This IP address has been reported a total of
43
times from
35 distinct
sources.
8.138.221.168 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 10
reports;
Brazil
with 3
reports;
France
with 3
reports.
The most common categories in these recent reports were:
Brute-Force
33
times;
SSH
31
times;
Port Scan
6
times;
Web App Attack
4
times;
Hacking
2
times;
Other
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-26T04:08:07.810615+02:00 arrow-za1 sshd-session[396916]: pam_unix(sshd:auth): authentication ...
show more2026-10-26T04:08:07.810615+02:00 arrow-za1 sshd-session[396916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.138.221.168
2026-10-26T04:08:09.805711+02:00 arrow-za1 sshd-session[396916]: Failed password for invalid user debian from 8.138.221.168 port 36386 ssh2
2026-10-26T04:10:47.108846+02:00 arrow-za1 sshd-session[396944]: Invalid user pakchoi from 8.138.221.168 port 34378
...
show less
Brute-Force
SSH
Anonymous
Oct 25 11:54:57 fell sshd[1874938]: User root from 8.138.221.168 not allowed because not listed in A ...
show moreOct 25 11:54:57 fell sshd[1874938]: User root from 8.138.221.168 not allowed because not listed in AllowUsers
Oct 25 11:58:52 fell sshd[1874986]: User root from 8.138.221.168 not allowed because not listed in AllowUsers
Oct 25 11:59:33 fell sshd[1875007]: User root from 8.138.221.168 not allowed because not listed in AllowUsers
...
show less
This IP address carried out 42 SSH credential attack (attempts) on 21-10-2026. For more information ...
show moreThis IP address carried out 42 SSH credential attack (attempts) on 21-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.
show less
TSEC Honeypot Network report. Threat score: 99/100. Categories: Port Scan, Hacking, Brute-Force, Web ...
show moreTSEC Honeypot Network report. Threat score: 99/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: cowrie. Context: Attacker IP from Guangzhou, China (AS37963, Hangzhou Alibaba Advertising Co.
show less
Oct 22 15:00:01 hkphoto sshd[1768505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 e ...
show moreOct 22 15:00:01 hkphoto sshd[1768505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.138.221.168 user=root
Oct 22 15:00:03 hkphoto sshd[1768505]: Failed password for root from 8.138.221.168 port 39700 ssh2
Oct 22 15:00:25 hkphoto sshd[1768521]: Invalid user kishan from 8.138.221.168 port 41554
Oct 22 15:00:25 hkphoto sshd[1768521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.138.221.168
Oct 22 15:00:27 hkphoto sshd[1768521]: Failed password for invalid user kishan from 8.138.221.168 port 41554 ssh2
...
show less
(sshd) Failed SSH login from 8.138.221.168 (CN/China/-): 5 in the last 3600 secs; Ports: *; Directio ...
show more(sshd) Failed SSH login from 8.138.221.168 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_TRIGGER; Logs: Oct 21 02:55:12 localhost sshd[143925]: Invalid user myuser from 8.138.221.168 port 43656
Oct 21 02:55:39 localhost sshd[143948]: Invalid user bill from 8.138.221.168 port 34234
Oct 21 02:56:06 localhost sshd[143955]: Invalid user user3 from 8.138.221.168 port 38592
Oct 21 02:56:31 localhost sshd[143977]: Invalid user user3 from 8.138.221.168 port 45874
Oct 21 02:58:07 localhost sshd[144054]: Invalid user foundry from 8.138.221.168 port 50498
show less
FTP Brute-Force
Port Scan
Brute-Force
Web App Attack
SSH
SSH Brute force: 1 attempts were recorded from 8.138.221.168
2026-10-19T05:21:09+02:00 Disconnected ...
show moreSSH Brute force: 1 attempts were recorded from 8.138.221.168
2026-10-19T05:21:09+02:00 Disconnected from authenticating user root 8.138.221.168 port 32834 [preauth]
show less
ICS Labs threat intelligence (ICS Feeds): Port Scan, Brute-Force. Last observed 2026-10-18 UTC.
Port Scan
Brute-Force
Anonymous
Oct 13 00:08:20 mail sshd-session[1900859]: Invalid user chris from 8.138.221.168 port 42142
Oct 13 ...
show moreOct 13 00:08:20 mail sshd-session[1900859]: Invalid user chris from 8.138.221.168 port 42142
Oct 13 00:14:31 mail sshd-session[1901277]: Invalid user acs from 8.138.221.168 port 59988
Oct 13 00:16:39 mail sshd-session[1901442]: Invalid user temp from 8.138.221.168 port 43054
...
show less
2026-10-17T08:42:04.562753+02:00 Skadi sshd[2176030]: Invalid user gladys from 8.138.221.168 port 57 ...
show more2026-10-17T08:42:04.562753+02:00 Skadi sshd[2176030]: Invalid user gladys from 8.138.221.168 port 57842
2026-10-17T08:44:17.084665+02:00 Skadi sshd[2177120]: Invalid user jake from 8.138.221.168 port 33718
2026-10-17T08:45:23.578139+02:00 Skadi sshd[2177669]: Invalid user vinay from 8.138.221.168 port 55448
2026-10-17T08:47:02.821424+02:00 Skadi sshd[2178477]: Invalid user ubuntu from 8.138.221.168 port 42646
2026-10-17T08:48:05.307612+02:00 Skadi sshd[2178997]: Invalid user faisal from 8.138.221.168 port 39974
...
show less
Brute-Force
SSH
Anonymous
Reported by RattusGuard: Honeypot: ssh emulator (port 2222/tcp)
