162.243.145.44

Basic Info

City: San Francisco

Region: California

Country: United States

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: DigitalOcean, LLC

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	12221/tcp 42626/tcp 1400/tcp... [2019-06-13/08-12]50pkt,44pt.(tcp),3pt.(udp)	2019-08-13 00:19:56
attackbots	404 NOT FOUND	2019-08-04 11:28:51
attackspambots	21/tcp 8123/tcp 34275/tcp... [2019-04-30/06-28]49pkt,39pt.(tcp),5pt.(udp)	2019-06-30 12:01:03

Comments on same subnet:

IP	Type	Details	Datetime
162.243.145.195	attack	162.243.145.195 - - [01/Oct/2020:17:05:46 +0100] "POST /wp-login.php HTTP/1.1" 200 2596 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:17:05:48 +0100] "POST /wp-login.php HTTP/1.1" 200 2580 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:17:05:49 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-10-02 00:44:39
162.243.145.195	attackbots	162.243.145.195 - - [01/Oct/2020:09:22:59 +0100] "POST /wp-login.php HTTP/1.1" 200 2862 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:09:23:00 +0100] "POST /wp-login.php HTTP/1.1" 200 2831 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:09:23:02 +0100] "POST /wp-login.php HTTP/1.1" 200 2866 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-10-01 16:50:20
162.243.145.195	attack	162.243.145.195 - - [21/Sep/2020:16:10:29 +0200] "GET /wp-login.php HTTP/1.1" 200 8558 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [21/Sep/2020:16:10:31 +0200] "POST /wp-login.php HTTP/1.1" 200 8809 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [21/Sep/2020:16:10:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-22 00:20:13
162.243.145.195	attack	Automatic report generated by Wazuh	2020-09-21 16:01:43
162.243.145.195	attackspam	CMS (WordPress or Joomla) login attempt.	2020-09-21 07:55:55
162.243.145.195	attackspam	Sep 20 16:08:16 10.23.102.230 wordpress(www.ruhnke.cloud)[41055]: Blocked authentication attempt for admin from 162.243.145.195 ...	2020-09-20 22:49:49
162.243.145.195	attackbotsspam	162.243.145.195 - - \[20/Sep/2020:08:30:11 +0200\] "POST /wp-login.php HTTP/1.0" 200 9641 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[20/Sep/2020:08:30:13 +0200\] "POST /wp-login.php HTTP/1.0" 200 9639 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[20/Sep/2020:08:30:15 +0200\] "POST /wp-login.php HTTP/1.0" 200 9487 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-09-20 14:40:56
162.243.145.195	attack	162.243.145.195 - - \[19/Sep/2020:22:59:17 +0200\] "POST /wp-login.php HTTP/1.0" 200 8786 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[19/Sep/2020:22:59:20 +0200\] "POST /wp-login.php HTTP/1.0" 200 8612 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[19/Sep/2020:22:59:22 +0200\] "POST /wp-login.php HTTP/1.0" 200 8607 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-09-20 06:39:46
162.243.145.36	attack	[Fri Jun 12 05:30:57 2020] - DDoS Attack From IP: 162.243.145.36 Port: 35586	2020-07-16 21:19:34
162.243.145.80	attackbotsspam	[Mon Jun 15 02:54:26 2020] - DDoS Attack From IP: 162.243.145.80 Port: 35122	2020-07-16 20:47:35
162.243.145.9	attack	[Fri Jun 19 22:32:56 2020] - DDoS Attack From IP: 162.243.145.9 Port: 55083	2020-07-16 20:02:50
162.243.145.78	attackbots	[Sun Jun 21 02:59:49 2020] - DDoS Attack From IP: 162.243.145.78 Port: 38625	2020-07-16 19:59:34
162.243.145.36	attackbots	[Fri Jun 12 05:30:59 2020] - DDoS Attack From IP: 162.243.145.36 Port: 35586	2020-07-13 03:28:40
162.243.145.80	attack	[Mon Jun 15 02:54:28 2020] - DDoS Attack From IP: 162.243.145.80 Port: 35122	2020-07-13 03:13:20
162.243.145.9	attackbots	[Fri Jun 19 22:32:58 2020] - DDoS Attack From IP: 162.243.145.9 Port: 55083	2020-07-13 02:44:34

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 162.243.145.44
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45914
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;162.243.145.44.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019040100 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Tue Apr 02 00:18:35 +08 2019
;; MSG SIZE  rcvd: 118

Host info

44.145.243.162.in-addr.arpa domain name pointer zg-0326a-70.stretchoid.com.

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

Non-authoritative answer:
44.145.243.162.in-addr.arpa	name = zg-0326a-70.stretchoid.com.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
34.87.185.57	attackspambots	Mar 6 05:13:50 cumulus sshd[17077]: Did not receive identification string from 34.87.185.57 port 59384 Mar 6 05:14:18 cumulus sshd[17094]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.87.185.57 user=r.r Mar 6 05:14:21 cumulus sshd[17094]: Failed password for r.r from 34.87.185.57 port 37338 ssh2 Mar 6 05:14:21 cumulus sshd[17094]: Received disconnect from 34.87.185.57 port 37338:11: Normal Shutdown, Thank you for playing [preauth] Mar 6 05:14:21 cumulus sshd[17094]: Disconnected from 34.87.185.57 port 37338 [preauth] Mar 6 05:14:57 cumulus sshd[17115]: Invalid user oracle from 34.87.185.57 port 40022 Mar 6 05:14:57 cumulus sshd[17115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.87.185.57 Mar 6 05:14:59 cumulus sshd[17115]: Failed password for invalid user oracle from 34.87.185.57 port 40022 ssh2 Mar 6 05:14:59 cumulus sshd[17115]: Received disconnect from 34.87.185.57........ -------------------------------	2020-03-08 07:13:34
106.13.52.83	attackbotsspam	Mar 7 23:07:44 vps691689 sshd[13059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.52.83 Mar 7 23:07:45 vps691689 sshd[13059]: Failed password for invalid user PASSW0RD@1234 from 106.13.52.83 port 53880 ssh2 Mar 7 23:08:41 vps691689 sshd[13083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.52.83 ...	2020-03-08 07:30:31
121.15.2.178	attackspambots	Mar 7 17:51:43 plusreed sshd[26249]: Invalid user chencaiping from 121.15.2.178 ...	2020-03-08 07:04:58
92.46.40.110	attack	SSH bruteforce	2020-03-08 07:32:13
120.188.74.62	attackbotsspam	[Sun Mar 08 05:08:36.844962 2020] [:error] [pid 31098:tid 140163355236096] [client 120.188.74.62:15953] [client 120.188.74.62] ModSecurity: Access denied with code 403 (phase 4). Pattern match "^5\\\\d{2}$" at RESPONSE_STATUS. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/RESPONSE-950-DATA-LEAKAGES.conf"] [line "118"] [id "950100"] [msg "The Application Returned a 500-Level Status Code"] [data "Matched Data: 500 found within RESPONSE_STATUS: 500"] [severity "ERROR"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-disclosure"] [tag "WASCTC/WASC-13"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.6"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/component/tags/tag/141"] [unique_id "XmQbU3HKLB0y8zumICQOHAAAADs"], referer: https://www.google.com/ ...	2020-03-08 07:32:39
189.186.171.104	attackbotsspam	Port probing on unauthorized port 23	2020-03-08 07:22:10
80.82.77.232	attackbots	Port Scan detected from 80.82.77.232 (NL/Netherlands/-). 11 hits in the last 101 seconds	2020-03-08 07:37:02
222.186.175.217	attackbotsspam	Mar 8 00:20:24 server sshd[632304]: Failed none for root from 222.186.175.217 port 42406 ssh2 Mar 8 00:20:27 server sshd[632304]: Failed password for root from 222.186.175.217 port 42406 ssh2 Mar 8 00:20:32 server sshd[632304]: Failed password for root from 222.186.175.217 port 42406 ssh2	2020-03-08 07:21:39
49.232.86.90	attackspam	Mar 7 22:48:00 dev0-dcde-rnet sshd[31749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.86.90 Mar 7 22:48:02 dev0-dcde-rnet sshd[31749]: Failed password for invalid user nas from 49.232.86.90 port 53176 ssh2 Mar 7 23:11:14 dev0-dcde-rnet sshd[31979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.86.90	2020-03-08 06:56:35
178.89.82.225	attackspam	1583618911 - 03/07/2020 23:08:31 Host: 178.89.82.225/178.89.82.225 Port: 445 TCP Blocked	2020-03-08 07:37:30
91.183.149.230	attack	(imapd) Failed IMAP login from 91.183.149.230 (BE/Belgium/230.149-183-91.adsl-static.isp.belgacom.be): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Mar 8 01:39:31 ir1 dovecot[4133960]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=91.183.149.230, lip=5.63.12.44, TLS, session=	2020-03-08 07:02:34
89.179.69.48	attack	Automatic report - Port Scan Attack	2020-03-08 07:29:35
222.186.180.147	attackbots	Mar 7 13:25:39 php1 sshd\[28232\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.147 user=root Mar 7 13:25:41 php1 sshd\[28232\]: Failed password for root from 222.186.180.147 port 6330 ssh2 Mar 7 13:25:57 php1 sshd\[28271\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.147 user=root Mar 7 13:25:59 php1 sshd\[28271\]: Failed password for root from 222.186.180.147 port 27288 ssh2 Mar 7 13:26:19 php1 sshd\[28305\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.147 user=root	2020-03-08 07:31:51
31.7.62.29	attackbots	20/3/7@17:35:14: FAIL: IoT-Telnet address from=31.7.62.29 20/3/7@17:35:14: FAIL: IoT-Telnet address from=31.7.62.29 20/3/7@17:35:14: FAIL: IoT-Telnet address from=31.7.62.29 ...	2020-03-08 06:54:51
27.254.174.209	attackspambots	SMB Server BruteForce Attack	2020-03-08 07:35:35

Recently Reported IPs

172.217.14.196	62.110.229.5	2.183.97.9	110.46.15.135
62.101.104.138	2.95.206.58	202.141.254.102	51.77.56.2
42.118.79.211	192.185.4.25	162.241.134.142	60.12.26.218
42.118.0.225	200.196.240.60	94.232.136.126	79.170.50.43
60.250.53.30	42.2.69.4	218.92.0.197	36.96.187.119