This IP address has been reported a total of
155
times from
81 distinct
sources.
202.96.16.48 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
Anonymous
"Unauthorized connection attempt on SSHD detected"
2026-07-23T01:23:17.113009+02:00 srv03 sshd[236247]: Invalid user shudis from 202.96.16.48 port 3547 ...
show more2026-07-23T01:23:17.113009+02:00 srv03 sshd[236247]: Invalid user shudis from 202.96.16.48 port 3547
2026-07-23T01:24:11.241970+02:00 srv03 sshd[236380]: Invalid user pc from 202.96.16.48 port 3548
2026-07-23T01:25:02.994195+02:00 srv03 sshd[236496]: Invalid user ctf from 202.96.16.48 port 3549
2026-07-23T01:26:39.964124+02:00 srv03 sshd[236897]: Invalid user baiyc from 202.96.16.48 port 3551
2026-07-23T01:27:23.079990+02:00 srv03 sshd[237010]: Invalid user renyu from 202.96.16.48 port 3552
...
show less
2026-07-21T18:41:30.454259+01:00 vegeta sshd[30615]: Invalid user hotlab from 202.96.16.48 port 3314 ...
show more2026-07-21T18:41:30.454259+01:00 vegeta sshd[30615]: Invalid user hotlab from 202.96.16.48 port 3314
2026-07-21T18:42:26.976993+01:00 vegeta sshd[30625]: Invalid user radio from 202.96.16.48 port 3315
show less
2026-07-21T04:10:03.785896+00:00 loadbal sshd[2819671]: User root from 202.96.16.48 not allowed beca ...
show more2026-07-21T04:10:03.785896+00:00 loadbal sshd[2819671]: User root from 202.96.16.48 not allowed because not listed in AllowUsers
2026-07-21T04:10:51.331219+00:00 loadbal sshd[2819676]: Invalid user taggers from 202.96.16.48 port 2593
2026-07-21T04:11:41.425422+00:00 loadbal sshd[2819697]: Invalid user yaojun from 202.96.16.48 port 2594
...
show less
Brute-Force
SSH
Anonymous
Jul 20 07:48:19 server21 sshd-session[15225]: User root from 202.96.16.48 not allowed because not li ...
show moreJul 20 07:48:19 server21 sshd-session[15225]: User root from 202.96.16.48 not allowed because not listed in AllowUsers
Jul 20 07:49:07 server21 sshd-session[15279]: Invalid user career from 202.96.16.48 port 2368
Jul 20 07:49:56 server21 sshd-session[15302]: Invalid user sftp from 202.96.16.48 port 2369
Jul 20 07:51:26 server21 sshd-session[15802]: Invalid user huawei from 202.96.16.48 port 2370
Jul 20 07:52:09 server21 sshd-session[15811]: User root from 202.96.16.48 not allowed because not listed in AllowUsers
...
show less
Jun 25 00:50:44 routing0301 sshd[2670899]: pam_unix(sshd:auth): authentication failure; logname= uid ...
show moreJun 25 00:50:44 routing0301 sshd[2670899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.96.16.48 user=root
Jun 25 00:50:47 routing0301 sshd[2670899]: Failed password for root from 202.96.16.48 port 2224 ssh2
Jun 25 00:51:38 routing0301 sshd[2670906]: Invalid user server from 202.96.16.48 port 2225
...
show less
(sshd) Failed SSH login from 202.96.16.48 (CN/China/-)
Brute-Force
SSH
Anonymous
2026-06-24T08:49:46.578759+02:00 smvps001 sshd-session[18950]: Connection closed by 202.96.16.48 por ...
show more2026-06-24T08:49:46.578759+02:00 smvps001 sshd-session[18950]: Connection closed by 202.96.16.48 port 10837 [preauth]
2026-06-24T08:53:08.724331+02:00 smvps001 sshd-session[19089]: Unable to negotiate with 202.96.16.48 port 10843: no matching cipher found. Their offer: arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,[email protected],3des-cbc,[email protected] [preauth]
2026-06-24T08:54:19.248271+02:00 smvps001 sshd-session[19110]: Unable to negotiate with 202.96.16.48 port 10844: no matching cipher found. Their offer: arcfour,arcfour128,arcfour256,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,[email protected],3des-cbc,[email protected] [preauth]
...
show less
Blocked by fail2ban on cVPS [/tcp]
Source Port:
TTL:
Packet Length:
TOS:
Analyzed by https://ip ...
show moreBlocked by fail2ban on cVPS [/tcp]
Source Port:
TTL:
Packet Length:
TOS:
Analyzed by https://ip.wiredalter.com
show less
2026-03-28T08:49:39.292716+03:30 codictive sshd[734445]: Invalid user test from 202.96.16.48 port 41 ...
show more2026-03-28T08:49:39.292716+03:30 codictive sshd[734445]: Invalid user test from 202.96.16.48 port 41111
2026-03-28T08:51:51.013010+03:30 codictive sshd[734465]: Invalid user admin from 202.96.16.48 port 41112
2026-03-28T08:53:35.952269+03:30 codictive sshd[734478]: Invalid user admin from 202.96.16.48 port 41113
...
show less
2026-03-28T02:27:53.823379+01:00 rserver.lirion.de sshd-session[622455]: Invalid user user from 202. ...
show more2026-03-28T02:27:53.823379+01:00 rserver.lirion.de sshd-session[622455]: Invalid user user from 202.96.16.48 port 56975
2026-03-28T02:28:35.450361+01:00 rserver.lirion.de sshd-session[622793]: Invalid user user from 202.96.16.48 port 56976
2026-03-28T02:29:18.415607+01:00 rserver.lirion.de sshd-session[623074]: Invalid user ubuntu from 202.96.16.48 port 56977
2026-03-28T02:30:02.260292+01:00 rserver.lirion.de sshd-session[623238]: Invalid user go from 202.96.16.48 port 56978
2026-03-28T02:38:51.953761+01:00 rserver.lirion.de sshd-session[627108]: Invalid user deploy from 202.96.16.48 port 56982
...
show less
2026-03-27T21:13:20.205078+01:00 rserver.lirion.de sshd-session[2214558]: Invalid user test from 202 ...
show more2026-03-27T21:13:20.205078+01:00 rserver.lirion.de sshd-session[2214558]: Invalid user test from 202.96.16.48 port 56606
2026-03-27T21:16:48.883570+01:00 rserver.lirion.de sshd-session[2215851]: Invalid user deploy from 202.96.16.48 port 56610
2026-03-27T21:17:40.223104+01:00 rserver.lirion.de sshd-session[2216109]: Invalid user ubuntu from 202.96.16.48 port 56611
2026-03-27T21:19:24.738309+01:00 rserver.lirion.de sshd-session[2217202]: Invalid user user from 202.96.16.48 port 56613
2026-03-27T21:22:52.155596+01:00 rserver.lirion.de sshd-session[2218843]: Invalid user test from 202.96.16.48 port 56617
...
show less
Brute-Force
SSH
Showing 1 to
15
of 155 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩