This IP address has been reported a total of
142
times from
126 distinct
sources.
34.52.225.251 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 39
reports;
United States of America
with 32
reports;
France
with 12
reports.
The most common categories in these recent reports were:
SSH
128
times;
Brute-Force
117
times;
Port Scan
17
times;
Hacking
8
times;
Exploited Host
5
times;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Unauthorised SSH/Telnet login attempt with user "admin" at 2026-10-23T07:59:46Z
Brute-Force
SSH
Anonymous
SSH tarpit (endlessh) connection from 34.52.225.251
Brute-Force
SSH
Anonymous
2026-10-23T09:14:16.338056+02:00 vps575891 sshd-session[1266688]: Invalid user jdegs from 34.52.225. ...
show more2026-10-23T09:14:16.338056+02:00 vps575891 sshd-session[1266688]: Invalid user jdegs from 34.52.225.251 port 4748
2026-10-23T09:14:22.943850+02:00 vps575891 sshd-session[1266694]: Unable to negotiate with 34.52.225.251 port 35654: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256 [preauth]
2026-10-23T09:14:23.205835+02:00 vps575891 sshd-session[1266696]: Unable to negotiate with 34.52.225.251 port 35660: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256 [preauth]
...
show less
Oct 23 09:03:58 themis sshd-session[2007472]: Invalid user admin from 34.52.225.251 port 44588
Oct 2 ...
show moreOct 23 09:03:58 themis sshd-session[2007472]: Invalid user admin from 34.52.225.251 port 44588
Oct 23 09:04:00 themis sshd-session[2007472]: error: PAM: User not known to the underlying authentication module for illegal user admin from 34.52.225.251
Oct 23 09:04:00 themis sshd-session[2007472]: Failed keyboard-interactive/pam for invalid user admin from 34.52.225.251 port 44588 ssh2
...
show less
2026-10-23T14:55:07.696535+08:00 ip-38-211-199-7 sshd[2748458]: Connection closed by 34.52.225.251 p ...
show more2026-10-23T14:55:07.696535+08:00 ip-38-211-199-7 sshd[2748458]: Connection closed by 34.52.225.251 port 41812
2026-10-23T14:55:34.336371+08:00 ip-38-211-199-7 sshd[2748460]: Unable to negotiate with 34.52.225.251 port 14320: no matching host key type found. Their offer: ssh-dss [preauth]
2026-10-23T14:55:35.130124+08:00 ip-38-211-199-7 sshd[2748462]: Unable to negotiate with 34.52.225.251 port 14336: no matching host key type found. Their offer: ssh-rsa [preauth]
2026-10-23T14:55:36.442360+08:00 ip-38-211-199-7 sshd[2748476]: Connection closed by 34.52.225.251 port 14350 [preauth]
...
show less
SSH tarpit on port 22: 32 connection(s) in the last 24h, held 650 s in total, longest 30 s. Unsolici ...
show moreSSH tarpit on port 22: 32 connection(s) in the last 24h, held 650 s in total, longest 30 s. Unsolicited SSH to a port with no SSH service: repeated SSH probes (scanner behavior). Automated endlessh tarpit report.
show less
2026-10-23 06:53:15 connection from 34.52.225.251
2026-10-23 06:53:16 connection from 34.52.225.251
...
show more2026-10-23 06:53:15 connection from 34.52.225.251
2026-10-23 06:53:16 connection from 34.52.225.251
2026-10-23 06:53:16 connection from 34.52.225.251
2026-10-23 06:53:16 connection from 34.52.225.251
2026-10-23 06:53:16 connection from 34.52.225.251
...
show less
Unsolicited SSH authentication activity against an instrumented SSH honeypot (TCP/22): 1 login event ...
show moreUnsolicited SSH authentication activity against an instrumented SSH honeypot (TCP/22): 1 login events across 1 SSH sessions, 1 distinct usernames; observed UTC 2026-10-23T06:51:30.160289Z through 2026-10-23T06:51:30.160289Z. Honeypot login-success events are simulated, not real host compromise.
show less
