Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: Nürnberg

Region: Bavaria

Country: Russian Federation

Internet Service Provider: ComTrade LLC

Hostname: unknown

Organization: unknown

Usage Type: Commercial

Comments:
Type Details Datetime
attackspam
Sep 19 17:26:09 mc1 kernel: \[193231.239593\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=10549 PROTO=TCP SPT=48678 DPT=6813 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 19 17:26:44 mc1 kernel: \[193266.273497\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=243 ID=43172 PROTO=TCP SPT=48678 DPT=6094 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 19 17:27:55 mc1 kernel: \[193337.346494\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=50351 PROTO=TCP SPT=48678 DPT=6796 WINDOW=1024 RES=0x00 SYN URGP=0 
...
2019-09-20 01:24:42
attackspambots
Sep 10 18:28:50 lenivpn01 kernel: \[365734.849668\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=195.201.121.15 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=25337 PROTO=TCP SPT=50516 DPT=6006 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 10 18:34:22 lenivpn01 kernel: \[366066.642794\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=195.201.121.15 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=17398 PROTO=TCP SPT=50516 DPT=6800 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 10 18:36:12 lenivpn01 kernel: \[366176.962211\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=195.201.121.15 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=48492 PROTO=TCP SPT=50516 DPT=6074 WINDOW=1024 RES=0x00 SYN URGP=0 
Sep 10 21:04:16 lenivpn01 kernel: \[375060.613315\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.38 DST=195.201.121.15 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=
...
2019-09-12 00:39:37
attack
09/09/2019-00:56:59.024470 45.136.109.38 Protocol: 6 ET SCAN NMAP -sS window 1024
2019-09-09 13:53:41
attackbots
09/08/2019-05:38:12.116651 45.136.109.38 Protocol: 6 ET SCAN NMAP -sS window 1024
2019-09-08 18:15:58
attack
09/07/2019-20:07:43.812755 45.136.109.38 Protocol: 6 ET SCAN NMAP -sS window 1024
2019-09-08 10:18:45
Comments on same subnet:
IP Type Details Datetime
45.136.109.219 attackspambots
ET CINS Active Threat Intelligence Poor Reputation IP group 26 - port: 6000 proto: tcp cat: Misc Attackbytes: 60
2020-08-19 23:39:13
45.136.109.219 attackspam
slow and persistent scanner
2020-08-17 20:34:11
45.136.109.251 attackbotsspam
Port scanning [3 denied]
2020-08-14 14:18:15
45.136.109.219 attackbots
 TCP (SYN) 45.136.109.219:50230 -> port 53, len 44
2020-08-07 08:11:38
45.136.109.219 attackbotsspam
[Tue Aug 04 17:47:28 2020] - DDoS Attack From IP: 45.136.109.219 Port: 41096
2020-08-06 18:31:50
45.136.109.219 attack
 TCP (SYN) 45.136.109.219:43869 -> port 53, len 44
2020-08-05 23:34:34
45.136.109.158 attack
Unauthorized connection attempt detected from IP address 45.136.109.158 to port 3389
2020-07-22 15:39:59
45.136.109.87 attack
BruteForce RDP attempts from 45.136.109.175
2020-07-17 14:21:12
45.136.109.158 attack
SmallBizIT.US 2 packets to tcp(3389,3391)
2020-07-07 12:28:14
45.136.109.158 attackbots
Unauthorized connection attempt detected from IP address 45.136.109.158 to port 4489 [T]
2020-07-05 22:47:55
45.136.109.175 attackspambots
Icarus honeypot on github
2020-07-02 08:25:18
45.136.109.251 attackbots
Multiport scan : 15 ports scanned 2888 3381 3382 3402 3420 3501 3502 4003 4018 5909 7926 8093 9000 9261 9833
2020-06-21 07:47:48
45.136.109.219 attackbots
ET CINS Active Threat Intelligence Poor Reputation IP group 27 - port: 6389 proto: TCP cat: Misc Attack
2020-06-06 08:47:05
45.136.109.222 attackspam
Mar 22 03:57:09 src: 45.136.109.222 signature match: "BACKDOOR NetSphere Connection attempt" (sid: 100044) tcp port: 30100
2020-03-22 12:01:46
45.136.109.222 attackbotsspam
Mar 18 22:14:16 src: 45.136.109.222 signature match: "BACKDOOR Subseven connection attempt" (sid: 100207) tcp port: 27374
2020-03-19 06:22:33
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 45.136.109.38
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 4177
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;45.136.109.38.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019090701 1800 900 604800 86400

;; Query time: 62 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Sep 08 10:18:30 CST 2019
;; MSG SIZE  rcvd: 117
Host info
Host 38.109.136.45.in-addr.arpa. not found: 3(NXDOMAIN)
Nslookup info:
Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 38.109.136.45.in-addr.arpa: NXDOMAIN
Related IP info:
Related comments:
IP Type Details Datetime
119.45.207.216 attackspam
Sep 25 01:21:49 nas sshd[7290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.207.216 
Sep 25 01:21:52 nas sshd[7290]: Failed password for invalid user tv from 119.45.207.216 port 37378 ssh2
Sep 25 01:27:10 nas sshd[7399]: Failed password for root from 119.45.207.216 port 33144 ssh2
...
2020-09-25 07:52:14
222.186.173.201 attack
Sep 25 01:39:39 plg sshd[26482]: Failed none for invalid user root from 222.186.173.201 port 50446 ssh2
Sep 25 01:39:39 plg sshd[26482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.201  user=root
Sep 25 01:39:41 plg sshd[26482]: Failed password for invalid user root from 222.186.173.201 port 50446 ssh2
Sep 25 01:39:45 plg sshd[26482]: Failed password for invalid user root from 222.186.173.201 port 50446 ssh2
Sep 25 01:39:51 plg sshd[26482]: Failed password for invalid user root from 222.186.173.201 port 50446 ssh2
Sep 25 01:39:55 plg sshd[26482]: Failed password for invalid user root from 222.186.173.201 port 50446 ssh2
Sep 25 01:39:59 plg sshd[26482]: Failed password for invalid user root from 222.186.173.201 port 50446 ssh2
Sep 25 01:40:00 plg sshd[26482]: error: maximum authentication attempts exceeded for invalid user root from 222.186.173.201 port 50446 ssh2 [preauth]
Sep 25 01:40:04 plg sshd[26490]: pam_unix(sshd:auth): auth
...
2020-09-25 07:56:07
69.28.234.130 attackspambots
5x Failed Password
2020-09-25 08:02:21
177.185.117.133 attackbots
(sshd) Failed SSH login from 177.185.117.133 (BR/Brazil/clt-home-133.117.185.177.tecnowireless.com.br): 12 in the last 3600 secs
2020-09-25 07:53:52
167.114.156.189 attackspam
[2020-09-24 16:54:43] NOTICE[1159][C-00001438] chan_sip.c: Call from '' (167.114.156.189:49817) to extension '01197233741877' rejected because extension not found in context 'public'.
[2020-09-24 16:54:43] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-24T16:54:43.396-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="01197233741877",SessionID="0x7fcaa0022038",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/167.114.156.189/49817",ACLName="no_extension_match"
[2020-09-24 16:57:10] NOTICE[1159][C-0000143b] chan_sip.c: Call from '' (167.114.156.189:56140) to extension '901197233741877' rejected because extension not found in context 'public'.
[2020-09-24 16:57:10] SECURITY[1198] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-09-24T16:57:10.517-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="901197233741877",SessionID="0x7fcaa02091e8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/
...
2020-09-25 07:59:58
51.103.24.92 attackspam
Sep 25 02:13:21 ns3164893 sshd[31985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.103.24.92
Sep 25 02:13:23 ns3164893 sshd[31985]: Failed password for invalid user hyerelle from 51.103.24.92 port 41838 ssh2
...
2020-09-25 08:14:44
58.87.72.42 attackbotsspam
Time:     Thu Sep 24 21:17:17 2020 +0000
IP:       58.87.72.42 (CN/China/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep 24 21:08:59 activeserver sshd[17470]: Failed password for invalid user deployment from 58.87.72.42 port 36309 ssh2
Sep 24 21:12:50 activeserver sshd[31360]: Invalid user ops from 58.87.72.42 port 20597
Sep 24 21:12:52 activeserver sshd[31360]: Failed password for invalid user ops from 58.87.72.42 port 20597 ssh2
Sep 24 21:17:12 activeserver sshd[9818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.87.72.42  user=postgres
Sep 24 21:17:14 activeserver sshd[9818]: Failed password for postgres from 58.87.72.42 port 61422 ssh2
2020-09-25 08:17:28
13.77.179.19 attack
Sep 25 01:46:53 theomazars sshd[19736]: Invalid user scripla from 13.77.179.19 port 19215
2020-09-25 07:55:47
222.186.42.7 attack
Sep 25 01:20:51 rocket sshd[4140]: Failed password for root from 222.186.42.7 port 61166 ssh2
Sep 25 01:20:58 rocket sshd[4150]: Failed password for root from 222.186.42.7 port 22654 ssh2
...
2020-09-25 08:25:17
170.106.38.97 attackbotsspam
Found on   Alienvault    / proto=6  .  srcport=46530  .  dstport=8020  .     (3330)
2020-09-25 08:11:24
35.242.214.242 attack
35.242.214.242 - - [24/Sep/2020:20:39:12 +0000] "POST /wp-login.php HTTP/1.1" 200 2077 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
35.242.214.242 - - [24/Sep/2020:20:39:14 +0000] "POST /wp-login.php HTTP/1.1" 200 2055 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
35.242.214.242 - - [24/Sep/2020:20:39:16 +0000] "POST /wp-login.php HTTP/1.1" 200 2052 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
35.242.214.242 - - [24/Sep/2020:20:39:17 +0000] "POST /wp-login.php HTTP/1.1" 200 2052 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
35.242.214.242 - - [24/Sep/2020:20:39:18 +0000] "POST /xmlrpc.php HTTP/1.1" 200 236 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "-"
2020-09-25 08:28:04
35.247.42.6 attack
CMS (WordPress or Joomla) login attempt.
2020-09-25 08:05:09
192.241.228.251 attackbotsspam
SSH Invalid Login
2020-09-25 08:12:01
171.120.42.102 attackbots
[N10.H2.VM2] Port Scanner Detected Blocked by UFW
2020-09-25 08:18:55
102.45.188.145 attack
" "
2020-09-25 08:01:46

Recently Reported IPs

46.229.213.118 91.32.192.209 45.76.203.203 104.4.189.248
117.240.172.19 168.48.14.42 112.195.165.23 13.57.193.221
46.229.213.69 167.71.250.105 207.142.243.144 158.145.121.89
173.198.125.241 86.33.21.2 36.4.63.75 129.228.170.90
141.255.20.96 64.251.30.184 171.222.89.102 183.150.149.9