This IP address has been reported a total of
1,857
times from
668 distinct
sources.
49.72.111.25 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-06-15T00:54:14.319033-07:00 server.vexstria.pro sshd[3637153]: Failed password for root from 49 ...
show more2026-06-15T00:54:14.319033-07:00 server.vexstria.pro sshd[3637153]: Failed password for root from 49.72.111.25 port 46162 ssh2
2026-06-15T00:54:17.453516-07:00 server.vexstria.pro sshd[3638368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.72.111.25 user=root
2026-06-15T00:54:19.303828-07:00 server.vexstria.pro sshd[3638368]: Failed password for root from 49.72.111.25 port 52626 ssh2
...
show less
Honeypot [nx-infrastructure]: Unauthorized connection attempt detected on 22/SSH
• Client: SSH-2.0-G ...
show moreHoneypot [nx-infrastructure]: Unauthorized connection attempt detected on 22/SSH
• Client: SSH-2.0-Go
Reported by: Justin F.
show less
SSH/Telnet honeypot (endlessh) on habith.eu: 2 connection attempts trapped, total tarpit time 40s. A ...
show moreSSH/Telnet honeypot (endlessh) on habith.eu: 2 connection attempts trapped, total tarpit time 40s. Automated report.
show less
2026-06-14T22:36:42.130576+00:00 kansas1 sshd[2953209]: Failed password for root from 49.72.111.25 p ...
show more2026-06-14T22:36:42.130576+00:00 kansas1 sshd[2953209]: Failed password for root from 49.72.111.25 port 39960 ssh2
2026-06-14T22:37:00.590836+00:00 kansas1 sshd[2953224]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.72.111.25 user=root
2026-06-14T22:37:03.123842+00:00 kansas1 sshd[2953224]: Failed password for root from 49.72.111.25 port 39024 ssh2
...
show less
2026-06-14T21:22:32.781319+00:00 de-fra2-nat641 sshd[3439460]: Invalid user user from 49.72.111.25 p ...
show more2026-06-14T21:22:32.781319+00:00 de-fra2-nat641 sshd[3439460]: Invalid user user from 49.72.111.25 port 38404
2026-06-14T21:22:34.607340+00:00 de-fra2-nat641 sshd[3439462]: Invalid user user from 49.72.111.25 port 47978
2026-06-14T21:22:37.358484+00:00 de-fra2-nat641 sshd[3439464]: Invalid user user from 49.72.111.25 port 51734
...
show less
2026-06-14T18:06:51.642516 ******* sshd[475344]: Connection closed by authenticating user root 49.72 ...
show more2026-06-14T18:06:51.642516 ******* sshd[475344]: Connection closed by authenticating user root 49.72.111.25 port 42488 [preauth]
2026-06-14T18:06:52.823256 ******* sshd[475358]: Connection closed by authenticating user root 49.72.111.25 port 43628 [preauth]
2026-06-14T18:06:54.824699 ******* sshd[475360]: Connection closed by authenticating user root 49.72.111.25 port 44468 [preauth]
show less
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS ...
show moreVerified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS=22 | HITS=2 | IPSET=ADD | FIRST=2026-06-14 10:03:32 | LAST=2026-06-14 10:03:33. Last seen 2026-06-14 10:03:33.
show less
Port Scan
Showing 1 to
15
of 1857 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩