This IP address has been reported a total of
40
times from
34 distinct
sources.
81.90.29.241 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 13
reports;
Germany
with 11
reports;
France
with 4
reports.
The most common categories in these recent reports were:
SSH
24
times;
Brute-Force
23
times;
Port Scan
10
times;
Hacking
7
times;
Web App Attack
6
times;
Other
7
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Honeypot Finding: SSH intrusion activity on TCP/22; successful login, command, or download activity ...
show moreHoneypot Finding: SSH intrusion activity on TCP/22; successful login, command, or download activity observed.
show less
2026-09-28T06:19:13.558403 telos sshd[4062801]: Invalid user admin from 81.90.29.241 port 12370
2026 ...
show more2026-09-28T06:19:13.558403 telos sshd[4062801]: Invalid user admin from 81.90.29.241 port 12370
2026-09-28T06:33:37.609885 telos sshd[4062815]: Invalid user user from 81.90.29.241 port 53326
2026-09-28T07:02:52.188845 telos sshd[4062950]: Invalid user user from 81.90.29.241 port 63512
show less
2026-09-28T06:26:12.593492polandend.hostes.io sshd[40476]: pam_unix(sshd:auth): authentication failu ...
show more2026-09-28T06:26:12.593492polandend.hostes.io sshd[40476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.90.29.241
2026-09-28T06:26:14.834074polandend.hostes.io sshd[40476]: Failed password for invalid user admin from 81.90.29.241 port 20612 ssh2
2026-09-28T06:40:41.645014polandend.hostes.io sshd[40484]: Invalid user user from 81.90.29.241 port 11910
...
show less
Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS ...
show moreVerified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT | PORTS=23 | HITS=2 | IPSET=ADD | FIRST=2026-09-28 08:19:58 | LAST=2026-09-28 08:19:58. Last seen 2026-09-28 08:19:58.
show less
2026-09-28T06:58:37.665608+02:00 hosting.defencegeeks.net sshd-session[2933715]: Invalid user sshadm ...
show more2026-09-28T06:58:37.665608+02:00 hosting.defencegeeks.net sshd-session[2933715]: Invalid user sshadmin from 81.90.29.241 port 60528
2026-09-28T06:58:37.670471+02:00 hosting.defencegeeks.net sshd-session[2933715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.90.29.241
2026-09-28T06:58:40.018858+02:00 hosting.defencegeeks.net sshd-session[2933715]: Failed password for invalid user sshadmin from 81.90.29.241 port 60528 ssh2
2026-09-28T07:13:05.578245+02:00 hosting.defencegeeks.net sshd-session[2943412]: Invalid user admin from 81.90.29.241 port 50756
2026-09-28T07:13:05.583132+02:00 hosting.defencegeeks.net sshd-session[2943412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.90.29.241
2026-09-28T07:13:07.599618+02:00 hosting.defencegeeks.net sshd-session[2943412]: Failed password for invalid user admin from 81.90.29.241 port 50756 ssh2
...
show less
This source IP appears to have had partial success against a monitored honeynet, with activity obser ...
show moreThis source IP appears to have had partial success against a monitored honeynet, with activity observed between 2026-09-28 04:35:39 UTC and 2026-09-28 04:37:59 UTC. Automated triage flagged this session for manual review: exploit attempt observed, followed by continued activity from the same source -- worth manual review. Logged: 2 network events and 1 web request. Targeted port 80/tcp. Suricata signatures fired: ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt and ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2. Request observed: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh. User-Agent string: 'libredtail-http'. Observed techniques align with MITRE ATT&CK T1595 (Active Scanning), T1046 (Network Service Discovery), T1083 (File and Directory Discovery), and T1190 (Exploit Public-Facing Application). Captured by a private research honeynet.
show less
