Attack against SSH infrastructure (7 attempts this report):
2026-11-08 01:09:52 firewall,info SSH_ ...
show moreAttack against SSH infrastructure (7 attempts this report):
2026-11-08 01:09:52 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac E4:8D:8C:35:67:B2, proto TCP (SYN), 86.38.187.167:12842->xxx.xxx.xxx.xxx:50022, len 60
show less
Multiple unauthorized SSH attempts two days in a row.
Log sample:
2026-11-02 01:29:05 firewall,inf ...
show moreMultiple unauthorized SSH attempts two days in a row.
Log sample:
2026-11-02 01:29:05 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac E4:8D:8C:35:67:B2, proto TCP (SYN), 86.38.187.34:18610->xxx.xxx.xxx.xxx:50022, len 40
show less
Apparent Mikrotik router exploit attempt. Along with several others from different nets of the domai ...
show moreApparent Mikrotik router exploit attempt. Along with several others from different nets of the domain telkom.co.id on the same day.
Log entry:
2026-10-01 18:51:53 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac E4:8D:8C:35:67:B2, proto TCP (SYN), 36.83.73.80:22822->xxx.xxx.xxx.xxx:50022, len 60
2026-10-01 18:51:56 system,error,critical login failure for user -2 from 36.83.73.80 via ssh
show less
Unauthorized SSH login attempt and appears to be a Mikrotik router exploit attempt.
Log entry:
202 ...
show moreUnauthorized SSH login attempt and appears to be a Mikrotik router exploit attempt.
Log entry:
2026-10-01 00:36:45 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac E4:8D:8C:35:67:B2, proto TCP (SYN), 82.158.133.16:31504->xxx.xxx.xxx.xxx:50022, len 60
2026-10-01 00:36:49 system,error,critical login failure for user -2 from 82.158.133.16 via ssh
Have had a number of these out of Indonesia
show less
SSH abuse apparently using the recent Mikrotik Router exploit.
Log entry:
2026-10-01 11:29:50 fir ...
show moreSSH abuse apparently using the recent Mikrotik Router exploit.
Log entry:
2026-10-01 11:29:50 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac E4:8D:8C:35:67:B2, proto TCP (SYN), 180.242.224.131:54786->xxx.xxx.xxx.xxx:50022, len 60
2026-10-01 11:29:53 system,error,critical login failure for user -2 from 180.242.224.131 via ssh
show less
Multiple unauthorized SSH attempts over 2 days. Log entries like this:2026-09-28 14:29:07 firewall,i ...
show moreMultiple unauthorized SSH attempts over 2 days. Log entries like this:2026-09-28 14:29:07 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac E4:8D:8C:35:67:B2, proto TCP (SYN), 45.198.8.98:52790->xxx.xxx.xxx.xxx:50022, len 60
Blocked.
show less
Attempt at router takeover chaining two Mikrotik RouterOS SSH bugs. Resulted in unauthenticated user ...
show moreAttempt at router takeover chaining two Mikrotik RouterOS SSH bugs. Resulted in unauthenticated user being able to add an admin user.
Log entry:
03:41:22 firewall,info SSH_ATTEMPT: input: in:ether24 out:(unknown 0), connection-state:new src-mac e4:8d:8c:35:67:b2, proto TCP (SYN), 130.94.122.219:51278->xxx.xxx.xxx.xxx:50022, len 60
03:41:34 system,info user admin_obsq added by 0
03:44:25 system,error,critical login failure for user -2 from 130.94.122.219 via ssh
ref: https://cyberinsider.com/mikrotik-routeros-bugs-actively-exploited-in-device-takeover-attacks/
show less
Made multiple attempts to establish an L2TP tunnel to our router.
Log entries follow:
05:20:31 l2t ...
show moreMade multiple attempts to establish an L2TP tunnel to our router.
Log entries follow:
05:20:31 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:32 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:33 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:33 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:33 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:20:33 l2tp,info first L2TP UDP packet received from 141.255.165.70
05:21:04 l2tp,info first L2TP UDP packet received from 141.255.165.70
show less
Bad actors at it again. Made 16 attacks yesterday. They rotate between .197 and .198. Am expecting m ...
show moreBad actors at it again. Made 16 attacks yesterday. They rotate between .197 and .198. Am expecting more today. Reporting to bshield doesn't seem to do anything. These have been ongoing since July with hundreds of attacks..
show less
Bad actors at it again. Made 32 attacks yesterday. They rotate between .197 and .198. Am expecting m ...
show moreBad actors at it again. Made 32 attacks yesterday. They rotate between .197 and .198. Am expecting more today. Reporting to bshield doesn't seem to do anything. These have been ongoing since July.
show less
SSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.