157.230.104.54

Basic Info

City: Frankfurt am Main

Region: Hesse

Country: Germany

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	As always with digital ocean	2019-10-17 03:13:11

Comments on same subnet:

IP	Type	Details	Datetime
157.230.104.94	attackspam	Invalid user ubnt from 157.230.104.94 port 40546	2020-09-16 02:27:23
157.230.104.94	attackbotsspam	Scanning	2020-09-15 18:23:23
157.230.104.185	attack	Automatic report - Banned IP Access	2020-08-07 18:51:10
157.230.104.185	attackbotsspam	157.230.104.185 - - [03/Aug/2020:13:26:19 +0100] "POST /wp-login.php HTTP/1.1" 200 1875 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 157.230.104.185 - - [03/Aug/2020:13:26:22 +0100] "POST /wp-login.php HTTP/1.1" 200 1875 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 157.230.104.185 - - [03/Aug/2020:13:26:26 +0100] "POST /wp-login.php HTTP/1.1" 200 1875 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-03 22:25:01
157.230.104.185	attackbotsspam	Malicious/Probing: /wp-login.php	2020-08-03 02:19:52
157.230.104.185	attackspam	157.230.104.185 - - [23/Jul/2020:05:58:45 +0200] "GET /wp-login.php HTTP/1.1" 200 6060 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 157.230.104.185 - - [23/Jul/2020:05:58:47 +0200] "POST /wp-login.php HTTP/1.1" 200 6311 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 157.230.104.185 - - [23/Jul/2020:05:58:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-07-23 12:54:42
157.230.104.51	attack	Port scanning [2 denied]	2020-06-14 15:15:14
157.230.104.51	attackspambots	Jun 9 23:19:20 debian kernel: [636516.139741] [UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:be:e4:65:08:e8:4f:6e:48:0c:08:00 SRC=157.230.104.51 DST=89.252.131.35 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=20266 PROTO=TCP SPT=32767 DPT=8545 WINDOW=1024 RES=0x00 SYN URGP=0	2020-06-10 05:57:17
157.230.104.176	attackbotsspam	Jul 30 18:28:17 server sshd\[74621\]: Invalid user kathleen from 157.230.104.176 Jul 30 18:28:17 server sshd\[74621\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.104.176 Jul 30 18:28:19 server sshd\[74621\]: Failed password for invalid user kathleen from 157.230.104.176 port 46766 ssh2 ...	2019-10-09 19:16:27
157.230.104.176	attackspam	Aug 8 22:48:22 XXX sshd[29748]: Invalid user ma from 157.230.104.176 port 58758	2019-08-09 09:17:56
157.230.104.176	attackspam	Automatic report - Banned IP Access	2019-08-04 03:06:55
157.230.104.176	attackspambots	Jul 5 09:13:30 pornomens sshd\[32118\]: Invalid user tim from 157.230.104.176 port 59632 Jul 5 09:13:30 pornomens sshd\[32118\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.104.176 Jul 5 09:13:32 pornomens sshd\[32118\]: Failed password for invalid user tim from 157.230.104.176 port 59632 ssh2 ...	2019-07-05 16:00:29

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 157.230.104.54
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6228
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;157.230.104.54.			IN	A

;; AUTHORITY SECTION:
.			438	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019101601 1800 900 604800 86400

;; Query time: 118 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Oct 17 03:13:08 CST 2019
;; MSG SIZE  rcvd: 118

Host info

54.104.230.157.in-addr.arpa domain name pointer fra1.squid.digitalocean.18.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
54.104.230.157.in-addr.arpa	name = fra1.squid.digitalocean.18.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
87.103.120.250	attackbots	Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-12T18:44:38Z and 2020-09-12T18:52:10Z	2020-09-13 03:18:50
47.88.153.61	attackbots	Sep 12 15:27:30 sip sshd[25719]: Failed password for root from 47.88.153.61 port 58664 ssh2 Sep 12 15:41:47 sip sshd[29477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.88.153.61 Sep 12 15:41:49 sip sshd[29477]: Failed password for invalid user apache from 47.88.153.61 port 35243 ssh2	2020-09-13 03:20:00
213.202.101.114	attackspam	Sep 12 12:22:32 propaganda sshd[26662]: Connection from 213.202.101.114 port 45624 on 10.0.0.161 port 22 rdomain "" Sep 12 12:22:32 propaganda sshd[26662]: Connection closed by 213.202.101.114 port 45624 [preauth]	2020-09-13 03:43:31
88.18.162.144	attack	Port scan denied	2020-09-13 03:29:08
203.95.212.41	attackbotsspam	$f2bV_matches	2020-09-13 03:24:27
168.205.124.246	attackbotsspam	Invalid user admin from 168.205.124.246 port 36954	2020-09-13 03:43:08
49.248.84.138	attack	Connection to SSH Honeypot - Detected by HoneypotDB	2020-09-13 03:33:58
190.214.21.185	attackspambots	Icarus honeypot on github	2020-09-13 03:31:38
88.157.229.58	attackbots	Time: Sat Sep 12 17:49:56 2020 +0000 IP: 88.157.229.58 (PT/Portugal/a88-157-229-58.static.cpe.netcabo.pt) Failures: 5 (sshd) Interval: 3600 seconds Blocked: Permanent Block [LF_SSHD] Log entries: Sep 12 17:39:24 ca-29-ams1 sshd[9401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.157.229.58 user=root Sep 12 17:39:26 ca-29-ams1 sshd[9401]: Failed password for root from 88.157.229.58 port 49024 ssh2 Sep 12 17:46:02 ca-29-ams1 sshd[10277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.157.229.58 user=root Sep 12 17:46:04 ca-29-ams1 sshd[10277]: Failed password for root from 88.157.229.58 port 58866 ssh2 Sep 12 17:49:55 ca-29-ams1 sshd[10792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=88.157.229.58 user=root	2020-09-13 03:35:41
104.206.128.22	attack	TCP (SYN) 104.206.128.22:50290 -> port 21, len 44	2020-09-13 03:14:58
34.80.223.251	attackbotsspam	SSH Brute Force	2020-09-13 03:17:17
116.74.116.123	attackbots	Port Scan detected! ...	2020-09-13 03:14:22
222.186.175.183	attackspambots	Sep 12 21:37:53 host sshd\[15757\]: Unable to negotiate with 222.186.175.183 port 12986: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 \[preauth\]	2020-09-13 03:42:07
51.254.0.99	attackspambots	Sep 12 12:18:51 vlre-nyc-1 sshd\[8075\]: Invalid user max from 51.254.0.99 Sep 12 12:18:51 vlre-nyc-1 sshd\[8075\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.0.99 Sep 12 12:18:54 vlre-nyc-1 sshd\[8075\]: Failed password for invalid user max from 51.254.0.99 port 35474 ssh2 Sep 12 12:25:55 vlre-nyc-1 sshd\[8305\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.0.99 user=root Sep 12 12:25:57 vlre-nyc-1 sshd\[8305\]: Failed password for root from 51.254.0.99 port 48928 ssh2 ...	2020-09-13 03:09:23
208.187.163.227	attackspambots	2020-09-11 11:39:13.597606-0500 localhost smtpd[48243]: NOQUEUE: reject: RCPT from unknown[208.187.163.227]: 554 5.7.1 Service unavailable; Client host [208.187.163.227] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS; from= to= proto=ESMTP helo=	2020-09-13 03:39:45

Recently Reported IPs

120.24.18.183	35.231.103.115	92.90.217.93	190.111.85.95
18.210.70.75	164.146.138.74	201.142.254.179	156.68.202.69
188.110.47.3	62.47.159.121	123.144.179.249	50.252.139.158
111.143.140.90	39.108.239.24	134.41.37.243	209.149.220.113
171.217.172.127	66.115.68.65	1.160.196.201	106.227.80.99