JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

170.64.141.102

Neutral Activity

Abuse Confidence Score

0% Low Risk

41 reports

24 reporters · latest 8 months ago

ISP: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
ASN: AS14061
Domain Name: digitalocean.com
Country: 🇦🇺 Australia
City: Sydney, New South Wales

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

170.64.141.102 has been reported 41 times. The most recent report is from 8 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

41 from 24 distinct reporters

First reported

March 6th 2026

Most recent report

8 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 rtbh.com.tr	2026-03-07 20:11:55 UTC · (8 months ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
🇪🇸 librebit	2026-03-07 01:18:45 UTC · (8 months ago)	Knockin' on Heaven's Door, SSH crap	Brute-Force SSH
🇺🇸 psh-ack	2026-03-07 00:17:54 UTC · (8 months ago)	Distributed cred spray attack: 3098 sessions, 1200+ cred pairs (admin/123456, root variants, db/cloud accounts). Post-auth: SSH key removal, competing malware cleanup from /dev/shm//var/tmp//tmp, crontab removal, chattr immutability blocking, SCP sta ... show more Distributed cred spray attack: 3098 sessions, 1200+ cred pairs (admin/123456, root variants, db/cloud accounts). Post-auth: SSH key removal, competing malware cleanup from /dev/shm//var/tmp//tmp, crontab removal, chattr immutability blocking, SCP staging to /dev/shm (2444 transfers). 3944 cmd variants executed. Artifacts: gIhvynPc 627KB d29ad2d5c8c4beb689d640a5e0f4f05ee96d979e33e9e5486ec2793f649861ef, cache binary 983KB 640c817722a4cd22251fcff100fdba167b7dfff885f36b5f64f2d59c52514180, iiKDgqnu 17.6MB 5e2ba475902c8d15ff0d0cb360a71951eb6a3b95d2737dfebfe55a4c6980d8d1, NjzlkhGx 32KB a4e72dc431944547f8c7a6ecebc9c05b5681343cfd653c6f9f682809. show less	Brute-Force SSH Hacking
🇫🇷 LRob	2026-03-07 00:01:20 UTC · (8 months ago)	SSH abuse or brute-force attack detected by Fail2Ban in ssh jail	Brute-Force SSH
🇩🇪 GrowdeinCannabis.pro	2026-03-06 23:12:08 UTC · (8 months ago)	Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 23:12:03 eager-sanderson sshd-session[608892]: Invalid user behnam from 170.64.141.102 port 41566 Mar 6 23:12:03 eager-sanderson sshd-session[608892]: pam_unix(sshd:auth): au ... show more Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 23:12:03 eager-sanderson sshd-session[608892]: Invalid user behnam from 170.64.141.102 port 41566 Mar 6 23:12:03 eager-sanderson sshd-session[608892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 23:12:05 eager-sanderson sshd-session[608892]: Failed password for invalid user behnam from 170.64.141.102 port 41566 ssh2 Mar 6 23:12:07 eager-sanderson sshd-session[608896]: Invalid user friend01 from 170.64.141.102 port 41568 show less	Brute-Force SSH
🇺🇸 psh-ack	2026-03-06 23:02:42 UTC · (8 months ago)	Brute-force SSH attack via SSH-2.0-Go client targeting 237 creds: root, admin, postgres, ubuntu, centos, jenkins, sonarqube, elasticsearch, rabbitmq, zabbix, llama3, codex, copilot, anthropic, together, metaflow, torchserve. Malware deployed via SCP ... show more Brute-force SSH attack via SSH-2.0-Go client targeting 237 creds: root, admin, postgres, ubuntu, centos, jenkins, sonarqube, elasticsearch, rabbitmq, zabbix, llama3, codex, copilot, anthropic, together, metaflow, torchserve. Malware deployed via SCP to /dev/shm, /tmp using 164+ randomized filenames (IAknOYXC, ZQpVyBEm, FerHOhpQ, etc.). Post-exploit cleanup: removed crontab, stripped immutable flags (chattr -iae) from SSH keys/payloads, deleted artifacts from /dev/shm/.x, /dev/shm/rete*, /var/tmp/payload, /tmp/.diicot, /tmp/kuak, /var/tmp/Documents/.diicot. 276 unique cmds executed across 2556 invocations. Commodity malware distribution targeting weak/default creds across cloud, containerized, dev environments. Heavy compromise of ML service accounts indicates reconnaissance against ML platforms and model serving infrastructure. show less	Brute-Force SSH
🇮🇪 RoboSOC	2026-03-06 22:56:43 UTC · (8 months ago)	Port 22 Scan, PTR: None	Port Scan
🇩🇪 GrowdeinCannabis.pro	2026-03-06 22:51:49 UTC · (8 months ago)	Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 22:51:44 eager-sanderson sshd-session[608554]: Invalid user debianuser from 170.64.141.102 port 41452 Mar 6 22:51:44 eager-sanderson sshd-session[608554]: pam_unix(sshd:auth) ... show more Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 22:51:44 eager-sanderson sshd-session[608554]: Invalid user debianuser from 170.64.141.102 port 41452 Mar 6 22:51:44 eager-sanderson sshd-session[608554]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 22:51:47 eager-sanderson sshd-session[608554]: Failed password for invalid user debianuser from 170.64.141.102 port 41452 ssh2 Mar 6 22:51:48 eager-sanderson sshd-session[608561]: Invalid user davy from 170.64.141.102 port 41466 show less	Brute-Force SSH
🇺🇸 psh-ack	2026-03-06 22:32:40 UTC · (8 months ago)	SSH brute-force: 170+ creds across 262 sessions (15min) using SSH-2.0-Go. Targeted: huggingface, wandb, mlflow, groq, postgres, elasticsearch, oracle, db2, jenkins, jira, gitlab, code-server, kubernetes, docker, coreweave, nominatim, mosquitto, jicof ... show more SSH brute-force: 170+ creds across 262 sessions (15min) using SSH-2.0-Go. Targeted: huggingface, wandb, mlflow, groq, postgres, elasticsearch, oracle, db2, jenkins, jira, gitlab, code-server, kubernetes, docker, coreweave, nominatim, mosquitto, jicofo, tomcat, jboss, root/admin/centos/ubuntu accounts. Post-compromise: removed crontab, disabled immutable attrs on authorized_keys, deleted /dev/shm, /tmp, /var/tmp payloads (.diicot, kuak, .x, rete*, /var/tmp/payload, /var/tmp/Documents/.diicot). 190 binary/script files via SCP to /dev/shm and /tmp with randomized names (FiytTDLk, HjHPFHSG, fGOuSRCB). Attack chain: brute-force -> staging -> exec -> cleanup. High session count suggests automated scanning or botnet. No external URL downloads; payloads pre-staged. Cleanup indicates sanitizing evidence of prior compromises and competing malware. Likely automated post-compromise activity from botnet coordinator. show less	Brute-Force SSH
🇩🇪 GrowdeinCannabis.pro	2026-03-06 22:31:34 UTC · (8 months ago)	Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 22:31:27 eager-sanderson sshd-session[608296]: Invalid user s10franch from 170.64.141.102 port 47476 Mar 6 22:31:28 eager-sanderson sshd-session[608296]: pam_unix(sshd:auth): ... show more Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 22:31:27 eager-sanderson sshd-session[608296]: Invalid user s10franch from 170.64.141.102 port 47476 Mar 6 22:31:28 eager-sanderson sshd-session[608296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 22:31:30 eager-sanderson sshd-session[608296]: Failed password for invalid user s10franch from 170.64.141.102 port 47476 ssh2 Mar 6 22:31:33 eager-sanderson sshd-session[608299]: Invalid user wandb from 170.64.141.102 port 45688 show less	Brute-Force SSH
🇩🇪 GrowdeinCannabis.pro	2026-03-06 22:11:20 UTC · (8 months ago)	Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 22:11:13 eager-sanderson sshd-session[608035]: Invalid user mxnet from 170.64.141.102 port 48610 Mar 6 22:11:13 eager-sanderson sshd-session[608035]: pam_unix(sshd:auth): aut ... show more Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 22:11:13 eager-sanderson sshd-session[608035]: Invalid user mxnet from 170.64.141.102 port 48610 Mar 6 22:11:13 eager-sanderson sshd-session[608035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 22:11:15 eager-sanderson sshd-session[608035]: Failed password for invalid user mxnet from 170.64.141.102 port 48610 ssh2 Mar 6 22:11:19 eager-sanderson sshd-session[608038]: Invalid user qingjingru from 170.64.141.102 port 50434 show less	Brute-Force SSH
🇺🇸 psh-ack	2026-03-06 22:02:36 UTC · (8 months ago)	Credential brute-force: 219 sessions, 148 user/pass pairs, SSH-2.0-Go client. Targets: jenkins, nexus, postgres, redis, oracle, mysql, mongodb, arangodb, tidb, zookeeper, root variants, admin, guest, deepseek, gpt4, koboldai, llama, replit, runpod, a ... show more Credential brute-force: 219 sessions, 148 user/pass pairs, SSH-2.0-Go client. Targets: jenkins, nexus, postgres, redis, oracle, mysql, mongodb, arangodb, tidb, zookeeper, root variants, admin, guest, deepseek, gpt4, koboldai, llama, replit, runpod, automatic1111, dmdba, sdbadmin, ecadmin, coder, sourcegraph, gitadmin, spark. Weak creds: 123456, 12345678, 123456789, qwerty, password, qwer1234, zaq12wsx, 1qaz@WSX, vendor defaults. Attack chain: validation > anti-forensics > payload staging. Cmd exec: crontab removal, chattr -iae, deletion from /dev/shm/.x, /dev/shm/rete*, /var/tmp/payload, /tmp/.diicot, /tmp/kuak, /var/tmp/Documents/.diicot. SSH authorized_keys hardened. 146 SCP transfers to /dev/shm/, /tmp/ with randomized names (LhSqXQTV, NTodwsVS, ObWcSHgr, fDwImGFo, DuOljYqD). Multi-stage payload delivery with cleanup. No persistence. show less	Brute-Force SSH
🇩🇪 GrowdeinCannabis.pro	2026-03-06 21:51:02 UTC · (8 months ago)	Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 21:40:56 eager-sanderson sshd-session[607734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 21:40:57 eager-san ... show more Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 21:40:56 eager-sanderson sshd-session[607734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 21:40:57 eager-sanderson sshd-session[607734]: Failed password for invalid user s10hilary from 170.64.141.102 port 37876 ssh2 Mar 6 21:50:58 eager-sanderson sshd-session[607822]: Invalid user yusef from 170.64.141.102 port 60444 Mar 6 21:50:59 eager-sanderson sshd-session[607822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 21:51:01 eager-sanderson sshd-session[607822]: Failed password for invalid user yusef from 170.64.141.102 port 60444 ssh2 show less	Brute-Force SSH
🇺🇸 psh-ack	2026-03-06 21:32:32 UTC · (8 months ago)	Brute-force campaign: 170+ cred pairs across 242 sessions via Go SSH client. Targets: root, postgres, ubuntu, oracle, jenkins, databricks, airflow, flink, hadoop, zookeeper, ansible, docker, git. Dictionary/credential-stuffing patterns detected. Atta ... show more Brute-force campaign: 170+ cred pairs across 242 sessions via Go SSH client. Targets: root, postgres, ubuntu, oracle, jenkins, databricks, airflow, flink, hadoop, zookeeper, ansible, docker, git. Dictionary/credential-stuffing patterns detected. Attack chain: enum → cleanup → persistence removal. Executed: crontab -r (disable tasks), chattr -iae (strip immutable flags ~/.ssh/authorized_keys), rm commands (/dev/shm/.x, /dev/shm/rete*, /var/tmp/payload, /tmp/.diicot, /tmp/kuak, /var/tmp/Documents/.diicot). Suggests remediation of prior compromise or competing botnet. Secondary: 194 SCP transfers to /dev/shm and /tmp with randomized 8-char filenames (AmZibCCi, DBhjdAaq, GoPMoPAa, KwDuFaKp, TBdZkCXq, UtIOkUNE, hVSUjVHa, AQkjEEoS, DZfrydmo). Payload staging pattern. 332 unique cmds across 2484 invocations indicate scripted recon, env enum, config changes. Alignment with Mirai variants, cred stealers, cryptominers targeting multi-user systems. Duration: 15 minutes, automated activity. show less	Brute-Force SSH
🇩🇪 GrowdeinCannabis.pro	2026-03-06 21:30:48 UTC · (8 months ago)	Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 21:30:43 eager-sanderson sshd-session[607605]: Invalid user ana from 170.64.141.102 port 51344 Mar 6 21:30:43 eager-sanderson sshd-session[607605]: pam_unix(sshd:auth): authe ... show more Fail2ban jail: ssh \| IP: 170.64.141.102 \| Failures: 3 \| Last match: Mar 6 21:30:43 eager-sanderson sshd-session[607605]: Invalid user ana from 170.64.141.102 port 51344 Mar 6 21:30:43 eager-sanderson sshd-session[607605]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.141.102 Mar 6 21:30:45 eager-sanderson sshd-session[607605]: Failed password for invalid user ana from 170.64.141.102 port 51344 ssh2 Mar 6 21:30:47 eager-sanderson sshd-session[607608]: Invalid user usr1cv8 from 170.64.141.102 port 51346 show less	Brute-Force SSH

Showing 1 to 15 of 41 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇫🇷 185.194.178.61

🇧🇷 177.131.189.251

🇰🇷 125.182.93.18

🇭🇰 123.58.210.247

🇺🇸 122.8.93.76

🇨🇦 85.217.149.54

🇫🇷 85.217.140.6

🇺🇸 66.132.159.128

🇳🇱 31.14.32.8

🇰🇷 220.76.91.28

🇫🇷 217.182.194.3

🇫🇮 194.99.27.24

🇳🇱 138.226.239.66

🇨🇳 117.62.22.127

🇬🇧 89.37.172.131

🇫🇷 85.217.140.50

🇱🇹 62.60.134.134

🇺🇸 40.74.212.136

🇳🇱 34.91.0.68

🇻🇪 190.94.213.26