This IP address has been reported a total of
8
times from
8 distinct
sources.
45.141.58.172 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated scan detection against redacted protected targets. Hits=2; port 44358 proto 6 detection da ...
show moreAutomated scan detection against redacted protected targets. Hits=2; port 44358 proto 6 detection dark_ip; port 35663 proto 6 detection dark_ip
show less
Phishing / brand impersonation of "amgbahis" served from tr.casibomgirisin-linki.vip (https://tr.cas ...
show morePhishing / brand impersonation of "amgbahis" served from tr.casibomgirisin-linki.vip (https://tr.casibomgirisin-linki.vip). Detection risk 100/100.
show less
Phishing
Anonymous
2026-06-26 UTC. Port 443/TCP (HTTPS + WSS). Complete TLS
handshake observed via openssl s_client to ...
show more2026-06-26 UTC. Port 443/TCP (HTTPS + WSS). Complete TLS
handshake observed via openssl s_client to 45.141.58.172:443
returns a certificate whose Subject Alternative Names include
api.112214marsbahis.com, m.112214marsbahis.com,
mobile.112214marsbahis.com, ws.112214marsbahis.com,
www.112214marsbahis.com (and same set under 112216marsbahis.com).
HTTPS GET / on each hostname returns a verbatim clone of the
marsbahis.com production frontend, including brand assets and
login form. The dedicated ws.* subdomain terminates a WebSocket
back-channel on this host, which is used to proxy live victim
sessions against the real marsbahis backend in real time
(adversary-in-the-middle), capturing credentials, OTP codes and
session tokens while the victim sees a successful login.
ASN: AS213373 IP Connect Inc. Active credential-theft host;
parallel reports filed with [email protected] and
Spamhaus on the same date.
show less
Web App Attack
Phishing
Showing 1 to
8
of 8 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩