This IP address has been reported a total of
52
times from
45 distinct
sources.
165.154.2.143 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 15
reports;
France
with 10
reports;
Germany
with 5
reports.
The most common categories in these recent reports were:
Brute-Force
43
times;
SSH
41
times;
Hacking
6
times;
Port Scan
4
times;
Exploited Host
1
time;
Other
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 12 06:04:03 sftp-cognizant-san-jose-1 sshd[419508]: pam_unix(sshd:auth): authentication failure; ...
show moreOct 12 06:04:03 sftp-cognizant-san-jose-1 sshd[419508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.2.143
Oct 12 06:04:05 sftp-cognizant-san-jose-1 sshd[419508]: Failed password for invalid user admin from 165.154.2.143 port 54108 ssh2
Oct 12 06:04:06 sftp-cognizant-san-jose-1 sshd[419510]: Invalid user postgres from 165.154.2.143 port 54112
...
show less
Used SSH login ubuntu/Test1234 via SSH-2.0-Go and executed a downloader/persistence chain. Created / ...
show moreUsed SSH login ubuntu/Test1234 via SSH-2.0-Go and executed a downloader/persistence chain. Created /dev/shm/w.sh, dropped files astats and kstats in writable locations, and added an @reboot crontab entry to run /dev/shm/w.sh "astats" "netai" "kstats" "ssh 2 az". Ran CPU enumeration with cat /proc/cpuinfo | grep processor | wc -l and process checks with ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10 plus ps aux | grep astats/kstats. Also attempted log/history cleanup: rm -rf .bash_history, /var/run/utmp, /var/run/wtmp, /var/log/lastlog, /home/yum.log, /var/log/wtmp, /var/log/secure. Searched common writable dirs and checked for existing astats/kstats processes. No lateral movement observed.
show less
2026-10-11T19:20:42.419472+00:00 instance-20250823-2358 sshd[2318176]: Invalid user deploy from 165. ...
show more2026-10-11T19:20:42.419472+00:00 instance-20250823-2358 sshd[2318176]: Invalid user deploy from 165.154.2.143 port 45436
2026-10-11T19:20:42.643128+00:00 instance-20250823-2358 sshd[2318176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.2.143
2026-10-11T19:20:44.534820+00:00 instance-20250823-2358 sshd[2318176]: Failed password for invalid user deploy from 165.154.2.143 port 45436 ssh2
2026-10-11T19:20:46.125320+00:00 instance-20250823-2358 sshd[2318252]: Invalid user www from 165.154.2.143 port 45444
2026-10-11T19:20:46.355287+00:00 instance-20250823-2358 sshd[2318252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.2.143
2026-10-11T19:20:48.131226+00:00 instance-20250823-2358 sshd[2318252]: Failed password for invalid user www from 165.154.2.143 port 45444 ssh2
...
show less
Brute-Force
SSH
Anonymous
SSH Brute Force (3 attempts). Evidence: sshd-session[31075]: Invalid user ubuntu from 165.154.2.143 ...
show moreSSH Brute Force (3 attempts). Evidence: sshd-session[31075]: Invalid user ubuntu from 165.154.2.143 port 58462;sshd-session[31075]: Connection closed by invalid user ubuntu 165.154.2.143 port 58462 [preauth]
show less
2026-10-11T14:43:25.519509+00:00 edge-obe-sto01.int.pdx.net.uk sshd[1793790]: Invalid user ubuntu fr ...
show more2026-10-11T14:43:25.519509+00:00 edge-obe-sto01.int.pdx.net.uk sshd[1793790]: Invalid user ubuntu from 165.154.2.143 port 36080
2026-10-11T14:43:26.858873+00:00 edge-obe-sto01.int.pdx.net.uk sshd[1793795]: Invalid user orangepi from 165.154.2.143 port 36088
2026-10-11T14:43:29.477796+00:00 edge-obe-sto01.int.pdx.net.uk sshd[1793799]: Invalid user ftp from 165.154.2.143 port 59604
...
show less
Fail2Ban automatic report:
SSH suspicious user names:
Oct 11 16:23:38 serw sshd[1779819]: Connection ...
show moreFail2Ban automatic report:
SSH suspicious user names:
Oct 11 16:23:38 serw sshd[1779819]: Connection closed by invalid user test 165.154.2.143 port 53514 [preauth]
show less
Brute-Force
SSH
Anonymous
Fail2ban (sshd jail): 2 failed SSH attempts from 165.154.2.143.
Brute-Force
SSH
Anonymous
2026-10-11T07:49:14.347587+02:00 devicedock sshd-session[256731]: Invalid user test from 165.154.2.1 ...
show more2026-10-11T07:49:14.347587+02:00 devicedock sshd-session[256731]: Invalid user test from 165.154.2.143 port 54316
2026-10-11T07:49:15.356662+02:00 devicedock sshd-session[256733]: User root from 165.154.2.143 not allowed because not listed in AllowUsers
2026-10-11T07:49:16.375339+02:00 devicedock sshd-session[256735]: Invalid user ec2-user from 165.154.2.143 port 54328
...
show less
Oct 10 21:18:39 ismay sshd[76194]: Failed password for invalid user developer from 165.154.2.143 por ...
show moreOct 10 21:18:39 ismay sshd[76194]: Failed password for invalid user developer from 165.154.2.143 port 59464 ssh2
Oct 10 21:18:42 ismay sshd[76197]: Invalid user ftpuser from 165.154.2.143 port 42724
Oct 10 21:18:42 ismay sshd[76197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.2.143
Oct 10 21:18:45 ismay sshd[76197]: Failed password for invalid user ftpuser from 165.154.2.143 port 42724 ssh2
Oct 10 21:18:46 ismay sshd[76200]: Invalid user test from 165.154.2.143 port 42734
...
show less
