IP address

Passive DNS

Tags: Scanner

IP blacklists

DataPlane SIP query

45.59.163.167 is listed on the DataPlane SIP query blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds, and measurement resource for operators, by operators. IP addresses that has been seen initiating an unsolicited SIP OPTIONS query to a remote host.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-17 03:10:01.344000
Was present on blacklist at: 2025-12-14 03:10, 2025-12-14 07:10, 2025-12-14 11:10, 2025-12-14 15:10, 2025-12-14 19:10, 2025-12-14 23:10, 2025-12-15 03:10, 2025-12-15 07:10, 2025-12-15 11:10, 2025-12-15 15:10, 2025-12-15 19:10, 2025-12-16 03:10, 2025-12-16 07:10, 2025-12-16 11:10, 2025-12-16 15:10, 2025-12-16 19:10, 2025-12-17 03:10

CI Army

45.59.163.167 is listed on the CI Army blacklist.

Description: Collective Intelligence Network Security is a Threat Intelligence database that provides scores for IPs. Source of unspecified malicious attacks most of them will be active attackers/scanners
Type of feed: primary (feed detail page)

Last checked at: 2025-12-17 03:50:00.936000
Was present on blacklist at: 2025-12-14 03:50, 2025-12-15 03:50, 2025-12-16 03:50, 2025-12-17 03:50

AbuseIPDB

45.59.163.167 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc. Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2025-12-15 05:00:00.709000
Was present on blacklist at: 2025-12-14 05:00, 2025-12-15 05:00

blocklist.de bots

45.59.163.167 is listed on the blocklist.de bots blacklist.

Description: Blocklist.de feed is a free and voluntary service provided by a Fraud/Abuse-specialist. IPs performing attacks on the RFI-Attacks, REG-Bots, IRC-Bots or BadBots.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-16 23:05:05.258000
Was present on blacklist at: 2025-12-14 17:05, 2025-12-14 23:05, 2025-12-15 05:05, 2025-12-15 11:05, 2025-12-15 17:05, 2025-12-15 23:05, 2025-12-16 05:05, 2025-12-16 11:05, 2025-12-16 17:05, 2025-12-16 23:05

Turris greylist

45.59.163.167 is listed on the Turris greylist blacklist.

Description: Greylist is the output of the Turris research project by CZ.NIC, which collects data of malicious IPs.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-16 22:15:00.144000
Was present on blacklist at: 2025-12-15 22:15, 2025-12-16 22:15

UCEPROTECT L1

45.59.163.167 is listed on the UCEPROTECT L1 blacklist.

Description: UCEPROTECT-NETWORK list of spam IPs.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-17 00:45:00.548000
Was present on blacklist at: 2025-12-16 00:45, 2025-12-16 08:45, 2025-12-16 16:45, 2025-12-17 00:45

Warden events (110)

2025-12-16: ReconScanning (node.4dc198): 1
2025-12-15: ReconScanning (node.4dc198): 6; ReconScanning (node.368407): 11
2025-12-14: AnomalyTraffic (node.ffe95c): 5; ReconScanning (node.4dc198): 57; ReconScanning (node.368407): 30

DShield reports (IP summary, reports)

2025-12-14: Number of reports: 345; Distinct targets: 259
2025-12-15: Number of reports: 68; Distinct targets: 59

OTX pulses

[693eba830707c4d7a3cb6e37] 2025-12-14 13:24:19.400000 | Apache honeypot logs for 14/Dec/2025

Author name:	jnazario
Pulse modified:	2025-12-14 13:24:19.400000
Indicator created:	2025-12-14 13:24:20
Indicator role:	None
Indicator title:
Indicator expiration:	2026-01-13 13:00:00

Origin AS: AS397423 - TIER-NET
BGP Prefix: 45.59.163.0/24
geo: United States, Dallas; 🕑 America/Chicago
hostname: mx00.carii.com
Address block ('inetnum' or 'NetRange' in whois database): 45.59.160.0 - 45.59.163.255
last_activity: 2025-12-16 10:33:56
last_warden_event: 2025-12-16 10:33:56
rep: 0.20833267938523065
reserved_range: 0
Shodan's InternetDB: Open ports: 25, 80, 443, 993, 995, 3306, 4190, 5060, 5353; Tags: scanner, database, self-signed, eol-product; CPEs: cpe:/a:openssl:openssl:1.0.1e, cpe:/a:getbootstrap:bootstrap, cpe:/a:apache:http_server:2.4.6, cpe:/a:mariadb:mariadb:5.5.35-MariaDB, cpe:/a:jquery:jquery:1.11.2, cpe:/a:postfix:postfix, cpe:/o:centos:centos, cpe:/a:php:php:5.4.16, cpe:/a:jquery:jquery_ui:1.11.4
ts_added: 2025-12-14 00:39:18.901000
ts_last_update: 2025-12-17 03:52:04.089000

Warden event timeline

DShield event timeline

Presence on blacklists

OTX pulses