85.172.54.45 - IPInfo

Basic Info

City: Krasnodar

Region: Krasnodarskiy Kray

Country: Russia

Internet Service Provider: OJSC Rostelecom

Hostname: unknown

Organization: Rostelecom

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	9 failed emails per dmarc_support@corp.mail.ru [Fri Jul 19 00:00:00 2019 GMT thru Sat Jul 20 00:00:00 2019 GMT]	2019-07-21 02:46:00

Comments on same subnet:

IP	Type	Details	Datetime
85.172.54.244	attackspambots	Unauthorized connection attempt from IP address 85.172.54.244 on Port 445(SMB)	2020-08-21 03:31:22
85.172.54.164	attackbotsspam	Port scan on 1 port(s): 23	2020-02-29 07:01:21
85.172.54.164	attackbotsspam	Automatic report - Port Scan Attack	2020-02-26 02:08:42
85.172.54.164	attackspam	DATE:2020-02-24 14:27:41, IP:85.172.54.164, PORT:telnet Telnet brute force auth on honeypot server (epe-honey1-hq)	2020-02-24 21:57:06
85.172.54.164	attack	Automatic report - Port Scan Attack	2019-11-17 22:10:14
85.172.54.164	attackspambots	Automatic report - Port Scan Attack	2019-11-16 09:10:35

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 85.172.54.45
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 27507
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;85.172.54.45.			IN	A

;; AUTHORITY SECTION:
.			2082	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019072001 1800 900 604800 86400

;; Query time: 1 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Jul 21 02:45:54 CST 2019
;; MSG SIZE  rcvd: 116

Host info

Host 45.54.172.85.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 45.54.172.85.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
76.186.81.229	attackspambots	Feb 25 04:10:48 MK-Soft-VM8 sshd[31562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=76.186.81.229 Feb 25 04:10:50 MK-Soft-VM8 sshd[31562]: Failed password for invalid user james from 76.186.81.229 port 44943 ssh2 ...	2020-02-25 11:19:01
185.212.168.150	attackspambots	0,52-01/06 [bc01/m11] PostRequest-Spammer scoring: harare01	2020-02-25 11:17:26
23.88.167.194	attackspam	Honeypot attack, port: 445, PTR: 194.167-88-23.rdns.scalabledns.com.	2020-02-25 11:00:27
61.178.19.67	attackbots	Honeypot attack, port: 445, PTR: PTR record not found	2020-02-25 10:52:55
80.179.10.50	attackbots	Honeypot attack, port: 81, PTR: 80.179.10.50.static.012.net.il.	2020-02-25 11:10:22
89.134.126.89	attackbots	Feb 25 04:40:15 pkdns2 sshd\[59444\]: Address 89.134.126.89 maps to business-89-134-126-88.business.broadband.hu, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Feb 25 04:40:15 pkdns2 sshd\[59444\]: Invalid user default from 89.134.126.89Feb 25 04:40:17 pkdns2 sshd\[59444\]: Failed password for invalid user default from 89.134.126.89 port 57834 ssh2Feb 25 04:48:46 pkdns2 sshd\[59822\]: Address 89.134.126.89 maps to business-89-134-126-88.business.broadband.hu, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!Feb 25 04:48:46 pkdns2 sshd\[59822\]: Invalid user kigwasshoi from 89.134.126.89Feb 25 04:48:48 pkdns2 sshd\[59822\]: Failed password for invalid user kigwasshoi from 89.134.126.89 port 40658 ssh2 ...	2020-02-25 10:59:05
54.36.106.204	attack	[2020-02-24 20:33:05] NOTICE[1148] chan_sip.c: Registration from '' failed for '54.36.106.204:53024' - Wrong password [2020-02-24 20:33:05] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-24T20:33:05.676-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="900",SessionID="0x7fd82c6cd778",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/54.36.106.204/53024",Challenge="399d833e",ReceivedChallenge="399d833e",ReceivedHash="d8f9717d6d48490c0c83b2d81070682a" [2020-02-24 20:33:34] NOTICE[1148] chan_sip.c: Registration from '' failed for '54.36.106.204:60086' - Wrong password [2020-02-24 20:33:34] SECURITY[1163] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-02-24T20:33:34.160-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1000",SessionID="0x7fd82c7af4d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/54.36.106.204/6 ...	2020-02-25 10:57:08
144.137.29.26	attackspam	Honeypot attack, port: 81, PTR: cpe-144-137-29-26.static.nsw.asp.telstra.net.	2020-02-25 11:01:28
5.135.165.51	attackspam	Feb 24 13:37:50 hanapaa sshd\[2508\]: Invalid user wangmeng from 5.135.165.51 Feb 24 13:37:50 hanapaa sshd\[2508\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3317937.ip-5-135-165.eu Feb 24 13:37:52 hanapaa sshd\[2508\]: Failed password for invalid user wangmeng from 5.135.165.51 port 41756 ssh2 Feb 24 13:45:47 hanapaa sshd\[3311\]: Invalid user kristof from 5.135.165.51 Feb 24 13:45:47 hanapaa sshd\[3311\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=ns3317937.ip-5-135-165.eu	2020-02-25 11:21:59
137.74.119.120	attack	Feb 25 03:49:24 lnxweb61 sshd[5662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.74.119.120	2020-02-25 11:18:16
80.144.231.184	attackspam	Feb 25 00:27:58 vps670341 sshd[969]: Invalid user charles from 80.144.231.184 port 45790	2020-02-25 11:12:03
51.83.42.3	attackbots	(sshd) Failed SSH login from 51.83.42.3 (FR/France/3.ip-51-83-42.eu): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Feb 25 00:21:54 ubnt-55d23 sshd[32003]: Invalid user wpyan from 51.83.42.3 port 54586 Feb 25 00:21:56 ubnt-55d23 sshd[32003]: Failed password for invalid user wpyan from 51.83.42.3 port 54586 ssh2	2020-02-25 11:24:25
125.43.175.182	attackspam	Feb 25 01:46:09 h2177944 kernel: \[5789361.261182\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=125.43.175.182 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=10898 PROTO=TCP SPT=64510 DPT=23 WINDOW=57310 RES=0x00 SYN URGP=0 Feb 25 01:46:09 h2177944 kernel: \[5789361.261193\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=125.43.175.182 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=10898 PROTO=TCP SPT=64510 DPT=23 WINDOW=57310 RES=0x00 SYN URGP=0 Feb 25 01:54:11 h2177944 kernel: \[5789843.367811\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=125.43.175.182 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=10898 PROTO=TCP SPT=64510 DPT=23 WINDOW=57310 RES=0x00 SYN URGP=0 Feb 25 01:54:11 h2177944 kernel: \[5789843.367824\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=125.43.175.182 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=10898 PROTO=TCP SPT=64510 DPT=23 WINDOW=57310 RES=0x00 SYN URGP=0 Feb 25 02:02:53 h2177944 kernel: \[5790365.388867\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=125.43.175.182 DST=85.214.117.9 LE	2020-02-25 10:59:53
190.85.108.186	attack	Feb 25 04:08:14 webmail sshd[13532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.85.108.186 Feb 25 04:08:16 webmail sshd[13532]: Failed password for invalid user HTTP from 190.85.108.186 port 37774 ssh2	2020-02-25 11:23:20
209.17.97.98	attackspam	Automatic report - Banned IP Access	2020-02-25 10:53:23

Recently Reported IPs

132.229.162.67	82.200.194.134	63.35.140.152	105.135.32.178
23.236.40.14	81.10.3.125	197.7.64.195	40.56.170.25
78.142.232.27	43.224.183.233	78.111.39.132	49.169.40.46
152.209.153.243	65.39.124.45	197.58.147.171	61.19.65.139
2003:d7:9f28:7500:20e0:d7db:c2fc:7763	50.108.159.173	64.102.49.223	230.1.255.94