This IP address has been reported a total of
107
times from
55 distinct
sources.
161.35.20.76 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 32
reports;
Germany
with 24
reports;
Korea (the Republic of)
with 8
reports.
The most common categories in these recent reports were:
Brute-Force
87
times;
SSH
68
times;
Hacking
12
times;
Port Scan
9
times;
Exploited Host
9
times;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 19 00:13:38 obsidian sshd[2701799]: Invalid user mysql from 161.35.20.76 port 48556
Oct 19 00:13 ...
show moreOct 19 00:13:38 obsidian sshd[2701799]: Invalid user mysql from 161.35.20.76 port 48556
Oct 19 00:13:38 obsidian sshd[2701802]: Invalid user admin from 161.35.20.76 port 48580
Oct 19 00:13:39 obsidian sshd[2701805]: Invalid user ubuntu from 161.35.20.76 port 48594
...
show less
Two SSH sessions from SSH-2.0-Go used credentials mailadmin/MhS+xYL#-OpmE0@. Activity focused on dro ...
show moreTwo SSH sessions from SSH-2.0-Go used credentials mailadmin/MhS+xYL#-OpmE0@. Activity focused on dropping and staging files in /dev/shm and cleaning evidence. Observed commands created /dev/shm/w.sh, astats, and kstats, then checked whether astats and kstats were running. The session inspected CPU count and process usage with cat /proc/cpuinfo and ps. It also attempted persistence by checking crontab and adding an @reboot entry for /dev/shm/w.sh with arguments including "astats" "netai" "kstats" "ssh 2 az". Evidence cleanup commands removed .bash_history, utmp/wtmp/lastlog, yum.log, secure, and related logs. No downloads, port forwards, or lateral movement were observed.
show less
{"event":{"DateTime":"2026-10-17T13:51:35Z","RemoteAddr":"161.35.20.76:34014","Protocol":"SSH","Comm ...
show more{"event":{"DateTime":"2026-10-17T13:51:35Z","RemoteAddr":"161.35.20.76:34014","Protocol":"SSH","Command":"","CommandOutput":"","Status":"Stateless","Msg":"New SSH Login Attempt","ID":"ee64f276-3181-48a3-9a42-dd1b5a8c2d5e","Environ":"","User":"cs2","Password":"L2me3Qbg7P3zbft","Client":"SSH-2.0-Go","Headers":"","HeadersMap":null,"Cookies":"","UserAgent":"","HostHTTPRequest":"","Body":"","HTTPMethod":"","RequestURI":"","Description":"SSH interactive","SourceIp":"161.35.20.76","SourcePort":"34014","TLSServerName":"","Handler":""},"level":"info","msg":"New Event","status":"Stateless"}
{"event":{"DateTime":"2026-10-18T11:43:11Z","RemoteAddr":"161.35.20.76:49410","Protocol":"SSH","Command":"","CommandOutput":"","Status":"Stateless","Msg":"New SSH Login Attempt","ID":"204c1f12-7d0b-4662-80ff-67eaefe2ddc9","Environ":"","User":"cs2","Password":"123456","Client":"SSH-2.0-Go","Headers":"","HeadersMap":null,"Cookies":"","UserAgent":"","HostHTTPRequest":"","Body":"","HTTPMethod":"","RequestURI":"","Description":"SSH inter
show less
Connection closed by authenticating user postgres 161.35.20.76 port 52552 [preauth]
Failed password ...
show moreConnection closed by authenticating user postgres 161.35.20.76 port 52552 [preauth]
Failed password for root from 161.35.20.76 port 52568 ssh2
Connection closed by authenticating user root 161.35.20.76 port 52568 [preauth]
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
propolis: 161.35.20.76 - 17 event(s) across 1 category since 2026-10-15T03:54:37.479237+00:00, curre ...
show morepropolis: 161.35.20.76 - 17 event(s) across 1 category since 2026-10-15T03:54:37.479237+00:00, current score 98.7
show less
propolis: 161.35.20.76 - 17 event(s) across 1 category since 2026-10-15T03:54:37.479237+00:00, curre ...
show morepropolis: 161.35.20.76 - 17 event(s) across 1 category since 2026-10-15T03:54:37.479237+00:00, current score 6.2
show less
SSH login with test/123456 from SSH-2.0-Go. Activity focused on implant setup and persistence: check ...
show moreSSH login with test/123456 from SSH-2.0-Go. Activity focused on implant setup and persistence: checked CPU count, inspected running processes, searched for existing astats/kstats processes, and created files in /dev/shm and /tmp-style fallbacks using cat > w.sh, cat > astats, and cat > kstats. Added persistence via crontab, attempting an @reboot entry to run /dev/shm/w.sh with quoted arguments. Also tried to remove traces by deleting shell history and log files including /var/log/wtmp, secure, lastlog, and utmp-related files. No downloads, lateral movement, or additional payload artifacts were observed in this session.
show less
