This IP address has been reported a total of
25
times from
25 distinct
sources.
49.207.242.45 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 7
reports;
United States of America
with 3
reports;
Hong Kong
with 2
reports.
The most common categories in these recent reports were:
Brute-Force
23
times;
SSH
22
times;
Port Scan
1
time;
Hacking
1
time.
Old Reports
The most recent abuse report for this IP address is from
. It is possible that this IP is no
longer involved in abusive activities.
2026-09-30T06:18:12.448872-06:00 b146-36 sshd[1972438]: pam_sss(sshd:auth): authentication failure; ...
show more2026-09-30T06:18:12.448872-06:00 b146-36 sshd[1972438]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.207.242.45 user=mohan
2026-09-30T06:18:14.194254-06:00 b146-36 sshd[1972438]: Failed password for invalid user mohan from 49.207.242.45 port 38713 ssh2
2026-09-30T06:18:56.637664-06:00 b146-36 sshd[1972458]: Invalid user temp from 49.207.242.45 port 37882
...
show less
Fail2Ban automatic report:
SSH brute-force:
Sep 30 14:12:50 serw sshd[1554301]: Invalid user bg from ...
show moreFail2Ban automatic report:
SSH brute-force:
Sep 30 14:12:50 serw sshd[1554301]: Invalid user bg from 49.207.242.45 port 39346
Sep 30 14:12:50 serw sshd[1554301]: Disconnected from invalid user bg 49.207.242.45 port 39346 [preauth]
Sep 30 14:15:29 serw sshd[1554341]: Disconnected from authenticating user root 49.207.242.45 port 38087 [preauth]
show less
2026-09-30T15:01:11.469832+03:00 pldelta-ladder.datagio.net sshd-session[1876657]: Invalid user debi ...
show more2026-09-30T15:01:11.469832+03:00 pldelta-ladder.datagio.net sshd-session[1876657]: Invalid user debian from 49.207.242.45 port 37531
...
show less
2026-09-30T19:48:40.332888+08:00 ip-38-211-199-7 sshd[2258844]: Invalid user daniel from 49.207.242. ...
show more2026-09-30T19:48:40.332888+08:00 ip-38-211-199-7 sshd[2258844]: Invalid user daniel from 49.207.242.45 port 39393
2026-09-30T19:48:40.437946+08:00 ip-38-211-199-7 sshd[2258844]: Disconnected from invalid user daniel 49.207.242.45 port 39393 [preauth]
2026-09-30T19:50:15.110445+08:00 ip-38-211-199-7 sshd[2258895]: Invalid user testadmin from 49.207.242.45 port 38327
2026-09-30T19:50:15.197118+08:00 ip-38-211-199-7 sshd[2258895]: Disconnected from invalid user testadmin 49.207.242.45 port 38327 [preauth]
...
show less
2026-09-30T13:43:25.392281+02:00 timesrv sshd-session[298646]: Invalid user exit from 49.207.242.45 ...
show more2026-09-30T13:43:25.392281+02:00 timesrv sshd-session[298646]: Invalid user exit from 49.207.242.45 port 38397
2026-09-30T13:46:00.168457+02:00 timesrv sshd-session[298657]: Invalid user james from 49.207.242.45 port 37618
...
show less
2026-09-30T04:48:59.071039 DDMZLXSFV01 sshd[1431002]: Failed password for root from 49.207.242.45 po ...
show more2026-09-30T04:48:59.071039 DDMZLXSFV01 sshd[1431002]: Failed password for root from 49.207.242.45 port 38615 ssh2
2026-09-30T04:50:35.363426 DDMZLXSFV01 sshd[1431054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.207.242.45 user=root
2026-09-30T04:50:37.199795 DDMZLXSFV01 sshd[1431054]: Failed password for root from 49.207.242.45 port 39407 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-09-30T09:47:54.299905+00:00 ubuntu-4gb-fsn1-1 sshd-session[1167555]: Invalid user sysadmin from ...
show more2026-09-30T09:47:54.299905+00:00 ubuntu-4gb-fsn1-1 sshd-session[1167555]: Invalid user sysadmin from 49.207.242.45 port 37703
2026-09-30T09:47:54.305888+00:00 ubuntu-4gb-fsn1-1 sshd-session[1167555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.207.242.45
2026-09-30T09:47:56.187098+00:00 ubuntu-4gb-fsn1-1 sshd-session[1167555]: Failed password for invalid user sysadmin from 49.207.242.45 port 37703 ssh2
...
show less
2026-09-30T11:43:52.773940+02:00 vps-a3e99d67 sshd-session[2046921]: Invalid user payara from 49.207 ...
show more2026-09-30T11:43:52.773940+02:00 vps-a3e99d67 sshd-session[2046921]: Invalid user payara from 49.207.242.45 port 39133
2026-09-30T11:44:11.378655+02:00 vps-a3e99d67 sshd-session[2047503]: Invalid user alexis from 49.207.242.45 port 38217
2026-09-30T11:44:32.480553+02:00 vps-a3e99d67 sshd-session[2048207]: Invalid user deploy from 49.207.242.45 port 38127
...
show less
[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted m ...
show more[Honeypot Report] Unauthorised shell access and command execution via SSH
A remote host attempted multiple logins against our emulated SSH service, then obtained shell access and executed commands.
Observed: 2026-09-30 09:07 to 2026-09-30 09:08 UTC | 6 sessions | 10 events | SSH (port 2222)
Attack chain:
1. 6 credential attempts: root/r00tb33r, sonar/admin123, root/zy@123456, mysql/Qwerty123, 345gs5662d34/345gs5662d34 (+1 more pairs)
2. Shell access obtained; 1 distinct command executed: cd ~; chattr -ia .ssh; lockr -ia .ssh
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/49.207.242.45.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
