This IP address has been reported a total of
79
times from
59 distinct
sources.
59.125.252.50 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
(sshd) Failed SSH login from 59.125.252.50 (TW/Taiwan/59-125-252-50.hinet-ip.hinet.net): 1 in the la ...
show more(sshd) Failed SSH login from 59.125.252.50 (TW/Taiwan/59-125-252-50.hinet-ip.hinet.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Aug 23 13:56:30 joshua sshd[3914393]: Invalid user test from 59.125.252.50 port 33471
show less
Port Scan
Anonymous
2026-08-23T05:05:38.559181-07:00 teslamate.docsit.net sshd[4043850]: pam_unix(sshd:auth): authentica ...
show more2026-08-23T05:05:38.559181-07:00 teslamate.docsit.net sshd[4043850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.125.252.50
2026-08-23T05:05:40.285246-07:00 teslamate.docsit.net sshd[4043850]: Failed password for invalid user guest from 59.125.252.50 port 40893 ssh2
...
show less
2026-08-22T19:44:46.648902+02:00 valhalla sshd-session[1813139]: Failed keyboard-interactive/pam for ...
show more2026-08-22T19:44:46.648902+02:00 valhalla sshd-session[1813139]: Failed keyboard-interactive/pam for invalid user test from 59.125.252.50 port 44108 ssh2
... <tp_comment>
show less
Novel zero-day payload (fingerprint=c339d4e1da2d) | HTTP GET ssh:// | at Edge layer | Attack type: r ...
show moreNovel zero-day payload (fingerprint=c339d4e1da2d) | HTTP GET ssh:// | at Edge layer | Attack type: reconnaissance scanning — target profiling | Raw payload: Client: SSH-2.0-OpenSSH_7.4
show less
Aug 22 02:11:36 hyperion sshd-session[2400263]: User operator from 59.125.252.50 not allowed because ...
show moreAug 22 02:11:36 hyperion sshd-session[2400263]: User operator from 59.125.252.50 not allowed because none of user's groups are listed in AllowGroups
Aug 22 02:11:40 hyperion sshd-session[2400263]: error: PAM: Authentication failure for illegal user operator from 59.125.252.50
Aug 22 02:11:40 hyperion sshd-session[2400263]: Failed keyboard-interactive/pam for invalid user operator from 59.125.252.50 port 34446 ssh2
...
show less
SSH credential brute-force observed by honeypot.
Source IP: 59.125.252.50
Targeted device: NAS
First ...
show moreSSH credential brute-force observed by honeypot.
Source IP: 59.125.252.50
Targeted device: NAS
First seen: 21 Aug 2026 23:55:13 UTC
Last seen: 21 Aug 2026 23:55:13 UTC
Attempts: 1
Client: SSH-2.0-OpenSSH_7.4
Sample credentials: unknown:12345
show less
Aug 21 23:00:15 gigabyte-h410m sshd[50382]: pam_unix(sshd:auth): authentication failure; logname= ui ...
show moreAug 21 23:00:15 gigabyte-h410m sshd[50382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.125.252.50
Aug 21 23:00:17 gigabyte-h410m sshd[50382]: Failed password for invalid user admin from 59.125.252.50 port 54894 ssh2
Aug 21 23:00:19 gigabyte-h410m sshd[50382]: Connection closed by invalid user admin 59.125.252.50 port 54894 [preauth]
...
show less
Aug 22 00:38:13 eos sshd-session[1407743]: User operator from 59.125.252.50 not allowed because none ...
show moreAug 22 00:38:13 eos sshd-session[1407743]: User operator from 59.125.252.50 not allowed because none of user's groups are listed in AllowGroups
Aug 22 00:38:16 eos sshd-session[1407743]: error: PAM: Authentication failure for illegal user operator from 59.125.252.50
Aug 22 00:38:16 eos sshd-session[1407743]: Failed keyboard-interactive/pam for invalid user operator from 59.125.252.50 port 52758 ssh2
...
show less
2026-08-21T20:12:37.877785luna-spire sshd[451398]: pam_unix(sshd:auth): authentication failure; logn ...
show more2026-08-21T20:12:37.877785luna-spire sshd[451398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.125.252.50
2026-08-21T20:12:39.429136luna-spire sshd[451398]: Failed password for invalid user user from 59.125.252.50 port 46005 ssh2
...
show less
SSH Brute force: 1 attempts were recorded from 59.125.252.50
2026-08-21T19:13:03+02:00 Invalid user ...
show moreSSH Brute force: 1 attempts were recorded from 59.125.252.50
2026-08-21T19:13:03+02:00 Invalid user default from 59.125.252.50 port 55029
show less
Automated report by DataDream Sentinel.
Repeated SSH authentication failures consistent with credent ...
show moreAutomated report by DataDream Sentinel.
Repeated SSH authentication failures consistent with credential brute-force activity were detected against infrastructure monitored by DataDream.
8 failed-authentication event references were correlated between 2026-08-21 13:51:31 and 13:51:35 UTC.
No successful SSH authentication was observed in the available telemetry.
Reference: DD-AIPDB-20260821-74880B39
show less
Brute-Force
SSH
Showing 1 to
15
of 79 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩