Log in to view charts and search reports for this IP.
Log In
Top Reporter Countries (Last 60 Days)
Example preview
Report Categories (Last 60 Days)
Example preview
Reports Activity
Example preview
Account required for the enhanced features
Log inSign up
IP Abuse Reports for 222.252.166.168:
This IP address has been reported a total of
89
times from
67 distinct
sources.
222.252.166.168 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 23
reports;
United States of America
with 19
reports;
United Kingdom of Great Britain and Northern Ireland
with 11
reports.
The most common categories in these recent reports were:
SSH
85
times;
Brute-Force
82
times;
Port Scan
4
times;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Sep 5 18:27:25 wp sshd[1714943]: Invalid user cerberus from 222.252.166.168 port 51110
Sep 5 18:27 ...
show moreSep 5 18:27:25 wp sshd[1714943]: Invalid user cerberus from 222.252.166.168 port 51110
Sep 5 18:27:27 wp sshd[1714943]: Failed password for invalid user cerberus from 222.252.166.168 port 51110 ssh2
Sep 5 18:29:03 wp sshd[1715305]: Invalid user pm2 from 222.252.166.168 port 59790
...
show less
2026-09-05T13:03:54.152568+02:00 host.nilsbossaller.de sshd[152995]: pam_unix(sshd:auth): authentica ...
show more2026-09-05T13:03:54.152568+02:00 host.nilsbossaller.de sshd[152995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.252.166.168
2026-09-05T13:03:56.513941+02:00 host.nilsbossaller.de sshd[152995]: Failed password for invalid user cat from 222.252.166.168 port 54546 ssh2
2026-09-05T13:03:57.648329+02:00 host.nilsbossaller.de sshd[152995]: Connection closed by invalid user cat 222.252.166.168 port 54546 [preauth]
...
show less
Sep 5 05:23:01 mailman sshd[25698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eui ...
show moreSep 5 05:23:01 mailman sshd[25698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.252.166.168
Sep 5 05:23:04 mailman sshd[25698]: Failed password for invalid user cat from 222.252.166.168 port 40968 ssh2
Sep 5 05:23:04 mailman sshd[25698]: Connection closed by 222.252.166.168 port 40968 [preauth]
show less
Brute-Force
SSH
Anonymous
222.252.166.168 (VN/Vietnam/-), 7 distributed sshd attacks on account [cat] in the last 3600 secs; P ...
show more222.252.166.168 (VN/Vietnam/-), 7 distributed sshd attacks on account [cat] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 5 06:11:21 server5 sshd[18974]: Invalid user cat from 222.252.166.168
Sep 5 06:11:23 server5 sshd[18974]: Failed password for invalid user cat from 222.252.166.168 port 51456 ssh2
Sep 5 06:16:00 server5 sshd[23547]: Invalid user cat from 69.175.42.65
Sep 5 06:21:47 server5 sshd[29983]: Invalid user cat from 210.1.59.163
Sep 5 06:16:05 server5 sshd[23547]: Failed password for invalid user cat from 69.175.42.65 port 51668 ssh2
Sep 5 06:15:05 server5 sshd[21341]: Invalid user cat from 154.16.115.33
Sep 5 06:15:11 server5 sshd[21341]: Failed password for invalid user cat from 154.16.115.33 port 44430 ssh2
IP Addresses Blocked:
show less
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-09-04 20:14 to 2026-09-05 06:03 UTC | 2 sessions | 10 events | SSH (port 22)
Attack chain:
1. 2 credential attempts: audit/Passw0rd, postmaster/password138.197.198.127
2. Shell access obtained; 1 distinct command executed: uname -a 2>/dev/null
Signatures: Host Reconnaissance Commands
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/222.252.166.168.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Sep 5 05:14:28 s1-jellyfish sshd[3232023]: Invalid user postmaster from 222.252.166.168 port 58932
...
show moreSep 5 05:14:28 s1-jellyfish sshd[3232023]: Invalid user postmaster from 222.252.166.168 port 58932
...
show less
Sep 4 18:17:27 mc sshd[2892331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 ...
show moreSep 4 18:17:27 mc sshd[2892331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.252.166.168
Sep 4 18:17:29 mc sshd[2892331]: Failed password for invalid user audit from 222.252.166.168 port 49802 ssh2
Sep 5 04:06:37 mc sshd[4115526]: Invalid user postmaster from 222.252.166.168 port 33338
...
show less
