This IP address has been reported a total of
35
times from
5 distinct
sources.
145.239.72.87 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 18
reports;
Korea (the Republic of)
with 10
reports;
Germany
with 7
reports.
The most common categories in these recent reports were:
Brute-Force
29
times;
SSH
25
times;
Hacking
10
times;
Exploited Host
10
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
SSH login attempt using devuser/devuser from an SSH-2.0-Go client. After authentication, the only ob ...
show moreSSH login attempt using devuser/devuser from an SSH-2.0-Go client. After authentication, the only observed command was uname -a for basic host recon; no payload download, file drop, persistence, port forwarding, or lateral movement was observed.
show less
SSH login used root/M$uX_8z3D_m-AI=. Session from SSH-2.0-Go ran a miner-style dropper: checked CPU ...
show moreSSH login used root/M$uX_8z3D_m-AI=. Session from SSH-2.0-Go ran a miner-style dropper: checked CPU count, inspected top CPU processes, created /dev/shm/w.sh, and wrote payload files astats and kstats in /dev/shm or fallback dirs. It added persistence with crontab @reboot pointing to /dev/shm/w.sh and included strings for astats/netai/kstats/http 80 az. It also attempted anti-forensics by deleting .bash_history, utmp, wtmp, lastlog, secure, and yum.log. Commands showed process checks for astats/kstats and cleanup of logs rather than lateral movement. No dropped-file artifacts were provided.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
propolis: 145.239.72.87 - 50 event(s) across 1 category since 2026-10-05T20:39:10.557693+00:00, curr ...
show morepropolis: 145.239.72.87 - 50 event(s) across 1 category since 2026-10-05T20:39:10.557693+00:00, current score 6.2
show less
propolis: 145.239.72.87 - 50 event(s) across 1 category since 2026-10-05T20:39:10.557693+00:00, curr ...
show morepropolis: 145.239.72.87 - 50 event(s) across 1 category since 2026-10-05T20:39:10.557693+00:00, current score 98.9
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
