JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

61.169.49.254

Recent Activity

Abuse Confidence Score

26% Elevated

52 reports

28 reporters · latest 6 days ago

ISP: CHINANET Shanghai province network
Usage Type: Fixed Line ISP
ASN: AS4812
Domain Name: online.sh.cn
Country: 🇨🇳 China
City: Shanghai, Shanghai

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

52 from 28 distinct reporters

First reported

November 2nd 2025

Most recent report

6 days ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 3 🇩🇪 Germany 1 🇭🇰 Hong Kong 1

Most common categories Brute-Force 7 SSH 5 Bad Web Bot 1 Port Scan 1 DDoS Attack 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇲🇾 Colin Vitalis	2026-11-05 07:06:52 UTC · (6 days ago)	Nov 5 15:06:48 kohamotac sshd[2937892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 user=root Nov 5 15:06:49 kohamotac sshd[2937892]: Failed password for root from 61.169.49.254 port 11443 ... show more Nov 5 15:06:48 kohamotac sshd[2937892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 user=root Nov 5 15:06:49 kohamotac sshd[2937892]: Failed password for root from 61.169.49.254 port 11443 ssh2 Nov 5 15:06:50 kohamotac sshd[2937894]: Invalid user admin from 61.169.49.254 port 11463 Nov 5 15:06:50 kohamotac sshd[2937894]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 Nov 5 15:06:52 kohamotac sshd[2937894]: Failed password for invalid user admin from 61.169.49.254 port 11463 ssh2 ... show less	DDoS Attack Brute-Force Bad Web Bot Web App Attack SSH
🇮🇩 Paschen J Ki	2026-10-28 04:52:10 UTC · (2 weeks ago)	2026-10-28T11:51:59.958876+07:00 h-1773832949746377849 sshd[519240]: Failed password for invalid user admin from 61.169.49.254 port 55482 ssh2 2026-10-28T11:52:07.872918+07:00 h-1773832949746377849 sshd[519244]: pam_unix(sshd:auth): authentication fa ... show more 2026-10-28T11:51:59.958876+07:00 h-1773832949746377849 sshd[519240]: Failed password for invalid user admin from 61.169.49.254 port 55482 ssh2 2026-10-28T11:52:07.872918+07:00 h-1773832949746377849 sshd[519244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 user=root 2026-10-28T11:52:09.942125+07:00 h-1773832949746377849 sshd[519244]: Failed password for root from 61.169.49.254 port 55659 ssh2 ... show less	Brute-Force SSH
🇺🇸 sh97	2026-10-17 00:48:48 UTC · (3 weeks ago)	US02-RN-LAX: SSH Brute Force from 61.169.49.254 at 2026-10-17 06:18:47 IST	Brute-Force SSH
🇩🇪 canturan	2026-10-14 22:45:02 UTC · (3 weeks ago)	Brute-force: 29 failed RDP/Windows logon login attempts; address blocked automatically.	Brute-Force
🇺🇸 valornode	2026-10-10 15:55:30 UTC · (1 month ago)	Detected by CrowdSec on vps-stl1-e8650a7b: CrowdSec: crowdsecurity/ssh-slow-bf \| ASN: 4812 (China Telecom Group) \| Country: CN \| Range: 61.169.0.0/16	Brute-Force SSH
🇺🇸 sh97	2026-10-08 01:22:31 UTC · (1 month ago)	US02-RN-LAX: SSH Brute Force from 61.169.49.254 at 2026-10-08 06:52:31 IST	Brute-Force SSH
🇭🇰 CGT Software Webmaster	2026-09-26 10:42:27 UTC · (1 month ago)	2026-09-26T10:42:24.156535+00:00 CVM51718 sshd[1014850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 2026-09-26T10:42:25.608343+00:00 CVM51718 sshd[1014850]: Failed password for invalid user a ... show more 2026-09-26T10:42:24.156535+00:00 CVM51718 sshd[1014850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 2026-09-26T10:42:25.608343+00:00 CVM51718 sshd[1014850]: Failed password for invalid user admin from 61.169.49.254 port 56277 ssh2 2026-09-26T10:42:26.006885+00:00 CVM51718 sshd[1014854]: Invalid user admin from 61.169.49.254 port 56305 ... show less	Port Scan Brute-Force
Anonymous	2026-08-28 04:36:19 UTC · (2 months ago)	SSH tarpit (endlessh) connection from 61.169.49.254	Brute-Force SSH
🇨🇦 Psycho Solutions LLC	2026-08-19 10:04:06 UTC · (2 months ago)	Active SSH brute-force detected. Logs: 2026-08-19T10:03:53.426980+00:00 AVM-373295 sshd-session[30638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 user=root 2026-08-19T10:03:55.514364+00:00 ... show more Active SSH brute-force detected. Logs: 2026-08-19T10:03:53.426980+00:00 AVM-373295 sshd-session[30638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.169.49.254 user=root 2026-08-19T10:03:55.514364+00:00 AV... show less	SSH Brute-Force
🇺🇸 xmission.com	2026-08-07 02:30:38 UTC · (3 months ago)	Blocked by UFW (TCP on 9101) Source port: 62023 TTL: 108 Packet length: 52 TOS: 0x08 This report (for 61.169.49.254) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇨🇳 Dominicwu	2026-07-24 03:34:21 UTC · (3 months ago)	SSH authentication failures over threshold (4/600s). Attempts: user=unknown src_port=55434; user=unknown src_port=55450; user=root src_port=55454. Password plaintext is not available in dropbear logs.	Brute-Force SSH
🇺🇸 clair	2026-07-20 14:22:28 UTC · (3 months ago)	2026-07-20T10:22:20.561550-04:00 clair-mc sshd-session[290317]: Invalid user admin from 61.169.49.254 port 59010 2026-07-20T10:22:24.413845-04:00 clair-mc sshd-session[290321]: Invalid user admin from 61.169.49.254 port 59044 2026-07-20T10:22:27.6133 ... show more 2026-07-20T10:22:20.561550-04:00 clair-mc sshd-session[290317]: Invalid user admin from 61.169.49.254 port 59010 2026-07-20T10:22:24.413845-04:00 clair-mc sshd-session[290321]: Invalid user admin from 61.169.49.254 port 59044 2026-07-20T10:22:27.613346-04:00 clair-mc sshd-session[290323]: Invalid user user from 61.169.49.254 port 59054 ... show less	Brute-Force SSH
🇺🇸 Tect.host	2026-07-15 18:49:09 UTC · (3 months ago)	Brute-force SSH server detected by Fail2ban	Brute-Force SSH
🇺🇸 xmission.com	2026-07-11 15:54:19 UTC · (3 months ago)	Blocked by UFW (TCP on 9101) Source port: 55428 TTL: 108 Packet length: 52 TOS: 0x0A This report (for 61.169.49.254) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇺🇸 xmission.com	2026-07-01 23:41:59 UTC · (4 months ago)	Blocked by UFW (TCP on 9101) Source port: 58701 TTL: 108 Packet length: 52 TOS: 0x08 This report (for 61.169.49.254) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan

Showing 1 to 15 of 52 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇬🇧 185.216.145.174

🇨🇿 185.87.121.1

🇳🇱 185.15.209.148

🇺🇸 170.75.255.65

🇨🇦 99.233.63.226

🇺🇸 98.228.178.160

🇩🇪 69.5.169.69

🇺🇸 45.55.151.3

🇺🇸 2604:2dc0:101:200::4942

🇻🇳 210.245.30.140

🇳🇱 195.178.110.217

🇧🇬 185.253.160.148

🇺🇸 170.106.147.63

🇸🇬 152.42.228.30

🇻🇳 103.159.54.61

🇷🇺 95.26.139.97

🇷🇺 91.198.213.21

🇨🇦 85.217.149.70

🇩🇪 64.227.112.28

🇳🇱 45.92.1.26