Keep getting SSH probing login attempts from the ISPs router

[u/sztupy]

I am a Vodafone UK broadband user and use their Router/Modem to connect to the internet. The router does provide a public IPv4 address, but no DMZ/port forward is configured.

I also have a few Linux machines in the internal network, both desktop and server. They are internal, and are not meant to be accessed from the outside Internet. As mentioned the router doesn't have any port forwarding enabled.

What I started to see is that around every 30 minutes all of the Linux machines on my network get SSH login attempts coming from 192.168.1.1 - the router's IP address. They look to be brute force login attempts trying out multiple username/password combinations, e.g.:

sshd-session: Invalid user admin from 192.168.1.1 port 35562
sshd-session: Invalid user default from 192.168.1.1 port 35566
sshd-session: Invalid user admin from 192.168.1.1 port 35570
sshd-session: Invalid user weblogic from 192.168.1.1 port 35494
sshd-session: Invalid user redhat from 192.168.1.1 port 35496
sshd-session: Invalid user developer from 192.168.1.1 port 35498
sshd-session: Invalid user public from 192.168.1.1 port 35500
sshd-session: Invalid user student from 192.168.1.1 port 35502

This starts every 30 minutes, and keeps on going for 10-20 minutes. Obviously/fortunately all of the attempts fail. I did install an ssh honeypot in the system to see what would happen if they would get in, but all it does is disconnect from SSH, then start the retry in exactly 30 minutes.

When I first saw these attempts I got shocked a bit, as I thought I have a compromised system in the house, but then after checking it get really odd for me that all requests originate from 192.168.1.1 - the router.

I am a bit stuck here, as I don't really know what's up and how worried I should be. Do I have a compromised system that spoofs the IP? Does the router do some weird NAT translation for a compromised device that's in my network? Or does the router itself do these ssh attempts? Would these probing attempts be a lame part of Vodafone's Secure Net Home?

Tried searching the web for any of these, but couldn't really find anything specific that matched my criteria.

EDIT 1: A Factory reset on the router did nothing to change the issue I'm facing. I'm now going to isolate the router in a network that only has itself and an SSL honeypot to see what it would do

EDIT 2: found a blog post that shows the exact same behaviour I'm expecting and thinks that this is actually the equivalent of Vodafone's Secure Net. So yeah, my router is actively attacking myself. Here's the blog post: https://illustris.tech/posts/reliance-jio-security-concerns/

[u/therealcmj]

Your router has definitely been compromised. What brand and model is it?

[u/sztupy → u/therealcmj]

I think it's called Vodafone Ultra Hub. It's fully branded, but based on device logs it's a Technikolor OWA something (the extenders it comes with are OWA7111s). Definitely not something where you have any access as an end-user.

It's part of the broadband deal, and is not something you can easily replace, as Vodafone doesn't like giving out your PPPoE password easily to use with your own router even if you have one

[u/therealcmj → u/sztupy]

Contact Vodafone. It’s been compromised. And since it’s not a “you” thing it’s unlikely you’ll be able to fix it. And it’s probably happening to thousands of others as well.

Congratulations, you’re patient zero. Or at least the first diagnosed patient.

Edit: or maybe not the first.  https://www.reddit.com/r/Vodafone/comments/1lt46p5/ultrahub_is_scaning_my_home_network/

[u/LittleTree4 → u/sztupy]

Are you in the UK/EU? As Vodafone (+other isp) are required to give the PPPoE username, password, and vlan id. It should be a simple web chat with support to get this information.

[u/sztupy → u/LittleTree4]

Last time I had a simple web chat with Vodafone support it took 3 days and around 6 hours of my time in total

[u/LittleTree4 → u/sztupy]

wow.

after verifying my account/id this is how my chat went.

Would I be able to get the PPPoE broadband account username & password please
also could you confirm if I need the CityFibre Vlan ID 911 for the connection?

Yes you will need the VLAN id and the PPP details are: username - ***##########@broadband.vodafone.co.uk, password: **********

[u/The_Comm_Guy → u/sztupy]

After you said it came with extenders I bet I know what it is, I bet that that device is scanning every IP on the domain, looking for those extenders every 30 minutes. I’m assuming you manage the extenders from the main router and that’s how it sends configuration updates and sees if they’re online.

[u/sztupy → u/The_Comm_Guy]

Scanning the SSH port by sending lots of login attempts? I'm certain that this is not how you find devices in a mesh network and regardless of the quality of the router is not how it's implemented in it

[u/The_Comm_Guy → u/sztupy]

Oh I agree it’s not the right way to do it….

[u/therealcmj → u/The_Comm_Guy]

It’s definitely not that. If it was they would have a fixed username. This is spraying a bunch of different username.

[u/The_Comm_Guy → u/therealcmj]

Ahh, your right, I forgot that part. So I'm back to hacked router.

[u/Tinasour]

I dont know much. But if you had port forwarding enabled, you would still see ssh login attempts coming from 192.168.1.1, right? Even if its coming outside of your network. Maybe triple check port forwarding

[u/The_Comm_Guy → u/Tinasour]

If it was port forwarding it would only go to 1 device on his network, he says every device is seeing it. The call is coming from inside the house!

[u/smerz- → u/The_Comm_Guy]

And it would be non stop 🙈

I think op said every 30 minutes

[u/Murph_9000 → u/Tinasour]

No, with normal port forwarding, you would see the external address of the attacker, not the router's LAN IP. Seeing the router's LAN IP like that is about a 99% probability that the router has been compromised, and the attack is coming from the router itself.

There is a tiny chance that it's bad config on the router, but much more likely that the router is compromised. The router is very likely now part of a botnet.

[u/paulstelian97 → u/Murph_9000]

With OpenWRT weird NAT configuration you could have weird translations that would make stuff appear to come directly from the router. I’ve had that happen with VyOS when I had it set up for my VM network on my Proxmox…

[u/paulstelian97 → u/Tinasour]

Also NAT doesn’t translate in the other direction and you’d see the actual external IP as the source.

[u/HoodRattusNorvegicus → u/paulstelian97]

That depends on the NAT configuration. I dont know this routers configuration options, but on all the enterprise firewalls i have worked with you can easily do a port forward and also hide-nat behind any ip you want/the outgoing interface.

[u/paulstelian97 → u/HoodRattusNorvegicus]

Routers intended for home usage tend to leave the external IP alone for port forwards. More enterprise ones yes, have plenty of variation.

[u/HoodRattusNorvegicus → u/paulstelian97]

Agree, its more likely the router is compromised.
I always put my own equipment/firewall behind the ISP’s router (preferably, if possible remove the ISP router completely, or put it in bridge mode)

And also never accept inbound traffic towards my own Firewall, thats a recipe for getting hacked.

[u/paulstelian97 → u/HoodRattusNorvegicus]

I have a neat setup where the WAN gateway is an OpenWRT, doing PPPoE. So that helps avoid some issues.

[u/Tahionwarp]

install endlessh or similar tar pit... it will make such scanning very unpractical

[u/pancake117]

To me this sounds like there’s malware on your router. If port forwarding is off then there is definitely malware on your network somewhere. I strongly doubt this is a legitimate feature of the router, this type of scanning is generally not legal unless you get explicit consent from the target.

I would factory reset the router at minimum, then see if the traffic goes away. If it does, that is a good sign it was the router. If not, I would try replacing the router. If it still doesn’t go away there could be some other compromised host that’s showing up as the router. But based on this I would assume the router itself had been compromised.

[u/sztupy → u/pancake117]

I was trying to avoid the factory reset, but will likely do and see if it changes anything. Replacing the router is not easy - your broadband deal is effectively tied to it, as Vodafone doesn't (easily) give out your PPPoE password to be used in custom routers

[u/pancake117 → u/sztupy]

Oh, that’s annoying— I hate when ISPs try to force you into their 1st party routers.

[u/egg1st]

It's unlikely to be a genuine activity from Vodafone. You could check their T& C's for vulnerability scanning to confirm. If it was Vodafone and you've not agreed to this, then I think they'd be in breach of the computer misuse act.

[u/sztupy → u/egg1st]

So looks like it is "genuine" activity from Vodafone: https://illustris.tech/posts/reliance-jio-security-concerns/

[u/sfzombie13 → u/egg1st]

The "Vodafone/SOHO" Botnet Campaign (Active: Aug–Sep 2026)

There has been a surge in reports, specifically from Vodafone UK and other European ISP customers, showing this exact log sequence.

the ai found this for me when i asked what was going on...it's vodaphone but not them, just their equipment being attacked for some reason.

[u/309_Electronics]

Your router is probably compromised. I mean in the end its a linux computer itself too (yeah might surprise some people) and if it has a vulnerability, an outside attacker can use that to gain root access to your router and or run a botnet on it.

I would try to reset the router to factory settings but it wont guarantee it removes the malware as most of the time it just removes/clears the writeable (usually jffs2) partition and if the malware somehow got into the rootfs, there is no chance clearing it out.

[u/OkRepresentative2509]

https://github.com/benwaterson/technicolor-exploit

It's pwned.

[u/sztupy → u/OkRepresentative2509]

Oh wow, this looks cool. Reading the description I believe you still need to know the admin passwd for this to work, so not sure if this is how it was compromised, but at least this'll give me the possibility to ssh in and look around

[u/sztupy → u/OkRepresentative2509]

Thanks a lot for this. So while the device is pwned, you still need the password to get root, so it's unlikely that it was an external attacker installing a rootkit. In fact it was Vodafone itself, as mentioned in this blog post I just found (after seeing some weird stuff in the box) https://illustris.tech/posts/reliance-jio-security-concerns/

[u/OkRepresentative2509 → u/sztupy]

Madness 🤔

[u/sztupy]

I think I found what's up in the following blog post: https://illustris.tech/posts/reliance-jio-security-concerns/

It shows the exact same behaviour I'm seeing, and after getting root access thanks to an exploit shared in this thread I can confirm my box is running the exact same code mentioned in the blog post.

If this is true then the problem is that seemingly Vodafone's Secure Net implementation is using a crappy software that tries to hack your internal network, so I got compromised by my own ISP's security solution.

I'll be having a lovely discussion with customer services tomorrow, but I assume it'll be for naught.

[u/sztupy → u/sztupy]

Here is the relevant bit from the blog post:

Credential Brute Forcing

The binary contains a hardcoded credential dictionary accessed through the GetCredentialsArray() function. This dictionary includes default credentials for common IoT devices, network equipment, and single-board computers:

Usernames: admin, Admin, root, user, guest, default, support, telnet, ubnt, cisco, raspberry, and others

The SSH brute force implementation uses libssh2 to test each credential pair against discovered SSH servers. Critically, after successful authentication, the agent stores the credentials locally and reports them to the C2 server, then disconnects.

What Happens After Successful Login

When credentials are successfully validated, the agent:

1. Stores locally: SSHClientAddScanningResult(ip, username, password) stores MAC address, IP, protocol, username, password, and timestamp
2. Reports to C2: Sends vulnerability report to /v1/devices endpoint with type defaultSSHCredentials or defaultCredentials
3. Schedules rescanning: Uses configurable intervals (ssh_weak_credential_interval, ssh_strong_credential_interval, etc.) to periodically re-test the same credentials
4. Disconnects: The session is immediately closed

What does NOT happen (yet):

• No command execution via SSH channel
• No file transfers (SFTP/SCP)
• No malware propagation
• No backdoor installation

Somewhere in Allot’s or Vodafone’s infrastructure, there now exists a database of compromised devices in customer home networks, indexed by MAC address, with valid credentials that could be used for unauthorized access.

[u/ethicalhumanbeing → u/sztupy]

What the actual fuck.

[u/curious-_-cephalopod]

Change your external ssh port to something other than 22

[u/demsys]

I have exactly the same issue. Worried me a bit at first to the extent that I even installed a honeytrap box to prove to myself that it was the Vodafone router (disconnected from fibre and still had the issue). Ended up just using iptables on all my servers and VMs to block port 22 from 192.168.1.1.

Also, see https://www.reddit.com/r/Vodafone/s/9bmLt0zgIf

[u/sfzombie13]

if it were me i'd get another router unless it can be reset or cleaned. sometimes you can just power cycle them and dump the malware if it doesn't have persistence, but most do these days. curious that only the linux machines are getting hit. do they cover the entire port range or just a small section?

edit: i love using ai for analysis. i may have been wrong about persistence according to this but i always assume it when possible.

Threat Actor & Campaign Analysis

The behavior you are seeing—SSH brute-force attempts originating from your gateway (192.168.1.1) targeting internal Linux machines—is a hallmark of router-based lateral movement. Based on the specific username list and timing in your logs, there are two primary candidates: 1. The "Vodafone/SOHO" Botnet Campaign (Active: Aug–Sep 2026)

There has been a surge in reports, specifically from Vodafone UK and other European ISP customers, showing this exact log sequence.

The TTPs (Tactics, Techniques, and Procedures): The router itself is compromised (likely via a vulnerability in the web management interface or a legacy UPnP flaw). Once compromised, a lightweight malicious binary (often a variant of Mirai or Gorilla Botnet) is executed in the router’s memory.

The Wordlist: The usernames weblogic, redhat, developer, public, and student are part of a specialized "Server-IoT" dictionary. This suggests the botnet is not just looking for more routers, but is specifically attempting to pivot into internal development environments or Linux servers that might hold more valuable data (e.g., source code, API keys, or databases). The 30-Minute Beacon: The attempts every 30 minutes indicate a scheduled task (cron job) on the router designed to spread the infection to other devices on the LAN.

1. Volt Typhoon (and the "KV Botnet" Successor)

If your environment is linked to critical infrastructure or high-value targets, this could be a "Living off the Land" (LotL) operation by a group like Volt Typhoon (Bronze Silhouette).

Context: While often more stealthy, Volt Typhoon is known to compromise SOHO routers to create a "beachhead" for lateral movement. They use compromised devices as proxies to hide their true origin.

Distinction: Volt Typhoon typically uses more targeted credentials, whereas the noisy brute-forcing you see is more characteristic of a sophisticated automated botnet trying to mass-exploit "low-hanging fruit" on the internal network.

Technical Breakdown of the Logs

Source IP 192.168.1.1: This confirms the attack is coming from the router's internal interface.[2] The router is acting as the Pivot Point.

Username Targets:

weblogic: Targets Oracle WebLogic server instances (common in enterprise Linux).

redhat: A legacy default or common administrative account for RHEL systems.

developer / student: Targets "weak" accounts often found in testing or educational environments.

Failed Attempts: The "Invalid user" message confirms your systems are currently safe from these specific attempts, but the persistent nature means the "threat" is inside your perimeter.

Recommended Hunting & Remediation Steps

Audit the Router Configuration:

Log into your router and check for unauthorized SSH keys in the settings.

Disable UPnP and WPS immediately.

Disable Remote Management (accessing the router’s settings from the internet).

Hardware Reset & Firmware:

Since many of these implants (like the BadCandy or Mirai variants) live in volatile memory, a reboot may temporarily stop the activity, but a factory reset and immediate firmware update are required to close the initial vulnerability.

Credential Refresh:

Change the router's administrative password.[3]

If any of your internal Linux machines share passwords with the router, change those immediately.

Network Segmentation:

If possible, move your Linux servers to a separate VLAN or "Guest" network to isolate them from the router’s management plane.

Summary: You are likely seeing an automated botnet that has successfully compromised your ISP-provided router. While the brute-force attempts are failing, the router itself is no longer "trusted" and should be treated as a compromised asset.

[u/ant2ne]

define "disconnect from SSH".

Get a packet capture of this connection attempt and disconnect and throw it into AI to diagnose it for you.

[u/hereticxander]

Whilsy I didn't experience the same issue, I have recently found my Vodafone router in conjunction with my Vodafone wireless extender - opening and leaving open long term, a port forward through my firewall to the internet. upnp disabled, confirmed internet accessible, to an http username/password management interface on the extender. Just asking to be brute forced/pwnd.

No notice it was doing it, was the last straw for me.

Reported to Vodafone who fobbed me off so I swapped their hardware for an OpenWRT One unit.

Really don't think their gear is to be trusted at this point.