This IP address has been reported a total of
20
times from
18 distinct
sources.
5.238.198.28 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 5
reports;
United States of America
with 3
reports;
Austria
with 2
reports.
The most common categories in these recent reports were:
Brute-Force
16
times;
SSH
16
times;
Port Scan
5
times;
Exploited Host
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 21 13:52:05 hecnet-us-east-gw sshd[2508352]: User root from 5.238.198.28 not allowed because not ...
show moreOct 21 13:52:05 hecnet-us-east-gw sshd[2508352]: User root from 5.238.198.28 not allowed because not listed in AllowUsers
Oct 21 13:52:07 hecnet-us-east-gw sshd[2508352]: Failed password for invalid user root from 5.238.198.28 port 59071 ssh2
Oct 21 13:52:10 hecnet-us-east-gw sshd[2508352]: Failed password for invalid user root from 5.238.198.28 port 59071 ssh2
...
show less
Oct 21 06:12:53 vps-1 sshd-session[262985]: Invalid user test2 from 5.238.198.28 port 46029
Oct 21 0 ...
show moreOct 21 06:12:53 vps-1 sshd-session[262985]: Invalid user test2 from 5.238.198.28 port 46029
Oct 21 06:12:54 vps-1 sshd-session[262985]: error: maximum authentication attempts exceeded for invalid user test2 from 5.238.198.28 port 46029 ssh2 [preauth]
Oct 21 06:13:04 vps-1 sshd-session[262988]: Invalid user test2 from 5.238.198.28 port 46046
...
show less
Brute-Force
SSH
Anonymous
2026-10-21T09:44:26.425754+00:00 subaru sshd-session[2998070]: pam_unix(sshd:auth): authentication f ...
show more2026-10-21T09:44:26.425754+00:00 subaru sshd-session[2998070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.238.198.28
2026-10-21T09:44:28.186775+00:00 subaru sshd-session[2998070]: Failed password for invalid user oracle from 5.238.198.28 port 46885 ssh2
2026-10-21T09:44:31.854954+00:00 subaru sshd-session[2998070]: Failed password for invalid user oracle from 5.238.198.28 port 46885 ssh2
2026-10-21T09:44:35.183993+00:00 subaru sshd-session[2998070]: Failed password for invalid user oracle from 5.238.198.28 port 46885 ssh2
2026-10-21T09:44:38.624591+00:00 subaru sshd-session[2998070]: Failed password for invalid user oracle from 5.238.198.28 port 46885 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-10-20T23:19:21.438973+00:00 mail sshd[1532597]: pam_unix(sshd:auth): authentication failure; lo ...
show more2026-10-20T23:19:21.438973+00:00 mail sshd[1532597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.238.198.28
2026-10-20T23:19:23.685239+00:00 mail sshd[1532597]: Failed password for invalid user test2 from 5.238.198.28 port 38361 ssh2
2026-10-20T23:19:28.104980+00:00 mail sshd[1532597]: Failed password for invalid user test2 from 5.238.198.28 port 38361 ssh2
2026-10-20T23:19:31.863912+00:00 mail sshd[1532597]: Failed password for invalid user test2 from 5.238.198.28 port 38361 ssh2
2026-10-20T23:19:34.427045+00:00 mail sshd[1532597]: Failed password for invalid user test2 from 5.238.198.28 port 38361 ssh2
...
show less
Unauthorized connection attempt detected from IP address 5.238.198.28 to port 22 (banankicks-server) ...
show moreUnauthorized connection attempt detected from IP address 5.238.198.28 to port 22 (banankicks-server) [F]
show less
Fail2Ban: Unauthorized connection / brute-force attempt detected (protocol: SSH, failed attempts: 5) ...
show moreFail2Ban: Unauthorized connection / brute-force attempt detected (protocol: SSH, failed attempts: 5).
show less
Brute-Force
SSH
Anonymous
Automated report from fail2ban.
Detected: repeated SSH login brute-force attempts.
Jail: sshd
Faile ...
show moreAutomated report from fail2ban.
Detected: repeated SSH login brute-force attempts.
Jail: sshd
Failed attempts recorded: 3
Report time: 2026-10-20 12:51:57 UTC
This IP has been automatically and permanently blocked at our network perimeter.
Evidence (most recent matched log lines, redacted):
$f2bV_matches
show less
Automated report by DataDream Sentinel.
Repeated SSH authentication failures consistent with credent ...
show moreAutomated report by DataDream Sentinel.
Repeated SSH authentication failures consistent with credential brute-force activity were detected against infrastructure monitored by DataDream.
6 failed-authentication event references were correlated between 2026-10-20 11:32:05 and 11:32:07 UTC.
No successful SSH authentication was observed in the available telemetry.
Reference: DD-AIPDB-20261020-3126FADA
show less
Cowrie SSH honeypot: 33 attempt(s) from 5.238.198.28. Period: 2026-10-19T22:02:53 to 2026-10-19T22:0 ...
show moreCowrie SSH honeypot: 33 attempt(s) from 5.238.198.28. Period: 2026-10-19T22:02:53 to 2026-10-19T22:04:45 UTC. Usernames tried: root. Passwords tried: 1234. Source: Cowrie honeypot (SSH/Telnet)
show less
Honeypot: 1 unsolicited connection attempt(s) to ports where no service is offered (22/tcp); first 2 ...
show moreHoneypot: 1 unsolicited connection attempt(s) to ports where no service is offered (22/tcp); first 2026-10-18 18:35:54 UTC, last 2026-10-18 18:35:54 UTC. Reported by ipdb-security/fitzgerald.eu
show less
Oct 19 03:45:08 obsidian sshd[3240175]: Failed password for root from 5.238.198.28 port 55099 ssh2
O ...
show moreOct 19 03:45:08 obsidian sshd[3240175]: Failed password for root from 5.238.198.28 port 55099 ssh2
Oct 19 03:45:13 obsidian sshd[3240175]: Failed password for root from 5.238.198.28 port 55099 ssh2
Oct 19 03:45:15 obsidian sshd[3240175]: Failed password for root from 5.238.198.28 port 55099 ssh2
...
show less
