Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-29T01:31:17.131432+00:00 alertalicitacao sshd[475453]: User root from 85.25.172.171 not allowed because not listed in AllowUsers
2026-10-29T01:31:17.587625+00:00 alertalicitacao sshd[475457]: Connection from 85.25.172.171 port 60686 on 192.16 ...
show more2026-10-29T01:31:17.131432+00:00 alertalicitacao sshd[475453]: User root from 85.25.172.171 not allowed because not listed in AllowUsers
2026-10-29T01:31:17.587625+00:00 alertalicitacao sshd[475457]: Connection from 85.25.172.171 port 60686 on 192.168.100.167 port 22 rdomain ""
2026-10-29T01:31:18.482951+00:00 alertalicitacao sshd[475457]: User root from 85.25.172.171 not allowed because not listed in AllowUsers
2026-10-29T01:31:18.930563+00:00 alertalicitacao sshd[475459]: Connection from 85.25.172.171 port 60702 on 192.168.100.167 port 22 rdomain ""
2026-10-29T01:31:19.800654+00:00 alertalicitacao sshd[475459]: User root from 85.25.172.171 not allowed because not listed in AllowUsers
...
show less
SSH brute-force detected by honeypot: 25 failed login attempts in 64s. Usernames tried: root. No real service on this host; no credentials were ever accepted.
SSH brute-force detected by honeypot: 49 failed login attempts in 960s. Usernames tried: root, suporte. No real service on this host; no credentials were ever accepted.
SSH brute-force detected by honeypot: 25 failed login attempts in 63s. Usernames tried: root. No real service on this host; no credentials were ever accepted.
SSH brute-force detected by honeypot: 26 failed login attempts in 65s. Usernames tried: root. No real service on this host; no credentials were ever accepted.
Brute-Force
SSH
Anonymous
Reported by RattusGuard: Honeypot: ssh emulator (port 2222/tcp)
Fail2ban ban on jail 'sshd'. Repeated failed authentication attempts against a monitored host. Detected and correlated by Wazuh SIEM (rule 100110, level 10). Reported automatically.
Fail2Ban found 2026-10-28T15:13:12.463180+00:00 node1 sshd[1687396]: Invalid user suporte from 85.25.172.171 port 15790
2026-10-28T15:13:12.680725+00:00 node1 sshd[1687396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r ...
show moreFail2Ban found 2026-10-28T15:13:12.463180+00:00 node1 sshd[1687396]: Invalid user suporte from 85.25.172.171 port 15790
2026-10-28T15:13:12.680725+00:00 node1 sshd[1687396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.25.172.171
2026-10-28T15:13:14.920612+00:00 node1 sshd[1687396]: Failed password for invalid user suporte from 85.25.172.171 port 15790 ssh2 attempts
show less
SSH brute-force detected by honeypot: 3 failed login attempts in 60379s. Usernames tried: suporte, root. No real service on this host; no credentials were ever accepted.
2026-10-28T12:12:18.151393-03:00 dns1 sshd[24946]: Connection closed by authenticating user root 85.25.172.171 port 26350 [preauth]
2026-10-28T12:12:19.691919-03:00 dns1 sshd[24948]: Invalid user suporte from 85.25.172.171 port 59376
2026-10-28T12:12 ...
show more2026-10-28T12:12:18.151393-03:00 dns1 sshd[24946]: Connection closed by authenticating user root 85.25.172.171 port 26350 [preauth]
2026-10-28T12:12:19.691919-03:00 dns1 sshd[24948]: Invalid user suporte from 85.25.172.171 port 59376
2026-10-28T12:12:19.931761-03:00 dns1 sshd[24948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.25.172.171
2026-10-28T12:12:21.560676-03:00 dns1 sshd[24948]: Failed password for invalid user suporte from 85.25.172.171 port 59376 ssh2
2026-10-28T12:12:22.280575-03:00 dns1 sshd[24948]: Connection closed by invalid user suporte 85.25.172.171 port 59376 [preauth]
show less
