This IP address has been reported a total of
97
times from
69 distinct
sources.
165.154.69.238 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 16 13:47:31 www4 sshd[2544596]: Failed password for root from 165.154.69.238 port 60940 ssh2
Oct ...
show moreOct 16 13:47:31 www4 sshd[2544596]: Failed password for root from 165.154.69.238 port 60940 ssh2
Oct 16 13:47:33 www4 sshd[2544600]: Invalid user steam from 165.154.69.238 port 60954
Oct 16 13:47:33 www4 sshd[2544600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.69.238
Oct 16 13:47:34 www4 sshd[2544600]: Failed password for invalid user steam from 165.154.69.238 port 60954 ssh2
Oct 16 13:47:36 www4 sshd[2544602]: Invalid user orangepi from 165.154.69.238 port 55024
...
show less
Oct 16 17:31:41 mail sshd[2563182]: Invalid user steam from 165.154.69.238 port 20522
Oct 16 17:31:4 ...
show moreOct 16 17:31:41 mail sshd[2563182]: Invalid user steam from 165.154.69.238 port 20522
Oct 16 17:31:42 mail sshd[2563184]: Invalid user orangepi from 165.154.69.238 port 20530
Oct 16 17:31:42 mail sshd[2563184]: Invalid user orangepi from 165.154.69.238 port 20530
Oct 16 17:31:44 mail sshd[2563186]: Invalid user ubuntu from 165.154.69.238 port 20536
Oct 16 17:31:44 mail sshd[2563186]: Invalid user ubuntu from 165.154.69.238 port 20536
...
show less
2026-10-16T15:38:20.370494+00:00 scw-zen-shannon sshd-session[17671]: Invalid user steam from 165.15 ...
show more2026-10-16T15:38:20.370494+00:00 scw-zen-shannon sshd-session[17671]: Invalid user steam from 165.154.69.238 port 11678
2026-10-16T15:38:21.382860+00:00 scw-zen-shannon sshd-session[17673]: Invalid user orangepi from 165.154.69.238 port 11686
2026-10-16T15:38:22.380314+00:00 scw-zen-shannon sshd-session[17675]: Invalid user ubuntu from 165.154.69.238 port 11694
...
show less
2026-10-16T15:34:06.795998+00:00 scw-871879 sshd[468496]: Invalid user steam from 165.154.69.238 por ...
show more2026-10-16T15:34:06.795998+00:00 scw-871879 sshd[468496]: Invalid user steam from 165.154.69.238 port 54792
2026-10-16T15:34:07.989923+00:00 scw-871879 sshd[468498]: Invalid user orangepi from 165.154.69.238 port 54794
2026-10-16T15:34:09.164248+00:00 scw-871879 sshd[468500]: User ubuntu from 165.154.69.238 not allowed because none of user's groups are listed in AllowGroups
2026-10-16T15:34:11.550092+00:00 scw-871879 sshd[468506]: Invalid user a from 165.154.69.238 port 54826
2026-10-16T15:34:12.754506+00:00 scw-871879 sshd[468508]: User ubuntu from 165.154.69.238 not allowed because none of user's groups are listed in AllowGroups
...
show less
2026-10-16T15:09:29.946891+00:00 scw-determined-maxwell sshd[18366]: Invalid user steam from 165.154 ...
show more2026-10-16T15:09:29.946891+00:00 scw-determined-maxwell sshd[18366]: Invalid user steam from 165.154.69.238 port 59788
2026-10-16T15:09:31.757247+00:00 scw-determined-maxwell sshd[18368]: Invalid user orangepi from 165.154.69.238 port 59792
2026-10-16T15:09:35.204194+00:00 scw-determined-maxwell sshd[18374]: Invalid user a from 165.154.69.238 port 61390
...
show less
Single SSH session used a brute-forced/login attempt with credential ubuntu/36#=s@2#V4+!Kru and SSH- ...
show moreSingle SSH session used a brute-forced/login attempt with credential ubuntu/36#=s@2#V4+!Kru and SSH-2.0-Go client. After login, the actor checked CPU count and running processes, then searched for competing instances of astats/kstats. They attempted persistence by reading crontab and appending an @reboot entry for /dev/shm/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". They created/executed /dev/shm/w.sh and attempted to write files named astats and kstats in /dev/shm, /tmp, /var/run, /mnt, /root, or /. They also issued cleanup commands to remove shell history and log files including /var/run/utmp, /var/run/wtmp, /var/log/lastlog, /home/yum.log, /var/log/wtmp, and /var/log/secure. No downloads or lateral movement were observed.
show less
propolis: 165.154.69.238 - 16 event(s) across 1 category since 2026-10-16T14:32:56.483048+00:00, cur ...
show morepropolis: 165.154.69.238 - 16 event(s) across 1 category since 2026-10-16T14:32:56.483048+00:00, current score 88.7
show less
Sustained failed SSH authentication attempts recorded by a honeypot sensor network.
Threat score: 12 ...
show moreSustained failed SSH authentication attempts recorded by a honeypot sensor network.
Threat score: 12/100 (info) | Phase: reconnaissance (pre-auth probing / scanning)
Failed auth: 74 (6 bad password, 68 invalid user) | 0 success | 133 total SSH log events | seen on 1 sensor(s)
Origin: Hong Kong (HK) | AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED | datacenter | 165.154.69.0/24
First seen: 2026-10-16 07:32:03 UTC | Last seen: 2026-10-16 08:31:45 UTC
Source: Linux OpenSSH journalctl telemetry, multi-sensor CERT honeypot.
show less
Oct 16 08:26:45 dabeau sshd[30800]: Invalid user deploy from 165.154.69.238 port 49466
Oct 16 08:26: ...
show moreOct 16 08:26:45 dabeau sshd[30800]: Invalid user deploy from 165.154.69.238 port 49466
Oct 16 08:26:45 dabeau sshd[30800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.154.69.238
Oct 16 08:26:47 dabeau sshd[30800]: Failed password for invalid user deploy from 165.154.69.238 port 49466 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-10-16T07:58:28.984895+00:00 scw-871879 sshd[454136]: Invalid user deploy from 165.154.69.238 po ...
show more2026-10-16T07:58:28.984895+00:00 scw-871879 sshd[454136]: Invalid user deploy from 165.154.69.238 port 17434
2026-10-16T07:58:32.516274+00:00 scw-871879 sshd[454142]: User ubuntu from 165.154.69.238 not allowed because none of user's groups are listed in AllowGroups
2026-10-16T07:58:33.702161+00:00 scw-871879 sshd[454144]: Invalid user minecraft from 165.154.69.238 port 17456
2026-10-16T07:58:36.081607+00:00 scw-871879 sshd[454148]: Invalid user testuser from 165.154.69.238 port 49422
2026-10-16T07:58:37.254076+00:00 scw-871879 sshd[454150]: Invalid user ubnt from 165.154.69.238 port 49430
...
show less
Oct 16 09:55:46 ouranos sshd[434138]: Invalid user deploy from 165.154.69.238 port 34928
Oct 16 09:5 ...
show moreOct 16 09:55:46 ouranos sshd[434138]: Invalid user deploy from 165.154.69.238 port 34928
Oct 16 09:55:48 ouranos sshd[434177]: Invalid user admin from 165.154.69.238 port 34950
Oct 16 09:55:49 ouranos sshd[434191]: Invalid user ubuntu from 165.154.69.238 port 34954
...
show less
Brute-Force
SSH
Showing 1 to
15
of 97 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩