This IP address has been reported a total of
4,115
times from
1,088 distinct
sources.
152.32.130.144 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Brute-force SSH attack via libssh. Three login attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d ...
show moreBrute-force SSH attack via libssh. Three login attempts: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/vicidial@123. Attacker exec'd: removed .ssh dir, recreated it, injected RSA pubkey (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4UhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2...). Second session attempted chattr -ia on .ssh for immutability, followed by lockr cmd (persistence tool). Pattern: credential enumeration targeting common usernames w/ dict/leaked password variants, then SSH key injection for persistence. VicIDial ref indicates VoIP/call center targeting. Commands exec'd in 7.8 sec, consistent w/ automated exploitation. No downloads. Focus: SSH backdoor access establish.
show less
(sshd) Failed SSH login from 152.32.130.144 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Dir ...
show more(sshd) Failed SSH login from 152.32.130.144 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Mar 31 23:23:17 14260 sshd[10113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=root
Mar 31 23:23:20 14260 sshd[10113]: Failed password for root from 152.32.130.144 port 14000 ssh2
Mar 31 23:29:21 14260 sshd[10555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=root
Mar 31 23:29:23 14260 sshd[10555]: Failed password for root from 152.32.130.144 port 45096 ssh2
Mar 31 23:33:11 14260 sshd[10867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=root
show less
[rede-arem1] (sshd) Failed SSH login from 152.32.130.144 (HK/Hong Kong/-): 5 in the last 3600 secs; ...
show more[rede-arem1] (sshd) Failed SSH login from 152.32.130.144 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 1 00:29:06 sshd[26851]: Invalid user [USERNAME] from 152.32.130.144 port 31432
Apr 1 00:29:08 sshd[26851]: Failed password for invalid user [USERNAME] from 152.32.130.144 port 31432 ssh2
Apr 1 00:34:06 sshd[27033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=[USERNAME]
Apr 1 00:34:08 sshd[27033]: Failed password for [USERNAME] from 152.32.130.144 port 17384 ssh2
Apr 1 00:37:22 sshd[27137]: pam_unix(sshd:auth): authenticati
show less
2026-04-01T11:20:10.355508+08:00 pbs sshd[3411140]: pam_unix(sshd:auth): authentication failure; log ...
show more2026-04-01T11:20:10.355508+08:00 pbs sshd[3411140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144
2026-04-01T11:20:12.846367+08:00 pbs sshd[3411140]: Failed password for invalid user claude from 152.32.130.144 port 24378 ssh2
...
show less
(sshd) Failed SSH login from 152.32.130.144 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Dir ...
show more(sshd) Failed SSH login from 152.32.130.144 (HK/Hong Kong/-): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_SSHD; Logs: Mar 31 21:38:24 21732 sshd[31636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=root
Mar 31 21:38:26 21732 sshd[31636]: Failed password for root from 152.32.130.144 port 61520 ssh2
Mar 31 21:42:18 21732 sshd[31937]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=root
Mar 31 21:42:20 21732 sshd[31937]: Failed password for root from 152.32.130.144 port 2254 ssh2
Mar 31 21:45:37 21732 sshd[32177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.130.144 user=root
show less
2026-04-01T04:07:22.855255+02:00 gw-de16-01.guestgw.net sshd[986114]: Disconnected from authenticati ...
show more2026-04-01T04:07:22.855255+02:00 gw-de16-01.guestgw.net sshd[986114]: Disconnected from authenticating user root 152.32.130.144 port 38506 [preauth]
2026-04-01T04:11:19.999799+02:00 gw-de16-01.guestgw.net sshd[987335]: Disconnected from authenticating user root 152.32.130.144 port 45528 [preauth]
2026-04-01T04:15:10.843472+02:00 gw-de16-01.guestgw.net sshd[988547]: Disconnected from authenticating user root 152.32.130.144 port 58112 [preauth]
2026-04-01T04:19:00.322235+02:00 gw-de16-01.guestgw.net sshd[989640]: Invalid user claude from 152.32.130.144 port 16106
2026-04-01T04:19:00.578023+02:00 gw-de16-01.guestgw.net sshd[989640]: Disconnected from invalid user claude 152.32.130.144 port 16106 [preauth]
show less
2026-04-01T01:47:19.614743+00:00 wightpi sshd[3854877]: Invalid user claude from 152.32.130.144 port ...
show more2026-04-01T01:47:19.614743+00:00 wightpi sshd[3854877]: Invalid user claude from 152.32.130.144 port 41186
2026-04-01T02:18:24.745771+00:00 wightpi sshd[3855298]: Invalid user claude from 152.32.130.144 port 15678
...
show less