SSH password guessing

Follow

Link Dupont

• October 21, 2026 15:53

I've been seeing consistent alarms of "Device 192.168.1.243 appears to be guessing SSH passwords on 140.82.114.3". It's always the same internal device, and always 140.82.114.3. Firewalla reports that IP as being owned by GitHub. I host a lot of repositories on GitHub, so it seems reasonable that my device would be making a lot of SSH connections to GitHub. This is a rather alarming alarm (no pun intended) though. Can I see any more detail about these password guessing attempts to figure out what software running on my device is attempting all these connections?

0

• 

  Firewalla

  • October 21, 2026 16:49

  Firewalla detects SSH password guessing by looking at the login attempts. So in your case, it might be something with 192.168.1.243 trying to talk to 140.82.114.3, and firewalla saw some failure or suspicious attempts. (as with any security detection, there will be false positives)

  The best way to see is probably looking at your ssh logs on 192.168.1.243, and see all the ssh sessions or failures. The network layer may be harder to find the details

   

  0

  Comment actions Permalink

Please sign in to leave a comment.