157.245.142.47

Honeypot Finding: repeated TCP service probing on TCP/1111 (service); 2 application-level events across 2 source port(s). Sensor(s): Honeytrap.

(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 157.245.142.47 (US/United States/-): 1 in the last 3600 secs (0-195)

FW-PortScan: Traffic Blocked srcport=61005 dstport=8181

Blocked by UFW (TCP on 8085) Source port: 61000 TTL: 241 Packet length: 44 TOS: 0x08 This report (for 157.245.142.47) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

tcp/50050

denied traffic to a honeypot network. destination port 7777.

Observed enumerating honeypot service(s). Source IP accessed honeypot infrastructure and engaged in scanning/enumeration behavior. Reported via automated honeypot analysis pipeline.

Unauthorized SSH access attempt (tcp/2222)

(sshd) Failed SSH login from 157.245.142.47 (US/United States/-)

Mar 20 04:15:19 vps-d7931dc8 sshd[449045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.47 Mar 20 04:15:19 vps-d7931dc8 sshd[449045]: Invalid user administrator from 157.245.142.47 port 48920 Ma ... show more Mar 20 04:15:19 vps-d7931dc8 sshd[449045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.47 Mar 20 04:15:19 vps-d7931dc8 sshd[449045]: Invalid user administrator from 157.245.142.47 port 48920 Mar 20 04:15:21 vps-d7931dc8 sshd[449045]: Failed password for invalid user administrator from 157.245.142.47 port 48920 ssh2 Mar 20 04:15:22 vps-d7931dc8 sshd[449045]: Connection closed by invalid user administrator 157.245.142.47 port 48920 [preauth] Mar 20 04:15:26 vps-d7931dc8 sshd[449047]: Invalid user adminuser from 157.245.142.47 port 33596 show less

2026-03-20T04:15:14.495003+00:00 taxi sshd[4103274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.47 2026-03-20T04:15:16.315897+00:00 taxi sshd[4103274]: Failed password for invalid user adminis ... show more 2026-03-20T04:15:14.495003+00:00 taxi sshd[4103274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.47 2026-03-20T04:15:16.315897+00:00 taxi sshd[4103274]: Failed password for invalid user administrator from 157.245.142.47 port 32768 ssh2 2026-03-20T04:15:21.533888+00:00 taxi sshd[4103277]: Invalid user adminuser from 157.245.142.47 port 32776 2026-03-20T04:15:21.640434+00:00 taxi sshd[4103277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.142.47 2026-03-20T04:15:23.757199+00:00 taxi sshd[4103277]: Failed password for invalid user adminuser from 157.245.142.47 port 32776 ssh2 ... show less

The IP 157.245.142.47 tried multiple SSH_BRUTE_FORCE logins

Events: TCP SYN Discovery or Flooding, Seen 6 times in the last 10800 seconds

Unsolicited connection attempt(s), port:1022.

Unsolicited connection attempt(s), port:1022.