This IP address has been reported a total of
50
times from
45 distinct
sources.
156.59.50.231 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 15
reports;
United States of America
with 7
reports;
France
with 5
reports.
The most common categories in these recent reports were:
Brute-Force
21
times;
Web App Attack
12
times;
SSH
11
times;
Port Scan
9
times;
Email Spam
6
times;
Other
8
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
2026-10-18T11:55:17.803904+02:00 mx1 postfix/submission/smtpd[1968112]: improper command pipelining ...
show more2026-10-18T11:55:17.803904+02:00 mx1 postfix/submission/smtpd[1968112]: improper command pipelining after CONNECT from unknown[156.59.50.231]: \026\003\001\000\376\001\000\000\372\003\003\260\210\n\364\017\201\252\020$\252\333\b H\210\033\206U\341\020\252L\227\256\220\035\ajY J\343 \362\257\360\375\355\rIQ\332\001g\030^\227T\341\235\363\266\r\325>.\022J\034w\313\367\320\005\214\0002\300+\300/\300,\3000\314\251\314\250\300\t\300\023\300\n\300\024\000\234
show less
Email Spam
Brute-Force
Anonymous
Brute-Force
Email Spam
Anonymous
2026-10-18T07:04:07.397009+00:00 nbg01-02-mail postfix/submission/smtpd[61218]: lost connection afte ...
show more2026-10-18T07:04:07.397009+00:00 nbg01-02-mail postfix/submission/smtpd[61218]: lost connection after CONNECT from unknown[156.59.50.231]
2026-10-18T07:08:16.384059+00:00 nbg01-02-mail postfix/smtps/smtpd[61233]: lost connection after CONNECT from unknown[156.59.50.231]
2026-10-18T07:08:19.394700+00:00 nbg01-02-mail postfix/smtps/smtpd[61233]: lost connection after CONNECT from unknown[156.59.50.231]
...
show less
Oct 17 19:16:09 156.59.50.231 TCP SPT=43284 DPT=2222 SYN
Oct 17 19:16:10 156.59.50.231 TCP SPT=43284 ...
show moreOct 17 19:16:09 156.59.50.231 TCP SPT=43284 DPT=2222 SYN
Oct 17 19:16:10 156.59.50.231 TCP SPT=43284 DPT=2222 SYN
...
show less
2026-10-18T04:59:27.608175+08:00 vmi996132.contaboserver.net sshd[3113043]: Connection closed by 156 ...
show more2026-10-18T04:59:27.608175+08:00 vmi996132.contaboserver.net sshd[3113043]: Connection closed by 156.59.50.231 port 37198 [preauth]
2026-10-18T04:59:28.659269+08:00 vmi996132.contaboserver.net sshd[3113045]: Connection closed by 156.59.50.231 port 37210 [preauth]
2026-10-18T04:59:29.828689+08:00 vmi996132.contaboserver.net sshd[3113066]: Connection closed by 156.59.50.231 port 37222 [preauth]
...
show less
postfix Server DDoS - AUTH drops, early HANGUPs, other DDoS attacks, etc. Might contain brute-force ...
show morepostfix Server DDoS - AUTH drops, early HANGUPs, other DDoS attacks, etc. Might contain brute-force dictionary attack sightings on IMAP and SMTP.
show less
DDoS Attack
Port Scan
Anonymous
Kept connecting and disconnecting without issuing any commands
Oct 17 16:11:29 [redacted] postfix/submission/smtpd[376254]: lost connection after STARTTLS from unk ...
show moreOct 17 16:11:29 [redacted] postfix/submission/smtpd[376254]: lost connection after STARTTLS from unknown[156.59.50.231]
...
show less
2026-10-17T09:56:33.813376localhost sshd[1706362]: Connection closed by 156.59.50.231 port 52458 [pr ...
show more2026-10-17T09:56:33.813376localhost sshd[1706362]: Connection closed by 156.59.50.231 port 52458 [preauth]
...
show less
Port Scan
Hacking
Brute-Force
Exploited Host
Web App Attack
2026-10-17T00:47:41.324946+00:00 relay-ams sshd[3201696]: Connection closed by 156.59.50.231 port 50 ...
show more2026-10-17T00:47:41.324946+00:00 relay-ams sshd[3201696]: Connection closed by 156.59.50.231 port 50434
2026-10-17T00:47:42.949031+00:00 relay-ams sshd[3201772]: Connection closed by 156.59.50.231 port 50438 [preauth]
2026-10-17T00:47:44.597384+00:00 relay-ams sshd[3201864]: Connection closed by 156.59.50.231 port 46344 [preauth]
...
show less
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ...
show moreUFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=156.59.50.231; proto=TCP; source_port=34274; target_port=2022
show less
