UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ...
show moreUFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=64.23.167.178; proto=TCP; source_port=61001; target_port=7173; flags=SYN
show less
Port Scan
Anonymous
denied traffic to a honeypot network. destination port 8443.
Automated scan detection against redacted protected targets. Hits=1; port 445 proto 6 detection dark ...
show moreAutomated scan detection against redacted protected targets. Hits=1; port 445 proto 6 detection dark_ip
show less
SSH brute force on port 22 -- 7 attempts, 1 successful. Credentials: root:herzog. Active: 2026-08-12 ...
show moreSSH brute force on port 22 -- 7 attempts, 1 successful. Credentials: root:herzog. Active: 2026-08-12T22:55 to 2026-08-12T23:11. Post-login: /usr/bin/env python3 /usr/local/bin/honeypot_pam.py; ausearch -i -k command --checkpoint /var/lib/honeypot/audit_; ausearch -i -m USER_LOGIN,USER_START --checkpoint /var/lib/h. Malware: botnet (high); trojan (high); trojan (critical). Source: AS14061 DigitalOcean, LLC (Santa Clara, US). Data from SSH honeypot — not a production system.
show less
2026-08-12T23:11:07.360994+00:00 instance-20241019-1127 sshd[3529659]: Connection closed by authenti ...
show more2026-08-12T23:11:07.360994+00:00 instance-20241019-1127 sshd[3529659]: Connection closed by authenticating user root 64.23.167.178 port 53998 [preauth]
...
show less
2026-08-12T22:55:59.717826+00:00 v2202502255267314709 sshd[4173762]: User root from 64.23.167.178 no ...
show more2026-08-12T22:55:59.717826+00:00 v2202502255267314709 sshd[4173762]: User root from 64.23.167.178 not allowed because not listed in AllowUsers
2026-08-12T22:58:45.768927+00:00 v2202502255267314709 sshd[4180506]: User root from 64.23.167.178 not allowed because not listed in AllowUsers
2026-08-12T23:01:34.601150+00:00 v2202502255267314709 sshd[4186849]: User root from 64.23.167.178 not allowed because not listed in AllowUsers
2026-08-12T23:04:26.890942+00:00 v2202502255267314709 sshd[4193720]: User root from 64.23.167.178 not allowed because not listed in AllowUsers
2026-08-12T23:07:18.687771+00:00 v2202502255267314709 sshd[7407]: User root from 64.23.167.178 not allowed because not listed in AllowUsers
...
show less
Brute-Force
SSH
Anonymous
Aug 13 01:01:28 tyrol sshd[2172723]: Failed password for [redacted] from 64.23.167.178 port 55514 ss ...
show moreAug 13 01:01:28 tyrol sshd[2172723]: Failed password for [redacted] from 64.23.167.178 port 55514 ssh2
Aug 13 01:04:18 tyrol sshd[2173369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.167.178 user=[redacted]
Aug 13 01:04:20 tyrol sshd[2173369]: Failed password for [redacted] from 64.23.167.178 port 43986 ssh2
Aug 13 01:07:11 tyrol sshd[2174566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.167.178 user=[redacted]
Aug 13 01:07:13 tyrol sshd[2174566]: Failed password for [redacted] from 64.23.167.178 port 51040 ssh2
...
show less
Brute-Force
SSH
Showing 1 to
15
of 52 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩