Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Nov 11 08:18:11 vmi2194164 sshd[3960004]: Failed password for root from 174.245.80.177 port 6114 ssh2 Nov 11 08:18:38 vmi2194164 sshd[3960188]: Invalid user todd from 174.245.80.177 port 9994
2026-11-11T04:35:09.673802+01:00 vmi913100 sshd[2010710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.245.80.177 user=root
2026-11-11T04:35:12.117684+01:00 vmi913100 sshd[2010710]: Failed password for ...
show more2026-11-11T04:35:09.673802+01:00 vmi913100 sshd[2010710]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.245.80.177 user=root
2026-11-11T04:35:12.117684+01:00 vmi913100 sshd[2010710]: Failed password for root from 174.245.80.177 port 3791 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-11-11T03:52:30.894844+01:00 mail sshd[2313434]: Invalid user qing from 174.245.80.177 port 5614
2026-11-11T03:53:35.557932+01:00 mail sshd[2313749]: Invalid user oracle from 174.245.80.177 port 3806
2026-11-11T03:53:37.182906+01:00 mail sshd[231 ...
show more2026-11-11T03:52:30.894844+01:00 mail sshd[2313434]: Invalid user qing from 174.245.80.177 port 5614
2026-11-11T03:53:35.557932+01:00 mail sshd[2313749]: Invalid user oracle from 174.245.80.177 port 3806
2026-11-11T03:53:37.182906+01:00 mail sshd[2313751]: Invalid user nvp from 174.245.80.177 port 6135
...
show less
2026-11-10T23:45:09.117977+01:00 prod-02 sshd[2254648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.245.80.177 user=root
2026-11-10T23:45:10.846287+01:00 prod-02 sshd[2254648]: Failed password for root ...
show more2026-11-10T23:45:09.117977+01:00 prod-02 sshd[2254648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.245.80.177 user=root
2026-11-10T23:45:10.846287+01:00 prod-02 sshd[2254648]: Failed password for root from 174.245.80.177 port 8985 ssh2
...
show less
Brute-Force
SSH
Anonymous
Nov 5 22:28:20 fell sshd[3942674]: User root from 174.245.80.177 not allowed because not listed in AllowUsers
Nov 5 22:28:49 fell sshd[3942676]: Invalid user support from 174.245.80.177 port 9990
Nov 10 21:04:18 fell sshd[728161]: User root from 17 ...
show moreNov 5 22:28:20 fell sshd[3942674]: User root from 174.245.80.177 not allowed because not listed in AllowUsers
Nov 5 22:28:49 fell sshd[3942676]: Invalid user support from 174.245.80.177 port 9990
Nov 10 21:04:18 fell sshd[728161]: User root from 174.245.80.177 not allowed because not listed in AllowUsers
...
show less
2026-11-10T15:09:06.321160+01:00 v30393 sshd[2584938]: Connection closed by 174.245.80.177 port 8986 [preauth]
2026-11-10T15:11:38.012271+01:00 v30393 sshd[2585081]: Connection closed by authenticating user root 174.245.80.177 port 5625 [preauth]
...
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.
2026-11-10T12:59:11.452222+00:00 shrapnelnet sshd-session[3623190]: Invalid user mongodb from 174.245.80.177 port 6595
2026-11-10T12:59:22.636551+00:00 shrapnelnet sshd-session[3623227]: Connection from 174.245.80.177 port 1780 on 128.140.106.165 por ...
show more2026-11-10T12:59:11.452222+00:00 shrapnelnet sshd-session[3623190]: Invalid user mongodb from 174.245.80.177 port 6595
2026-11-10T12:59:22.636551+00:00 shrapnelnet sshd-session[3623227]: Connection from 174.245.80.177 port 1780 on 128.140.106.165 port 420 rdomain ""
2026-11-10T12:59:23.128216+00:00 shrapnelnet sshd-session[3623227]: Invalid user testuser from 174.245.80.177 port 1780
2026-11-10T12:59:37.203368+00:00 shrapnelnet sshd-session[3623355]: Connection from 174.245.80.177 port 6112 on 128.140.106.165 port 420 rdomain ""
2026-11-10T12:59:37.691120+00:00 shrapnelnet sshd-session[3623355]: Invalid user colord from 174.245.80.177 port 6112
...
show less
Brute-Force
SSH
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown