50.6.198.7

SSH brute-force + malware deployment (Redtail miner). 31 hits on honeypot. Uploaded clean.sh, setup.sh, redtail binaries. Injected SSH backdoor key.

rule sshd, 5 hits from 2026-11-05T14:39:57Z to 2026-11-05T14:46:11Z

2026-11-05T13:55:58.060361+00:00 ktj-nc sshd[1066957]: Invalid user user from 50.6.198.7 port 42758 2026-11-05T13:55:58.248118+00:00 ktj-nc sshd[1066957]: Disconnected from invalid user user 50.6.198.7 port 42758 [preauth] ...

2026-11-05T05:49:48-08:00: Failed password for invalid user toto from 50.6.198.7 port 40336 ssh2 2026-11-05T05:47:01-08:00: Failed password for invalid user vyatta from 50.6.198.7 port 56818 ssh2 2026-11-05T05:47:01-08:00: Failed password for invalid ... show more 2026-11-05T05:49:48-08:00: Failed password for invalid user toto from 50.6.198.7 port 40336 ssh2 2026-11-05T05:47:01-08:00: Failed password for invalid user vyatta from 50.6.198.7 port 56818 ssh2 2026-11-05T05:47:01-08:00: Failed password for invalid user vyatta from 50.6.198.7 port 56818 ssh2 2026-11-05T05:44:13-08:00: Failed password for invalid user walter from 50.6.198.7 port 51726 ssh2 2026-11-05T05:44:13-08:00: Failed password for invalid user walter from 50.6.198.7 port 51726 ssh2 2026-11-05T05:41:10-08:00: Failed password for invalid user botuser from 50.6.198.7 port 33330 ssh2 2026-11-05T05:41:10-08:00: Failed password for invalid user botuser from 50.6.198.7 port 33330 ssh2 2026-11-05T05:38:02-08:00: Failed password for invalid user root from 50.6.198.7 port 60582 ssh2 2026-11-05T05:38:02-08:00: Failed password for invalid user root from 50.6.198.7 port 60582 ssh2 2026-11-05T05:34:57-08:00: Failed password for invalid user vpnuser from 50.6.198.7 port 59474 ssh2 show less

2026-11-05T05:31:55-08:00: Failed password for invalid user root from 50.6.198.7 port 42762 ssh2 2026-11-05T05:28:55-08:00: Failed password for invalid user root from 50.6.198.7 port 56658 ssh2 2026-11-05T05:28:55-08:00: Failed password for invalid u ... show more 2026-11-05T05:31:55-08:00: Failed password for invalid user root from 50.6.198.7 port 42762 ssh2 2026-11-05T05:28:55-08:00: Failed password for invalid user root from 50.6.198.7 port 56658 ssh2 2026-11-05T05:28:55-08:00: Failed password for invalid user root from 50.6.198.7 port 56658 ssh2 2026-11-05T05:26:06-08:00: Failed password for invalid user root from 50.6.198.7 port 34912 ssh2 2026-11-05T05:26:06-08:00: Failed password for invalid user root from 50.6.198.7 port 34912 ssh2 2026-11-05T05:23:13-08:00: Failed password for invalid user prueba from 50.6.198.7 port 38092 ssh2 2026-11-05T05:23:13-08:00: Failed password for invalid user prueba from 50.6.198.7 port 38092 ssh2 2026-11-05T05:20:20-08:00: Failed password for invalid user pc from 50.6.198.7 port 49850 ssh2 2026-11-05T05:20:19-08:00: Failed password for invalid user pc from 50.6.198.7 port 49850 ssh2 2026-11-05T05:17:06-08:00: Failed password for invalid user strapi from 50.6.198.7 port 43238 ssh2 show less

2026-11-05T15:21:13+0200 Failed SSH Authentication/Brute Force Attack. (Server 9)

2026-11-05T05:13:55-08:00: Failed password for invalid user root from 50.6.198.7 port 58138 ssh2 2026-11-05T05:10:37-08:00: Failed password for invalid user root from 50.6.198.7 port 34510 ssh2 2026-11-05T05:10:36-08:00: Failed password for invalid u ... show more 2026-11-05T05:13:55-08:00: Failed password for invalid user root from 50.6.198.7 port 58138 ssh2 2026-11-05T05:10:37-08:00: Failed password for invalid user root from 50.6.198.7 port 34510 ssh2 2026-11-05T05:10:36-08:00: Failed password for invalid user root from 50.6.198.7 port 34510 ssh2 2026-11-05T04:40:49-08:00: Failed password for invalid user root from 50.6.198.7 port 43770 ssh2 2026-11-05T04:40:48-08:00: Failed password for invalid user root from 50.6.198.7 port 43770 ssh2 show less

SSH bruteforce [BY]

50.6.198.7 (US/United States/50-6-198-7.unifiedlayer.com), 5 distributed sshd attacks on account [redacted]

2026-11-05T13:07:01.621898+01:00 serengeti2 sshd-session[1517846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T13:07:03.329814+01:00 serengeti2 sshd-session[1517846]: Failed ... show more 2026-11-05T13:07:01.621898+01:00 serengeti2 sshd-session[1517846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T13:07:03.329814+01:00 serengeti2 sshd-session[1517846]: Failed password for root from 50.6.198.7 port 46434 ssh2 2026-11-05T13:10:16.170150+01:00 serengeti2 sshd-session[1520720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T13:10:18.147457+01:00 serengeti2 sshd-session[1520720]: Failed password for root from 50.6.198.7 port 50224 ssh2 2026-11-05T13:13:17.023254+01:00 serengeti2 sshd-session[1521954]: Invalid user user1 from 50.6.198.7 port 43876 ... show less

[sshd] Caught by Fail2Ban: 7x bruteforce attempt on multiple users.

2026-11-05T12:46:07.497157+01:00 serengeti2 sshd-session[1506182]: Failed password for root from 50.6.198.7 port 34336 ssh2 2026-11-05T12:49:17.611877+01:00 serengeti2 sshd-session[1507272]: Invalid user dev from 50.6.198.7 port 45738 2026-11-05T12:4 ... show more 2026-11-05T12:46:07.497157+01:00 serengeti2 sshd-session[1506182]: Failed password for root from 50.6.198.7 port 34336 ssh2 2026-11-05T12:49:17.611877+01:00 serengeti2 sshd-session[1507272]: Invalid user dev from 50.6.198.7 port 45738 2026-11-05T12:49:17.619067+01:00 serengeti2 sshd-session[1507272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 2026-11-05T12:49:19.308963+01:00 serengeti2 sshd-session[1507272]: Failed password for invalid user dev from 50.6.198.7 port 45738 ssh2 2026-11-05T12:52:23.835108+01:00 serengeti2 sshd-session[1509329]: Invalid user vpn from 50.6.198.7 port 51244 ... show less

2026-11-05T11:45:55.360109+00:00 ASIA-SGP-1.moevsmachine.tf sshd-session[210277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T11:45:57.789176+00:00 ASIA-SGP-1.moevsmachine.t ... show more 2026-11-05T11:45:55.360109+00:00 ASIA-SGP-1.moevsmachine.tf sshd-session[210277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T11:45:57.789176+00:00 ASIA-SGP-1.moevsmachine.tf sshd-session[210277]: Failed password for root from 50.6.198.7 port 39896 ssh2 2026-11-05T11:49:06.697351+00:00 ASIA-SGP-1.moevsmachine.tf sshd-session[210376]: Invalid user dev from 50.6.198.7 port 37516 2026-11-05T11:49:06.702407+00:00 ASIA-SGP-1.moevsmachine.tf sshd-session[210376]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 2026-11-05T11:49:08.574859+00:00 ASIA-SGP-1.moevsmachine.tf sshd-session[210376]: Failed password for invalid user dev from 50.6.198.7 port 37516 ssh2 ... show less

2026-11-05T04:20:52.471782-07:00 b146-22 sshd[47848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T04:20:54.378666-07:00 b146-22 sshd[47848]: Failed password for invalid user ... show more 2026-11-05T04:20:52.471782-07:00 b146-22 sshd[47848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.6.198.7 user=root 2026-11-05T04:20:54.378666-07:00 b146-22 sshd[47848]: Failed password for invalid user root from 50.6.198.7 port 48988 ssh2 2026-11-05T04:43:52.018253-07:00 b146-22 sshd[48517]: User root from 50.6.198.7 not allowed because none of user's groups are listed in AllowGroups ... show less

Dyls honeypot brute-force: SSH (15 total hits)