This IP address has been reported a total of
31
times from
25 distinct
sources.
165.245.252.138 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 8
reports;
Germany
with 5
reports;
France
with 5
reports.
The most common categories in these recent reports were:
Port Scan
17
times;
Web App Attack
11
times;
Brute-Force
9
times;
Hacking
7
times;
SSH
5
times;
Other
6
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Oct 12 07:42:20 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 ...
show moreOct 12 07:42:20 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<k6TQUp1dZWql9fyK>
Oct 12 07:42:29 mail dovecot: imap-login: Disconnected (no auth attempts in 6 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<wX5UU51dmxil9fyK>
Oct 12 07:42:31 mail dovecot: imap-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: Connection closed, session=<yrdvU51dKVql9fyK>
show less
Oct 12 07:42:20 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 ...
show moreOct 12 07:42:20 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<k6TQUp1dZWql9fyK>
Oct 12 07:42:29 mail dovecot: imap-login: Disconnected (no auth attempts in 6 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<wX5UU51dmxil9fyK>
Oct 12 07:42:31 mail dovecot: imap-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: Connection closed, session=<yrdvU51dKVql9fyK>
show less
Unwanted traffic detected by honeypot on October 11, 2026: port scans (10 port 23 scans), and brute ...
show moreUnwanted traffic detected by honeypot on October 11, 2026: port scans (10 port 23 scans), and brute force and hacking attacks (9 over telnet).
show less
Oct 12 07:42:20 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 ...
show moreOct 12 07:42:20 mail dovecot: imap-login: Disconnected (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<k6TQUp1dZWql9fyK>
Oct 12 07:42:29 mail dovecot: imap-login: Disconnected (no auth attempts in 6 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<wX5UU51dmxil9fyK>
Oct 12 07:42:31 mail dovecot: imap-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=165.245.252.138, lip=192.168.1.80, TLS handshaking: Connection closed, session=<yrdvU51dKVql9fyK>
show less
Repeated TCP connections to unused ports on a honeypot
Port Scan
Anonymous
2026-10-11T21:03:12.086813-04:00 mail postfix/smtpd[1725165]: lost connection after CONNECT from unk ...
show more2026-10-11T21:03:12.086813-04:00 mail postfix/smtpd[1725165]: lost connection after CONNECT from unknown[165.245.252.138]
2026-10-11T21:03:27.034791-04:00 mail postfix/smtpd[1725165]: lost connection after EHLO from unknown[165.245.252.138]
2026-10-11T21:03:27.146543-04:00 mail postfix/smtpd[1725165]: improper command pipelining after CONNECT from unknown[165.245.252.138]: HELP\r\n
...
show less
