Log in to view charts and search reports for this IP.
Log In
No reports in the last 60 days
159.89.198.106 has been reported 47
times. The most recent report is from
.
The full history is preserved below and remains searchable. A
0% score reflects the absence of recent activity, but
this is not a guarantee that earlier reports were invalid. Abuse confidence score decays,
naturally, over time, when the abusive activity stops.
Feb 26 23:54:06 localhost sshd[511946]: Failed password for postgres from 159.89.198.106 port 56218 ssh2
Feb 26 23:55:04 localhost sshd[511956]: Invalid user ftp from 159.89.198.106 port 54874
Feb 26 23:55:05 localhost sshd[511956]: pam_unix(sshd:aut ...
show moreFeb 26 23:54:06 localhost sshd[511946]: Failed password for postgres from 159.89.198.106 port 56218 ssh2
Feb 26 23:55:04 localhost sshd[511956]: Invalid user ftp from 159.89.198.106 port 54874
Feb 26 23:55:05 localhost sshd[511956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.198.106
Feb 26 23:55:06 localhost sshd[511956]: Failed password for invalid user ftp from 159.89.198.106 port 54874 ssh2
Feb 26 23:56:04 localhost sshd[511973]: Invalid user ftp from 159.89.198.106 port 43222
...
show less
Attacker from 159.89.198.106 conducted 5 SSH sessions over 4 minutes using a Go-based SSH client, attempting weak default credentials for the pi user (123456, pi123, qwerty, raspberrypi). Upon access, the attacker executed system reconnaissance comma ...
show moreAttacker from 159.89.198.106 conducted 5 SSH sessions over 4 minutes using a Go-based SSH client, attempting weak default credentials for the pi user (123456, pi123, qwerty, raspberrypi). Upon access, the attacker executed system reconnaissance commands to enumerate OS information, architecture, and uptime, consistent with initial botnet reconnaissance activity. No malware downloads or port forwarding attempts were observed during this attack window.
show less
Feb 26 23:29:20 localhost sshd[511661]: Failed password for invalid user pi from 159.89.198.106 port 53328 ssh2
Feb 26 23:30:21 localhost sshd[511683]: Invalid user pi from 159.89.198.106 port 53768
Feb 26 23:30:21 localhost sshd[511683]: pam_unix(ss ...
show moreFeb 26 23:29:20 localhost sshd[511661]: Failed password for invalid user pi from 159.89.198.106 port 53328 ssh2
Feb 26 23:30:21 localhost sshd[511683]: Invalid user pi from 159.89.198.106 port 53768
Feb 26 23:30:21 localhost sshd[511683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.198.106
Feb 26 23:30:23 localhost sshd[511683]: Failed password for invalid user pi from 159.89.198.106 port 53768 ssh2
Feb 26 23:31:25 localhost sshd[511694]: Invalid user pi from 159.89.198.106 port 50372
...
show less
2026-02-27T01:28:07.390504+02:00 chat.me.ke sshd[1312712]: Invalid user pi from 159.89.198.106 port 40612
...
Brute-Force
SSH
Anonymous
2026-02-27T01:16:28.997818+02:00 mail sshd[1342326]: Failed password for invalid user guest from 159.89.198.106 port 57280 ssh2
2026-02-27T01:17:45.357284+02:00 mail sshd[1342361]: Invalid user ubuntu from 159.89.198.106 port 58056
2026-02-27T01:17:4 ...
show more2026-02-27T01:16:28.997818+02:00 mail sshd[1342326]: Failed password for invalid user guest from 159.89.198.106 port 57280 ssh2
2026-02-27T01:17:45.357284+02:00 mail sshd[1342361]: Invalid user ubuntu from 159.89.198.106 port 58056
2026-02-27T01:17:45.912001+02:00 mail sshd[1342361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.198.106
2026-02-27T01:17:47.524900+02:00 mail sshd[1342361]: Failed password for invalid user ubuntu from 159.89.198.106 port 58056 ssh2
2026-02-27T01:18:50.297834+02:00 mail sshd[1342390]: Invalid user ubuntu from 159.89.198.106 port 36806
...
show less
IP 159.89.198.106 conducted 71 SSH sessions over approximately 74 minutes using a Go-based SSH client, attempting 68 common credential combinations across admin, guest, root, test, and user accounts with weak passwords. The attacker executed system r ...
show moreIP 159.89.198.106 conducted 71 SSH sessions over approximately 74 minutes using a Go-based SSH client, attempting 68 common credential combinations across admin, guest, root, test, and user accounts with weak passwords. The attacker executed system reconnaissance commands to gather OS information, architecture details, and uptime metrics, consistent with automated botnet scanning behavior. No malware downloads, privilege escalation attempts, or port forwarding activity was observed in this session.
show less
Feb 26 23:03:12 localhost sshd[511401]: Failed password for invalid user test from 159.89.198.106 port 46084 ssh2
Feb 26 23:04:32 localhost sshd[511414]: Invalid user guest from 159.89.198.106 port 59872
Feb 26 23:04:32 localhost sshd[511414]: pam_un ...
show moreFeb 26 23:03:12 localhost sshd[511401]: Failed password for invalid user test from 159.89.198.106 port 46084 ssh2
Feb 26 23:04:32 localhost sshd[511414]: Invalid user guest from 159.89.198.106 port 59872
Feb 26 23:04:32 localhost sshd[511414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.198.106
Feb 26 23:04:34 localhost sshd[511414]: Failed password for invalid user guest from 159.89.198.106 port 59872 ssh2
Feb 26 23:05:53 localhost sshd[511428]: Invalid user guest from 159.89.198.106 port 57170
...
show less
Brute-Force
SSH
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown