145.239.29.13 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Poland

Internet Service Provider: OVH SAS

Hostname: unknown

Organization: OVH SAS

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Jun 25 08:57:12 nextcloud sshd\[17245\]: Invalid user saurabh from 145.239.29.13 Jun 25 08:57:12 nextcloud sshd\[17245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.29.13 Jun 25 08:57:14 nextcloud sshd\[17245\]: Failed password for invalid user saurabh from 145.239.29.13 port 44016 ssh2 ...	2019-06-25 19:58:00

Type

Details

Datetime

attack

Jun 25 08:57:12 nextcloud sshd\[17245\]: Invalid user saurabh from 145.239.29.13
Jun 25 08:57:12 nextcloud sshd\[17245\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.29.13
Jun 25 08:57:14 nextcloud sshd\[17245\]: Failed password for invalid user saurabh from 145.239.29.13 port 44016 ssh2
...

2019-06-25 19:58:00

Comments on same subnet:

IP	Type	Details	Datetime
145.239.29.12	spam	Exploit.RTF-ObfsStrm.Gen	2025-01-23 20:00:43
145.239.29.217	attackspam	wp-login.php	2020-10-06 02:01:23
145.239.29.217	attack	Attempt to hack Wordpress Login, XMLRPC or other login	2020-10-05 17:49:52
145.239.29.217	attackbotsspam	(PERMBLOCK) 145.239.29.217 (PL/Poland/ip-145-239-29.eu) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:	2020-09-29 23:35:29
145.239.29.71	attack	(mod_security) mod_security (id:210492) triggered by 145.239.29.71 (FR/France/-): 5 in the last 3600 secs	2020-09-25 03:30:39
145.239.29.71	attack	(mod_security) mod_security (id:210492) triggered by 145.239.29.71 (FR/France/-): 5 in the last 3600 secs	2020-09-24 19:15:18
145.239.29.217	attackbotsspam	145.239.29.217 - - [21/Sep/2020:06:50:02 +0100] "POST /wp-login.php HTTP/1.1" 200 1861 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [21/Sep/2020:06:50:02 +0100] "POST /wp-login.php HTTP/1.1" 200 1839 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [21/Sep/2020:06:50:03 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-21 15:37:58
145.239.29.217	attackbots	145.239.29.217 - - [20/Sep/2020:21:50:22 +0100] "POST /wp-login.php HTTP/1.1" 200 2520 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [20/Sep/2020:21:50:23 +0100] "POST /wp-login.php HTTP/1.1" 200 2572 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [20/Sep/2020:21:50:23 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-21 07:31:58
145.239.29.217	attack	145.239.29.217 - - [14/Sep/2020:08:51:41 +0200] "GET /wp-login.php HTTP/1.1" 200 8558 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [14/Sep/2020:08:51:44 +0200] "POST /wp-login.php HTTP/1.1" 200 8809 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [14/Sep/2020:08:51:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-14 23:59:46
145.239.29.217	attackspam	145.239.29.217 - - [14/Sep/2020:08:51:41 +0200] "GET /wp-login.php HTTP/1.1" 200 8558 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [14/Sep/2020:08:51:44 +0200] "POST /wp-login.php HTTP/1.1" 200 8809 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [14/Sep/2020:08:51:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-14 15:45:13
145.239.29.217	attack	145.239.29.217 - - [13/Sep/2020:18:59:28 +0100] "POST /wp-login.php HTTP/1.1" 200 2401 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [13/Sep/2020:18:59:29 +0100] "POST /wp-login.php HTTP/1.1" 200 2415 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 145.239.29.217 - - [13/Sep/2020:18:59:29 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-14 07:38:29
145.239.29.217	attackspam	GET /wp-login.php HTTP/1.1	2020-09-14 00:21:04
145.239.29.217	attackspambots	xmlrpc attack	2020-09-13 16:09:21
145.239.29.217	attackbotsspam	"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:	2020-09-13 07:53:02
145.239.29.217	attackspam	ENG,DEF GET /wp-login.php	2020-09-06 02:42:44

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 145.239.29.13
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64873
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;145.239.29.13.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019040600 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Sat Apr 06 19:40:44 +08 2019
;; MSG SIZE  rcvd: 117

Host info

13.29.239.145.in-addr.arpa domain name pointer ip-145-239-29.eu.

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

Non-authoritative answer:
13.29.239.145.in-addr.arpa	name = ip-145-239-29.eu.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
103.8.119.166	attackbots	Oct 8 08:04:51 vps01 sshd[3920]: Failed password for root from 103.8.119.166 port 58332 ssh2	2019-10-08 14:24:24
119.52.253.2	attack	2019-10-08T04:38:35.294080abusebot-4.cloudsearch.cf sshd\[22191\]: Invalid user www from 119.52.253.2 port 55036	2019-10-08 14:25:18
46.45.160.75	attackbotsspam	WordPress wp-login brute force :: 46.45.160.75 0.048 BYPASS [08/Oct/2019:14:57:02 1100] [censored_4] "POST /wp-login.php HTTP/1.1" 200 3989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-10-08 14:13:53
218.188.210.214	attackbots	Oct 8 08:09:07 vps691689 sshd[24884]: Failed password for root from 218.188.210.214 port 36682 ssh2 Oct 8 08:14:14 vps691689 sshd[25012]: Failed password for root from 218.188.210.214 port 49446 ssh2 ...	2019-10-08 14:15:06
196.220.34.80	attackspambots	10/07/2019-23:57:19.086294 196.220.34.80 Protocol: 6 ET SCAN NMAP -sS window 1024	2019-10-08 14:00:14
106.13.117.96	attackspam	Oct 8 05:47:57 MainVPS sshd[20273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.117.96 user=root Oct 8 05:47:59 MainVPS sshd[20273]: Failed password for root from 106.13.117.96 port 60700 ssh2 Oct 8 05:52:22 MainVPS sshd[20596]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.117.96 user=root Oct 8 05:52:24 MainVPS sshd[20596]: Failed password for root from 106.13.117.96 port 40596 ssh2 Oct 8 05:56:51 MainVPS sshd[20909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.117.96 user=root Oct 8 05:56:52 MainVPS sshd[20909]: Failed password for root from 106.13.117.96 port 48688 ssh2 ...	2019-10-08 14:23:56
14.29.239.215	attackbotsspam	Oct 8 08:06:22 SilenceServices sshd[7812]: Failed password for root from 14.29.239.215 port 39802 ssh2 Oct 8 08:10:16 SilenceServices sshd[9041]: Failed password for root from 14.29.239.215 port 40894 ssh2	2019-10-08 14:20:08
139.59.5.65	attackbotsspam	[ssh] SSH attack	2019-10-08 13:46:19
36.226.161.134	attackspam	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/36.226.161.134/ TW - 1H : (327) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : TW NAME ASN : ASN3462 IP : 36.226.161.134 CIDR : 36.226.0.0/16 PREFIX COUNT : 390 UNIQUE IP COUNT : 12267520 WYKRYTE ATAKI Z ASN3462 : 1H - 22 3H - 42 6H - 66 12H - 145 24H - 316 DateTime : 2019-10-08 05:56:58 INFO : Port Scan TELNET Detected and Blocked by ADMIN - data recovery	2019-10-08 14:18:20
192.227.136.67	attack	2019-10-08T07:02:15.498328 sshd[24522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.136.67 user=root 2019-10-08T07:02:17.802620 sshd[24522]: Failed password for root from 192.227.136.67 port 59760 ssh2 2019-10-08T07:09:25.384163 sshd[24576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.136.67 user=root 2019-10-08T07:09:27.387032 sshd[24576]: Failed password for root from 192.227.136.67 port 55764 ssh2 2019-10-08T07:16:24.662667 sshd[24693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.227.136.67 user=root 2019-10-08T07:16:26.520013 sshd[24693]: Failed password for root from 192.227.136.67 port 51558 ssh2 ...	2019-10-08 13:48:18
216.118.228.234	attackbotsspam	Oct 8 07:57:25 vmanager6029 sshd\[9623\]: Invalid user 12345@Admin from 216.118.228.234 port 23863 Oct 8 07:57:25 vmanager6029 sshd\[9623\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.118.228.234 Oct 8 07:57:26 vmanager6029 sshd\[9623\]: Failed password for invalid user 12345@Admin from 216.118.228.234 port 23863 ssh2	2019-10-08 14:20:38
183.134.199.68	attack	Oct 8 06:05:20 hcbbdb sshd\[23224\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.134.199.68 user=root Oct 8 06:05:21 hcbbdb sshd\[23224\]: Failed password for root from 183.134.199.68 port 53634 ssh2 Oct 8 06:09:03 hcbbdb sshd\[23664\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.134.199.68 user=root Oct 8 06:09:05 hcbbdb sshd\[23664\]: Failed password for root from 183.134.199.68 port 55511 ssh2 Oct 8 06:12:51 hcbbdb sshd\[24102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.134.199.68 user=root	2019-10-08 14:13:21
37.59.37.69	attack	Oct 8 07:16:40 ns41 sshd[8468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.59.37.69	2019-10-08 14:10:57
112.112.102.79	attackbots	Apr 26 20:07:56 ubuntu sshd[3638]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.112.102.79 Apr 26 20:07:58 ubuntu sshd[3638]: Failed password for invalid user administrat\303\266r from 112.112.102.79 port 4716 ssh2 Apr 26 20:10:39 ubuntu sshd[3947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.112.102.79 Apr 26 20:10:42 ubuntu sshd[3947]: Failed password for invalid user yn from 112.112.102.79 port 4717 ssh2	2019-10-08 14:26:51
92.46.250.118	attackbots	Oct 7 22:44:21 mailman postfix/smtpd[8979]: NOQUEUE: reject: RCPT from unknown[92.46.250.118]: 554 5.7.1 Service unavailable; Client host [92.46.250.118] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/92.46.250.118; from= to= proto=ESMTP helo=<[92.46.250.118]> Oct 7 22:57:09 mailman postfix/smtpd[9088]: NOQUEUE: reject: RCPT from unknown[92.46.250.118]: 554 5.7.1 Service unavailable; Client host [92.46.250.118] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/92.46.250.118; from= to= proto=ESMTP helo=<[92.46.250.118]>	2019-10-08 14:06:29

Recently Reported IPs

182.23.95.50	95.24.23.68	112.133.251.146	178.128.76.41
222.252.50.108	149.56.140.219	14.232.250.115	189.7.121.28
180.248.177.203	209.97.143.239	182.73.11.98	78.107.149.14
183.80.214.196	212.47.226.52	120.102.232.1	51.254.39.23
60.250.103.199	36.91.165.25	183.83.86.127	41.174.134.172