This IP address has been reported a total of
625
times from
162 distinct
sources.
185.222.138.254 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-05-19T06:33:24.321072+02:00 adycoaduanas sshd[1107246]: User root from 185.222.138.254 not allo ...
show more2026-05-19T06:33:24.321072+02:00 adycoaduanas sshd[1107246]: User root from 185.222.138.254 not allowed because not listed in AllowUsers
2026-05-19T09:34:44.524779+02:00 adycoaduanas sshd[1177371]: User root from 185.222.138.254 not allowed because not listed in AllowUsers
...
show less
May 19 08:52:41 smtp sshd[860183]: error: maximum authentication attempts exceeded for invalid user ...
show moreMay 19 08:52:41 smtp sshd[860183]: error: maximum authentication attempts exceeded for invalid user root from 185.222.138.254 port 44914 ssh2 [preauth]
...
show less
[fail2ban Auto Report] 2026-05-19T02:43:20.560639-04:00 alpha sshd-session[3826725]: error: maximum ...
show more[fail2ban Auto Report] 2026-05-19T02:43:20.560639-04:00 alpha sshd-session[3826725]: error: maximum authentication attempts exceeded for root from 185.222.138.254 port 43210 ssh2 [preauth]
...
show less
2026-05-17T20:41:53.826357+02:00 ns3150947 sshd-session[1787373]: Disconnected from authenticating u ...
show more2026-05-17T20:41:53.826357+02:00 ns3150947 sshd-session[1787373]: Disconnected from authenticating user root 185.222.138.254 port 56522 [preauth]
2026-05-18T05:52:54.019364+02:00 ns3150947 sshd-session[1997666]: Disconnected from authenticating user root 185.222.138.254 port 42014 [preauth]
2026-05-18T05:52:54.019364+02:00 ns3150947 sshd-session[1997666]: Disconnected from authenticating user root 185.222.138.254 port 42014 [preauth]
2026-05-19T08:33:39.914335+02:00 ns3150947 sshd-session[2611969]: Disconnected from authenticating user root 185.222.138.254 port 34136 [preauth]
...
show less
Honeypot hit: Brute-force attack detected on 22/SSH
• Credential used: root:undefined
• Number of lo ...
show moreHoneypot hit: Brute-force attack detected on 22/SSH
• Credential used: root:undefined
• Number of login attempts: 1
• Client: SSH-2.0-libssh2_1.11.0
• SSH key fingerprints: a1:77:99:29:e2:2f:fe:0f:0b:c1:76:55:2f:f6:e1:dd
show less
2026-05-19T00:57:55.576853+00:00 instance-20241105-1951 sshd[1826930]: Disconnected from authenticat ...
show more2026-05-19T00:57:55.576853+00:00 instance-20241105-1951 sshd[1826930]: Disconnected from authenticating user root 185.222.138.254 port 56008 [preauth]
...
show less
Hacking
Brute-Force
SSH
Showing 1 to
15
of 625 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩