(sshd) Failed SSH login from 151.59.159.41 (IT/Italy/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul 9 12:18:47 da057 sshd[2266576]: Invalid user user from 151.59.159.41 port 38360 Jul 9 12:25:20 da057 sshd[2276 ... show more (sshd) Failed SSH login from 151.59.159.41 (IT/Italy/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jul 9 12:18:47 da057 sshd[2266576]: Invalid user user from 151.59.159.41 port 38360 Jul 9 12:25:20 da057 sshd[2276797]: Invalid user hik from 151.59.159.41 port 48130 Jul 9 12:27:07 da057 sshd[2278288]: Invalid user db2inst1 from 151.59.159.41 port 36830 Jul 9 12:28:49 da057 sshd[2279918]: Invalid user shoply from 151.59.159.41 port 56562 Jul 9 12:30:31 da057 sshd[2283933]: Invalid user dd from 151.59.159.41 port 57562 show less

Invalid user user from 151.59.159.41 port 37562