Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-11-08T13:58:52.395768+08:00 netcup-llb sshd[2115112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.130.39.66 user=root
2026-11-08T13:58:54.649915+08:00 netcup-llb sshd[2115112]: Failed password for ...
show more2026-11-08T13:58:52.395768+08:00 netcup-llb sshd[2115112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.130.39.66 user=root
2026-11-08T13:58:54.649915+08:00 netcup-llb sshd[2115112]: Failed password for root from 27.130.39.66 port 42434 ssh2
2026-11-08T13:59:21.922012+08:00 netcup-llb sshd[2115456]: Invalid user jefferson from 27.130.39.66 port 54080
2026-11-08T13:59:22.103763+08:00 netcup-llb sshd[2115456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.130.39.66
2026-11-08T13:59:24.477882+08:00 netcup-llb sshd[2115456]: Failed password for invalid user jefferson from 27.130.39.66 port 54080 ssh2
...
show less
Brute-Force
SSH
Anonymous
Nov 8 06:19:56 server21 sshd-session[29613]: User root from 27.130.39.66 not allowed because not listed in AllowUsers
Nov 8 06:20:12 server21 sshd-session[29657]: User ftpuser from 27.130.39.66 not allowed because not listed in AllowUsers
Nov 8 06 ...
show moreNov 8 06:19:56 server21 sshd-session[29613]: User root from 27.130.39.66 not allowed because not listed in AllowUsers
Nov 8 06:20:12 server21 sshd-session[29657]: User ftpuser from 27.130.39.66 not allowed because not listed in AllowUsers
Nov 8 06:20:29 server21 sshd-session[29661]: Invalid user user0 from 27.130.39.66 port 37930
Nov 8 06:20:45 server21 sshd-session[29689]: User root from 27.130.39.66 not allowed because not listed in AllowUsers
Nov 8 06:21:10 server21 sshd-session[29701]: User root from 27.130.39.66 not allowed because not listed in AllowUsers
...
show less
2026-11-08T03:29:18.946870+01:00 v30393 sshd[2378623]: Connection closed by 27.130.39.66 port 38692 [preauth]
2026-11-08T03:32:28.543523+01:00 v30393 sshd[2378742]: Connection closed by authenticating user root 27.130.39.66 port 45240 [preauth]
...
Nov 7 19:40:57 mail sshd[3012378]: Invalid user user from 27.130.39.66 port 54568
Nov 7 19:40:57 mail sshd[3012378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.130.39.66
Nov 7 19:40:59 mail sshd[301 ...
show moreNov 7 19:40:57 mail sshd[3012378]: Invalid user user from 27.130.39.66 port 54568
Nov 7 19:40:57 mail sshd[3012378]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.130.39.66
Nov 7 19:40:59 mail sshd[3012378]: Failed password for invalid user user from 27.130.39.66 port 54568 ssh2
...
show less
2026-11-07T14:04:19.530127 vmi2293746.contaboserver.net sshd[73203]: Invalid user stu03 from 27.130.39.66 port 56984
2026-11-07T14:04:35.114169 vmi2293746.contaboserver.net sshd[73215]: Invalid user esadmin from 27.130.39.66 port 60686
...
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.
2026-11-07T10:10:56.591669-03:00 vmi2819241 sshd-session[2158233]: Failed password for invalid user root from 27.130.39.66 port 27576 ssh2
2026-11-07T10:11:12.090079-03:00 vmi2819241 sshd-session[2158343]: Invalid user linux from 27.130.39.66 port 39 ...
show more2026-11-07T10:10:56.591669-03:00 vmi2819241 sshd-session[2158233]: Failed password for invalid user root from 27.130.39.66 port 27576 ssh2
2026-11-07T10:11:12.090079-03:00 vmi2819241 sshd-session[2158343]: Invalid user linux from 27.130.39.66 port 39396
2026-11-07T10:11:12.302242-03:00 vmi2819241 sshd-session[2158343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.130.39.66
2026-11-07T10:11:13.986728-03:00 vmi2819241 sshd-session[2158343]: Failed password for invalid user linux from 27.130.39.66 port 39396 ssh2
...
show less
2026-11-07T13:37:40.609350+01:00 server01vp.huettersen.org sshd-session[1783244]: Invalid user stu04 from 27.130.39.66 port 40638
2026-11-07T13:38:41.392300+01:00 server01vp.huettersen.org sshd-session[1783414]: Invalid user wangwei from 27.130.39.66 ...
show more2026-11-07T13:37:40.609350+01:00 server01vp.huettersen.org sshd-session[1783244]: Invalid user stu04 from 27.130.39.66 port 40638
2026-11-07T13:38:41.392300+01:00 server01vp.huettersen.org sshd-session[1783414]: Invalid user wangwei from 27.130.39.66 port 52624
2026-11-07T13:38:45.899801+01:00 server01vp.huettersen.org sshd-session[1783417]: Invalid user suporte from 27.130.39.66 port 45840
2026-11-07T13:38:53.983386+01:00 server01vp.huettersen.org sshd-session[1783449]: Invalid user student2 from 27.130.39.66 port 40196
2026-11-07T13:38:56.395525+01:00 server01vp.huettersen.org sshd-session[1783452]: Invalid user ts3 from 27.130.39.66 port 40204
show less
Brute-Force
SSH
Anonymous
2026-11-07T11:55:55.798151+01:00 ns2 sshd[7491]: Invalid user oracle from 27.130.39.66 port 53986
2026-11-07T11:56:11.471354+01:00 ns2 sshd[7493]: Connection from 27.130.39.66 port 54308 on 95.217.13.87 port 31511 rdomain ""
2026-11-07T11:56:12.33673 ...
show more2026-11-07T11:55:55.798151+01:00 ns2 sshd[7491]: Invalid user oracle from 27.130.39.66 port 53986
2026-11-07T11:56:11.471354+01:00 ns2 sshd[7493]: Connection from 27.130.39.66 port 54308 on 95.217.13.87 port 31511 rdomain ""
2026-11-07T11:56:12.336738+01:00 ns2 sshd[7493]: Invalid user cloudera from 27.130.39.66 port 54308
...
show less
