Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Web app exploit probe on a honeypot: requested known vulnerability paths (wp-login.php, .env, .git ...).
Requests within an hour: 1 on 1 host(s)
User agent: Mozilla/5.0
Requested, e.g.:
- [REDACTED]/wp-login.php
2026-02-23T12:47:37.510187+00:00 instance sshd-session[434372]: Invalid user centos from 178.128.160.41 port 47056
2026-02-23T12:48:06.313500+00:00 instance sshd-session[434375]: Invalid user centos from 178.128.160.41 port 42494
2026-02-23T12:48:35. ...
show more2026-02-23T12:47:37.510187+00:00 instance sshd-session[434372]: Invalid user centos from 178.128.160.41 port 47056
2026-02-23T12:48:06.313500+00:00 instance sshd-session[434375]: Invalid user centos from 178.128.160.41 port 42494
2026-02-23T12:48:35.537987+00:00 instance sshd-session[434377]: Invalid user centos from 178.128.160.41 port 46972
2026-02-23T12:49:03.573150+00:00 instance sshd-session[434382]: Invalid user centos from 178.128.160.41 port 46722
2026-02-23T12:49:31.546683+00:00 instance sshd-session[434396]: Invalid user centos from 178.128.160.41 port 32804
...
show less
2026-02-23T12:29:59.361032+00:00 instance sshd-session[434194]: Invalid user admin from 178.128.160.41 port 38012
2026-02-23T12:30:31.147277+00:00 instance sshd-session[434197]: Invalid user admin from 178.128.160.41 port 41974
2026-02-23T12:31:02.30 ...
show more2026-02-23T12:29:59.361032+00:00 instance sshd-session[434194]: Invalid user admin from 178.128.160.41 port 38012
2026-02-23T12:30:31.147277+00:00 instance sshd-session[434197]: Invalid user admin from 178.128.160.41 port 41974
2026-02-23T12:31:02.300993+00:00 instance sshd-session[434208]: Invalid user admin from 178.128.160.41 port 50454
2026-02-23T12:31:32.531020+00:00 instance sshd-session[434224]: Invalid user admin from 178.128.160.41 port 51436
2026-02-23T12:32:02.726685+00:00 instance sshd-session[434226]: Invalid user admin from 178.128.160.41 port 33538
...
show less
Brute-Force
SSH
Anonymous
Feb 23 07:18:29 server1 sshd[833297]: Connection closed by authenticating user root 178.128.160.41 port 53122 [preauth]
Feb 23 07:19:06 server1 sshd[833300]: Connection closed by authenticating user root 178.128.160.41 port 37914 [preauth]
Feb 23 07: ...
show moreFeb 23 07:18:29 server1 sshd[833297]: Connection closed by authenticating user root 178.128.160.41 port 53122 [preauth]
Feb 23 07:19:06 server1 sshd[833300]: Connection closed by authenticating user root 178.128.160.41 port 37914 [preauth]
Feb 23 07:19:43 server1 sshd[833302]: Connection closed by authenticating user root 178.128.160.41 port 41896 [preauth]
...
show less
2026-02-23T07:18:10.888903-05:00 ip-172-31-76-241 sshd[3312358]: Connection closed by authenticating user root 178.128.160.41 port 50082 [preauth]
2026-02-23T07:18:47.380964-05:00 ip-172-31-76-241 sshd[3321623]: Connection closed by authenticating us ...
show more2026-02-23T07:18:10.888903-05:00 ip-172-31-76-241 sshd[3312358]: Connection closed by authenticating user root 178.128.160.41 port 50082 [preauth]
2026-02-23T07:18:47.380964-05:00 ip-172-31-76-241 sshd[3321623]: Connection closed by authenticating user root 178.128.160.41 port 60016 [preauth]
2026-02-23T07:19:24.417114-05:00 ip-172-31-76-241 sshd[3330500]: Connection closed by authenticating user root 178.128.160.41 port 45156 [preauth]
...
show less