{ "type": "IPv4", "indicator": "45.12.70.151", "general": { "whois": "http://whois.domaintools.com/45.12.70.151", "reputation": 0, "indicator": "45.12.70.151", "type": "IPv4", "type_title": "IPv4", "base_indicator": { "id": 4383380061, "indicator": "45.12.70.151", "type": "IPv4", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "69f4022bbc9f2eb63058f951", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - May 2026", "description": "Rolling monthly view for May 2026 of indicators observed by T-Pot CE honeypots. Each run looks back the last 24h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-05-30T23:30:17.602000", "created": "2026-05-01T01:30:19.093000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4553, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 61407, "IPv6": 4283, "URL": 32, "FileHash-SHA256": 118 }, "indicator_count": 65840, "is_author": false, "is_subscribing": null, "subscriber_count": 113, "modified_text": "39 minutes ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 1 }, { "id": "6a0fb65d1948a4b8e30f010f", "name": "SOHO Router Scanning", "description": "IPs observed making scans against SOHO routers.", "modified": "2026-05-30T22:01:05.777000", "created": "2026-05-22T01:50:17.952000", "tags": [ "Inbound Scan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tkruppert", "id": "299722", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 33484 }, "indicator_count": 33484, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "2 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [], "validation": [], "asn": "AS58057 securebit ag", "city_data": true, "city": null, "region": null, "continent_code": "NA", "country_code3": "MTQ", "country_code2": "MQ", "subdivision": null, "latitude": 14.6658, "postal_code": null, "longitude": -60.9965, "accuracy_radius": 100, "country_code": "MQ", "country_name": "Martinique", "dma_code": 0, "charset": 0, "area_code": 0, "flag_url": "/assets/images/flags/mq.png", "flag_title": "Martinique", "sections": [ "general", "geo", "reputation", "url_list", "passive_dns", "malware", "nids_list", "http_scans" ] }, "geo": { "asn": "AS58057 securebit ag", "city_data": true, "city": null, "region": null, "continent_code": "NA", "country_code3": "MTQ", "country_code2": "MQ", "subdivision": null, "latitude": 14.6658, "postal_code": null, "longitude": -60.9965, "accuracy_radius": 100, "country_code": "MQ", "country_name": "Martinique", "dma_code": 0, "charset": 0, "area_code": 0, "flag_url": "/assets/images/flags/mq.png", "flag_title": "Martinique" }, "geo_ipapicom": { "country": "Finland", "country_code": "FI", "region": "Uusimaa", "city": "Helsinki", "zip": "", "latitude": 60.1698, "longitude": 24.9383, "timezone": "Europe/Helsinki", "isp": "Baykov Ilya Sergeevich", "org": "Baykov Ilya Sergeevich", "asn": "AS41745 Baykov Ilya Sergeevich", "asn_name": "FORTIS-AS", "is_proxy": false, "is_hosting": false, "source": "ip-api.com" }, "pulse_count": 2, "pulses": [ { "id": "69f4022bbc9f2eb63058f951", "name": "Honeypot Data \u2013 T-Pot - Sydney, Australia - May 2026", "description": "Rolling monthly view for May 2026 of indicators observed by T-Pot CE honeypots. Each run looks back the last 24h and appends newly seen indicators for this month. Signals are deduped and filtered (min event count threshold; private IPs excluded). Intended for defensive use; infrastructure may be compromised or spoofed. Sensor: T-Pot CE. Location: Sydney, Australia.", "modified": "2026-05-30T23:30:17.602000", "created": "2026-05-01T01:30:19.093000", "tags": [ "tpot", "honeypot", "sensor-tagged", "cowrie", "suricata", "dionaea", "honeytrap", "p0f", "fatt", "mailoney", "tanner", "sentrypeer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4553, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "conrat45", "id": "280429", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_280429/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 61407, "IPv6": 4283, "URL": 32, "FileHash-SHA256": 118 }, "indicator_count": 65840, "is_author": false, "is_subscribing": null, "subscriber_count": 113, "modified_text": "39 minutes ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 1 }, { "id": "6a0fb65d1948a4b8e30f010f", "name": "SOHO Router Scanning", "description": "IPs observed making scans against SOHO routers.", "modified": "2026-05-30T22:01:05.777000", "created": "2026-05-22T01:50:17.952000", "tags": [ "Inbound Scan" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1595", "name": "Active Scanning", "display_name": "T1595 - Active Scanning" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tkruppert", "id": "299722", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 33484 }, "indicator_count": 33484, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "2 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "IPv4", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "45.12.70.151", "type": "IPv4" }, "abuseipdb": { "indicator": "45.12.70.151", "abuse_score": 100, "verdict": "malicious", "total_reports": 69, "distinct_users": 46, "last_reported": "2026-05-30T01:25:19+00:00", "country_code": "FI", "country_name": "Finland", "isp": "InterLIR GmbH", "domain": "interlir.com", "is_tor": false, "is_public": true, "is_whitelisted": false, "usage_type": "Data Center/Web Hosting/Transit", "recent_reports": [ { "date": "2026-05-29", "categories": [ "Brute-Force" ], "comment": "", "reporter": "RU" }, { "date": "2026-05-29", "categories": [ "Port Scan" ], "comment": "2026-05-29T13:14:20.910629+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2d:5e:71:aa:73:08:00 ", "reporter": "FI" }, { "date": "2026-05-29", "categories": [ "Brute-Force", "SSH" ], "comment": "DShield firewall scan - TCP to port 25565", "reporter": "NL" }, { "date": "2026-05-29", "categories": [ "Port Scan" ], "comment": "2026-05-29T11:37:16.950736+02:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:", "reporter": "FR" }, { "date": "2026-05-29", "categories": [ "Port Scan" ], "comment": "2026-05-29T12:06:37.286316+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00", "reporter": "FI" } ], "error": null }, "urlhaus": { "indicator": "45.12.70.151", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780186208.1484523 }