Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Nov 10 22:15:35 backup sshd[3917543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.251.28 user=root
Nov 10 22:15:37 backup sshd[3917543]: Failed password for root from 45.8.251.28 port 43472 ssh2
Nov 1 ...
show moreNov 10 22:15:35 backup sshd[3917543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.251.28 user=root
Nov 10 22:15:37 backup sshd[3917543]: Failed password for root from 45.8.251.28 port 43472 ssh2
Nov 10 22:18:14 backup sshd[3917578]: Invalid user deploy from 45.8.251.28 port 47148
Nov 10 22:18:14 backup sshd[3917578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.251.28
Nov 10 22:18:16 backup sshd[3917578]: Failed password for invalid user deploy from 45.8.251.28 port 47148 ssh2
...
show less
(sshd) Failed SSH login from 45.8.251.28 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov 10 11:36:40 zone sshd[3674763]: Invalid user deploy from 45.8.251.28 port 50148
Nov 10 11:36:43 zone sshd[3674763 ...
show more(sshd) Failed SSH login from 45.8.251.28 (RU/Russia/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Nov 10 11:36:40 zone sshd[3674763]: Invalid user deploy from 45.8.251.28 port 50148
Nov 10 11:36:43 zone sshd[3674763]: Failed password for invalid user deploy from 45.8.251.28 port 50148 ssh2
Nov 10 11:49:46 zone sshd[3677386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.251.28 user=root
Nov 10 11:49:49 zone sshd[3677386]: Failed password for root from 45.8.251.28 port 36694 ssh2
Nov 10 11:52:48 zone sshd[3678011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.8.251.28 user=root
show less
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.