45.55.50.52 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbotsspam	Mar 9 07:31:21 vps691689 sshd[2600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.50.52 Mar 9 07:31:24 vps691689 sshd[2600]: Failed password for invalid user git from 45.55.50.52 port 43992 ssh2 ...	2020-03-09 14:45:07
attackbotsspam	...	2020-03-03 16:52:57
attack	Feb 8 09:05:25 vps691689 sshd[15439]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.50.52 Feb 8 09:05:27 vps691689 sshd[15439]: Failed password for invalid user nagios from 45.55.50.52 port 42292 ssh2 ...	2020-02-08 16:09:44
attackspambots	Jan 29 08:02:42 silence02 sshd[21390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.50.52 Jan 29 08:02:44 silence02 sshd[21390]: Failed password for invalid user choopa from 45.55.50.52 port 46118 ssh2 Jan 29 08:04:43 silence02 sshd[21474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.50.52	2020-01-29 15:25:44

Comments on same subnet:

IP	Type	Details	Datetime
45.55.50.222	attackspam	WordPress login Brute force / Web App Attack on client site.	2019-11-01 00:54:29
45.55.50.222	attackspambots	fail2ban honeypot	2019-10-18 21:30:42
45.55.50.222	attackspam	WordPress (CMS) attack attempts. Date: 2019 Oct 14. 02:58:12 Source IP: 45.55.50.222 Portion of the log(s): 45.55.50.222 - [14/Oct/2019:02:58:12 +0200] "POST /wp-login.php HTTP/1.1" 200 2393 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 45.55.50.222 - [14/Oct/2019:02:58:10 +0200] "POST /wp-login.php HTTP/1.1" 200 2392 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 45.55.50.222 - [14/Oct/2019:02:58:09 +0200] "POST /wp-login.php HTTP/1.1" 200 2389 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 45.55.50.222 - [14/Oct/2019:02:58:07 +0200] "POST /wp-login.php HTTP/1.1" 200 2399 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 45.55.50.222 - [14/Oct/2019:02:58:05 +0200] "POST /wp-login.php HTTP/1.1" 200 2389 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 45.55.50.222 - [14/Oct/2019:02:58:04 +0200] "POST /wp-login.php HTTP/1.1"	2019-10-14 19:11:38

Type

Details

Datetime

45.55.50.222

attackspam

WordPress login Brute force / Web App Attack on client site.

2019-11-01 00:54:29

45.55.50.222

attackspambots

fail2ban honeypot

2019-10-18 21:30:42

45.55.50.222

attackspam

WordPress (CMS) attack attempts.
Date: 2019 Oct 14. 02:58:12
Source IP: 45.55.50.222

Portion of the log(s):
45.55.50.222 - [14/Oct/2019:02:58:12 +0200] "POST /wp-login.php HTTP/1.1" 200 2393 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.55.50.222 - [14/Oct/2019:02:58:10 +0200] "POST /wp-login.php HTTP/1.1" 200 2392 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.55.50.222 - [14/Oct/2019:02:58:09 +0200] "POST /wp-login.php HTTP/1.1" 200 2389 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.55.50.222 - [14/Oct/2019:02:58:07 +0200] "POST /wp-login.php HTTP/1.1" 200 2399 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.55.50.222 - [14/Oct/2019:02:58:05 +0200] "POST /wp-login.php HTTP/1.1" 200 2389 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
45.55.50.222 - [14/Oct/2019:02:58:04 +0200] "POST /wp-login.php HTTP/1.1"

2019-10-14 19:11:38

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 45.55.50.52
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 16741
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;45.55.50.52.			IN	A

;; AUTHORITY SECTION:
.			316	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020012200 1800 900 604800 86400

;; Query time: 120 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Jan 22 14:33:23 CST 2020
;; MSG SIZE  rcvd: 115

Host info

52.50.55.45.in-addr.arpa domain name pointer terminus.arkangroupco.com.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
52.50.55.45.in-addr.arpa	name = terminus.arkangroupco.com.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
181.74.218.195	attackspam	Feb 3 14:29:23 grey postfix/smtpd\[28856\]: NOQUEUE: reject: RCPT from unknown\[181.74.218.195\]: 554 5.7.1 Service unavailable\; Client host \[181.74.218.195\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=181.74.218.195\; from=\ to=\ proto=ESMTP helo=\<\[181.74.218.195\]\> ...	2020-02-03 22:29:05
103.6.198.40	attackspambots	WordPress wp-login brute force :: 103.6.198.40 0.120 - [03/Feb/2020:14:01:23 0000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 1806 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" "HTTP/1.1"	2020-02-03 22:40:14
37.231.32.96	attackspam	Feb 3 14:29:19 grey postfix/smtpd\[9971\]: NOQUEUE: reject: RCPT from unknown\[37.231.32.96\]: 554 5.7.1 Service unavailable\; Client host \[37.231.32.96\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[37.231.32.96\]\; from=\ to=\ proto=ESMTP helo=\<\[37.231.32.96\]\> ...	2020-02-03 22:43:43
14.29.168.116	attack	2020-02-03T15:36:46.352089scmdmz1 sshd[24758]: Invalid user ktc from 14.29.168.116 port 33769 2020-02-03T15:36:46.355316scmdmz1 sshd[24758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.29.168.116 2020-02-03T15:36:46.352089scmdmz1 sshd[24758]: Invalid user ktc from 14.29.168.116 port 33769 2020-02-03T15:36:48.654840scmdmz1 sshd[24758]: Failed password for invalid user ktc from 14.29.168.116 port 33769 ssh2 2020-02-03T15:40:33.353270scmdmz1 sshd[25148]: Invalid user guard from 14.29.168.116 port 43670 ...	2020-02-03 22:46:46
46.38.144.231	attackspambots	2020-02-03 15:11:24 dovecot_login authenticator failed for \(User\) \[46.38.144.231\]: 535 Incorrect authentication data \(set_id=sana@no-server.de\) 2020-02-03 15:11:30 dovecot_login authenticator failed for \(User\) \[46.38.144.231\]: 535 Incorrect authentication data \(set_id=njfontcolor@no-server.de\) 2020-02-03 15:11:42 dovecot_login authenticator failed for \(User\) \[46.38.144.231\]: 535 Incorrect authentication data \(set_id=njfontcolor@no-server.de\) 2020-02-03 15:11:44 dovecot_login authenticator failed for \(User\) \[46.38.144.231\]: 535 Incorrect authentication data \(set_id=njfontcolor@no-server.de\) 2020-02-03 15:11:44 dovecot_login authenticator failed for \(User\) \[46.38.144.231\]: 535 Incorrect authentication data \(set_id=njfontcolor@no-server.de\) ...	2020-02-03 22:12:52
169.56.73.239	attackbotsspam	ICMP MH Probe, Scan /Distributed -	2020-02-03 22:49:20
219.93.106.33	attack	Feb 3 04:38:47 web1 sshd\[13530\]: Invalid user qhsupport from 219.93.106.33 Feb 3 04:38:48 web1 sshd\[13530\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.93.106.33 Feb 3 04:38:50 web1 sshd\[13530\]: Failed password for invalid user qhsupport from 219.93.106.33 port 42171 ssh2 Feb 3 04:40:23 web1 sshd\[13604\]: Invalid user admin from 219.93.106.33 Feb 3 04:40:23 web1 sshd\[13604\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.93.106.33	2020-02-03 22:53:09
160.177.253.126	attackspam	Feb 3 15:40:25 grey postfix/smtpd\[25424\]: NOQUEUE: reject: RCPT from unknown\[160.177.253.126\]: 554 5.7.1 Service unavailable\; Client host \[160.177.253.126\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=160.177.253.126\; from=\ to=\ proto=ESMTP helo=\<\[160.177.253.126\]\> ...	2020-02-03 22:55:00
123.21.18.252	attackbotsspam	Feb 3 14:29:24 grey postfix/smtpd\[18791\]: NOQUEUE: reject: RCPT from unknown\[123.21.18.252\]: 554 5.7.1 Service unavailable\; Client host \[123.21.18.252\] blocked using dul.dnsbl.sorbs.net\; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml\?123.21.18.252\; from=\ to=\ proto=ESMTP helo=\<\[123.21.18.252\]\> ...	2020-02-03 22:28:03
181.191.241.6	attackspam	...	2020-02-03 22:49:46
185.200.118.37	attackbots	Feb 3 15:49:41 debian-2gb-nbg1-2 kernel: \[3000633.477300\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=185.200.118.37 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=60295 DPT=3389 WINDOW=65535 RES=0x00 SYN URGP=0	2020-02-03 22:53:41
103.134.3.90	attackbotsspam	Port 1433 Scan	2020-02-03 22:45:41
134.73.51.237	attack	Postfix RBL failed	2020-02-03 22:42:43
201.48.61.1	attackspam	Feb 3 14:29:30 grey postfix/smtpd\[17313\]: NOQUEUE: reject: RCPT from unknown\[201.48.61.1\]: 554 5.7.1 Service unavailable\; Client host \[201.48.61.1\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=201.48.61.1\; from=\ to=\ proto=ESMTP helo=\<\[201.48.61.1\]\> ...	2020-02-03 22:22:33
1.212.153.166	attackbots	Feb 3 14:40:25 sigma sshd\[20153\]: Invalid user elenor from 1.212.153.166Feb 3 14:40:27 sigma sshd\[20153\]: Failed password for invalid user elenor from 1.212.153.166 port 37968 ssh2 ...	2020-02-03 22:52:48

Recently Reported IPs

49.232.94.167	212.64.16.31	28.83.98.173	187.54.85.8
187.142.86.134	84.119.160.192	181.98.104.212	44.27.184.70
180.183.196.118	179.111.32.185	164.221.90.12	178.46.210.123
114.86.200.103	162.29.153.74	113.119.193.15	102.42.28.10
94.128.19.159	92.119.69.220	59.125.30.161	62.245.174.136