This IP address has been reported a total of
63
times from
60 distinct
sources.
167.99.85.152 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Detected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: honeypot_ssh. So ...
show moreDetected by SiberKapan threat intelligence platform (siberkapan.org). Attack types: honeypot_ssh. Sources: honeypot. First seen: 2026-10-16. Risk score: 30/100.
show less
Automated SSH brute-force attack detected. The IP repeatedly attempted to authenticate to port 22 us ...
show moreAutomated SSH brute-force attack detected. The IP repeatedly attempted to authenticate to port 22 using multiple usernames and password guesses within a short timeframe.
show less
SSH Brute force: 15 attempts were recorded from 167.99.85.152
2026-10-17T00:37:48+02:00 Connection c ...
show moreSSH Brute force: 15 attempts were recorded from 167.99.85.152
2026-10-17T00:37:48+02:00 Connection closed by authenticating user root 167.99.85.152 port 58030 [preauth]
2026-10-17T00:40:35+02:00 Connection closed by authenticating user root 167.99.85.152 port 50280 [preauth]
2026-10-17T00:43:27+02:00 Connection closed by authenticating user root 167.99.85.152 port 44420 [preauth]
2026-10-17T00:38:06+02:00 Connection closed by authenticating user root 167.99.85.152 port 48892 [preauth]
2026-10-17T00:40:53+02:00 Connection closed by authenticating user root 167.99.85.152 port 57894 [preauth]
2026-10-17T00:43:45+02:00 Connection closed by authenticating user root 167.99.85.152 port 53490 [preauth]
2026-10-17T00:37:36+02:00 Connection closed by authenticating user root 167.99.85.152 port 58266 [preauth]
2026-10-17T00:40:23+02:00 Connection closed by authenticating user root 167.99.85.152 por
show less
Oct 16 16:43:52 mortgagebase sshd[2716]: Failed password for root from 167.99.85.152 port 44242 ssh2 ...
show moreOct 16 16:43:52 mortgagebase sshd[2716]: Failed password for root from 167.99.85.152 port 44242 ssh2
Oct 16 16:46:33 mortgagebase sshd[2742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.85.152 user=root
Oct 16 16:46:35 mortgagebase sshd[2742]: Failed password for root from 167.99.85.152 port 35456 ssh2
Oct 16 16:49:20 mortgagebase sshd[2780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.85.152 user=root
Oct 16 16:49:22 mortgagebase sshd[2780]: Failed password for root from 167.99.85.152 port 38018 ssh2
...
show less
2026-10-17T00:37:30.978919+02:00 serengeti sshd-session[2340253]: Failed password for root from 167. ...
show more2026-10-17T00:37:30.978919+02:00 serengeti sshd-session[2340253]: Failed password for root from 167.99.85.152 port 32952 ssh2
2026-10-17T00:40:17.969253+02:00 serengeti sshd-session[2340938]: Failed password for root from 167.99.85.152 port 60124 ssh2
2026-10-17T00:43:09.176595+02:00 serengeti sshd-session[2341260]: Failed password for root from 167.99.85.152 port 56986 ssh2
2026-10-17T00:45:54.030454+02:00 serengeti sshd-session[2341781]: Failed password for root from 167.99.85.152 port 50922 ssh2
2026-10-17T00:48:38.479213+02:00 serengeti sshd-session[2342045]: Failed password for root from 167.99.85.152 port 39432 ssh2
...
show less
This source was blocked by Fail2Ban after repeated SSH login failures within a 10-minute detection w ...
show moreThis source was blocked by Fail2Ban after repeated SSH login failures within a 10-minute detection window. The server log documents rejected password authentication; these unsolicited attempts are consistent with SSH credential probing. The timestamped entries below are the observed evidence for this report. Local server addresses and attempted account names are redacted.
SSH log evidence (UTC):
2026-10-16 22:43:05Z sshd: Failed password for [account] from 167.99.85.152 port 47560 ssh2
2026-10-16 22:45:49Z sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.85.152 [account]
2026-10-16 22:45:50Z sshd: Failed password for [account] from 167.99.85.152 port 39070 ssh2
2026-10-16 22:48:33Z sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.85.152 [account]
2026-10-16 22:48:35Z sshd: Failed password for [account] from 167.99.85.152 port 51730 ssh2
show less