This IP address has been reported a total of
37
times from
32 distinct
sources.
2.28.134.245 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[09:31] Attempted telnet login with credentials root:s****y
Brute-Force
IoT Targeted
Anonymous
2026-09-27T09:23:04.456064+00:00 ubuntu sshd[1004724]: Failed password for invalid user admin from 2 ...
show more2026-09-27T09:23:04.456064+00:00 ubuntu sshd[1004724]: Failed password for invalid user admin from 2.28.134.245 port 40086 ssh2
2026-09-27T09:23:06.143415+00:00 ubuntu sshd[1004724]: Connection closed by invalid user admin 2.28.134.245 port 40086 [preauth]
2026-09-27T09:23:36.347950+00:00 ubuntu sshd[1004760]: Invalid user user from 2.28.134.245 port 45584
2026-09-27T09:23:36.350367+00:00 ubuntu sshd[1004760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.28.134.245
2026-09-27T09:23:38.279058+00:00 ubuntu sshd[1004760]: Failed password for invalid user user from 2.28.134.245 port 45584 ssh2
...
show less
Report 2710229 with IP 3757796 for SSH brute-force attack by source 3752454 via ssh-honeypot/0.2.1+h ...
show moreReport 2710229 with IP 3757796 for SSH brute-force attack by source 3752454 via ssh-honeypot/0.2.1+http
show less
Brute-Force
SSH
Anonymous
2026-09-27T17:07:42.382884+08:00 kltw-debian sshd[397841]: Invalid user admin from 2.28.134.245 port ...
show more2026-09-27T17:07:42.382884+08:00 kltw-debian sshd[397841]: Invalid user admin from 2.28.134.245 port 58156
2026-09-27T17:07:42.693471+08:00 kltw-debian sshd[397841]: Connection closed by invalid user admin 2.28.134.245 port 58156 [preauth]
2026-09-27T17:08:14.184459+08:00 kltw-debian sshd[397843]: Invalid user user from 2.28.134.245 port 40932
2026-09-27T17:08:14.481779+08:00 kltw-debian sshd[397843]: Connection closed by invalid user user 2.28.134.245 port 40932 [preauth]
2026-09-27T17:08:46.403069+08:00 kltw-debian sshd[397845]: Connection closed by authenticating user root 2.28.134.245 port 38450 [preauth]
...
show less
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS ...
show moreVerified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS=23 | HITS=2 | IPSET=ADD | FIRST=2026-09-27 11:07:43 | LAST=2026-09-27 11:07:43. Last seen 2026-09-27 11:07:43.
show less