Repeated SSH brute force and user enumeration attempts against a secured server. Multiple failed authentication attempts from this IP across an extended period.
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
Anonymous
2026-09-18T22:34:54.549310+00:00 ubuntu-4gb-hel1-2 sshd[1884780]: Invalid user hadoop from 91.98.169.56 port 48144
2026-09-18T22:36:04.226331+00:00 ubuntu-4gb-hel1-2 sshd[1886340]: Invalid user git from 91.98.169.56 port 37026
2026-09-18T22:39:15.158 ...
show more2026-09-18T22:34:54.549310+00:00 ubuntu-4gb-hel1-2 sshd[1884780]: Invalid user hadoop from 91.98.169.56 port 48144
2026-09-18T22:36:04.226331+00:00 ubuntu-4gb-hel1-2 sshd[1886340]: Invalid user git from 91.98.169.56 port 37026
2026-09-18T22:39:15.158916+00:00 ubuntu-4gb-hel1-2 sshd[1890713]: Invalid user elastic from 91.98.169.56 port 35238
2026-09-18T22:42:28.077469+00:00 ubuntu-4gb-hel1-2 sshd[1894980]: Invalid user placement from 91.98.169.56 port 48430
2026-09-18T22:43:33.677144+00:00 ubuntu-4gb-hel1-2 sshd[1896420]: Invalid user firebird from 91.98.169.56 port 43286
...
show less
Brute-Force
SSH
Anonymous
Sep 18 22:34:51 ubuntu sshd[189184]: Invalid user hadoop from 91.98.169.56 port 33778
Sep 18 22:36:01 ubuntu sshd[190297]: Invalid user git from 91.98.169.56 port 44472
Sep 18 22:39:12 ubuntu sshd[192524]: Invalid user elastic from 91.98.169.56 port ...
show moreSep 18 22:34:51 ubuntu sshd[189184]: Invalid user hadoop from 91.98.169.56 port 33778
Sep 18 22:36:01 ubuntu sshd[190297]: Invalid user git from 91.98.169.56 port 44472
Sep 18 22:39:12 ubuntu sshd[192524]: Invalid user elastic from 91.98.169.56 port 45856
...
show less
Brute-Force
SSH
Anonymous
(sshd) Failed SSH login from 91.98.169.56 (DE/Germany/static.56.169.98.91.clients.your-server.de): 4 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 19 00:25:50 xn--80aqlfee4d sshd[2125]: Invalid user www-data from 91.9 ...
show more(sshd) Failed SSH login from 91.98.169.56 (DE/Germany/static.56.169.98.91.clients.your-server.de): 4 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 19 00:25:50 xn--80aqlfee4d sshd[2125]: Invalid user www-data from 91.98.169.56
Sep 19 00:25:52 xn--80aqlfee4d sshd[2125]: Failed password for invalid user www-data from 91.98.169.56 port 50294 ssh2
Sep 19 00:33:56 xn--80aqlfee4d sshd[3011]: Invalid user hadoop from 91.98.169.56
Sep 19 00:33:58 xn--80aqlfee4d sshd[3011]: Failed password for invalid user hadoop from 91.98.169.56 port 57610 ssh2
show less
2026-09-18T16:02:40.542078-06:00 oracle5 sshd[3503351]: Invalid user micro from 91.98.169.56 port 40178
2026-09-18T16:10:34.724878-06:00 oracle5 sshd[3524298]: Invalid user project from 91.98.169.56 port 60448
2026-09-18T16:12:42.393914-06:00 oracle5 ...
show more2026-09-18T16:02:40.542078-06:00 oracle5 sshd[3503351]: Invalid user micro from 91.98.169.56 port 40178
2026-09-18T16:10:34.724878-06:00 oracle5 sshd[3524298]: Invalid user project from 91.98.169.56 port 60448
2026-09-18T16:12:42.393914-06:00 oracle5 sshd[3529661]: Invalid user raj from 91.98.169.56 port 60774
...
show less
Brute-Force
SSH
Anonymous
Repeated SSH brute force and user enumeration attempts against a secured server. Multiple failed authentication attempts from this IP across an extended period.
2026-09-18T15:59:49.152147-06:00 leda sshd[1161421]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.98.169.56 user=micro
2026-09-18T15:59:51.400679-06:00 leda sshd[1161421]: Failed password for invalid user ...
show more2026-09-18T15:59:49.152147-06:00 leda sshd[1161421]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.98.169.56 user=micro
2026-09-18T15:59:51.400679-06:00 leda sshd[1161421]: Failed password for invalid user micro from 91.98.169.56 port 58908 ssh2
2026-09-18T16:04:40.063948-06:00 leda sshd[1161617]: User root from 91.98.169.56 not allowed because none of user's groups are listed in AllowGroups
...
show less
Sep 18 14:33:01 stories sshd[2950763]: Invalid user dst from 91.98.169.56 port 53314
Sep 18 14:34:10 stories sshd[2950891]: Invalid user rd from 91.98.169.56 port 55096
Sep 18 14:35:17 stories sshd[2951016]: Invalid user admin from 91.98.169.56 port ...
show moreSep 18 14:33:01 stories sshd[2950763]: Invalid user dst from 91.98.169.56 port 53314
Sep 18 14:34:10 stories sshd[2950891]: Invalid user rd from 91.98.169.56 port 55096
Sep 18 14:35:17 stories sshd[2951016]: Invalid user admin from 91.98.169.56 port 48886
Sep 18 14:36:21 stories sshd[2951130]: Invalid user deploy from 91.98.169.56 port 38326
Sep 18 14:37:30 stories sshd[2951251]: Invalid user admin from 91.98.169.56 port 60724
...
show less
Brute-Force
SSH
Anonymous
2026-09-18T23:33:59.570430+02:00 polaris sshd-session[3659482]: Invalid user dst from 91.98.169.56 port 46242
2026-09-18T23:35:06.635656+02:00 polaris sshd-session[3659827]: Invalid user rd from 91.98.169.56 port 51472
2026-09-18T23:36:10.003868+02:0 ...
show more2026-09-18T23:33:59.570430+02:00 polaris sshd-session[3659482]: Invalid user dst from 91.98.169.56 port 46242
2026-09-18T23:35:06.635656+02:00 polaris sshd-session[3659827]: Invalid user rd from 91.98.169.56 port 51472
2026-09-18T23:36:10.003868+02:00 polaris sshd-session[3660136]: Invalid user admin from 91.98.169.56 port 36028
...
show less
2026-09-18T23:33:38.178183+02:00 ns3124905 sshd-session[1160169]: Invalid user dst from 91.98.169.56 port 42374
2026-09-18T23:33:38.182624+02:00 ns3124905 sshd-session[1160169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=s ...
show more2026-09-18T23:33:38.178183+02:00 ns3124905 sshd-session[1160169]: Invalid user dst from 91.98.169.56 port 42374
2026-09-18T23:33:38.182624+02:00 ns3124905 sshd-session[1160169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.98.169.56
2026-09-18T23:33:40.005413+02:00 ns3124905 sshd-session[1160169]: Failed password for invalid user dst from 91.98.169.56 port 42374 ssh2
...
show less
2026-09-18T23:33:21.483342+02:00 arrow-at1 sshd-session[346193]: Invalid user dst from 91.98.169.56 port 57946
2026-09-18T23:33:21.486020+02:00 arrow-at1 sshd-session[346193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ...
show more2026-09-18T23:33:21.483342+02:00 arrow-at1 sshd-session[346193]: Invalid user dst from 91.98.169.56 port 57946
2026-09-18T23:33:21.486020+02:00 arrow-at1 sshd-session[346193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.98.169.56
2026-09-18T23:33:23.072878+02:00 arrow-at1 sshd-session[346193]: Failed password for invalid user dst from 91.98.169.56 port 57946 ssh2
...
show less
Brute-Force
SSH
Anonymous
2026-09-18T23:02:44.283929 prodgateway sshd-session[6671]: Invalid user jia from 91.98.169.56 port 45680
2026-09-18T23:02:44.288321 prodgateway sshd-session[6671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhos ...
show more2026-09-18T23:02:44.283929 prodgateway sshd-session[6671]: Invalid user jia from 91.98.169.56 port 45680
2026-09-18T23:02:44.288321 prodgateway sshd-session[6671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.98.169.56
2026-09-18T23:02:46.011146 prodgateway sshd-session[6671]: Failed password for invalid user jia from 91.98.169.56 port 45680 ssh2
...
show less
Disconnected from authenticating user root 91.98.169.56 port 46478 [preauth]
Failed password for jia from 91.98.169.56 port 58902 ssh2
Disconnected from jia 91.98.169.56 port 58902 [preauth]
SSH
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown
