45.138.16.214

Classification: Malicious

45.138.16.214 is a malicious IP address in Warsaw, PL. Linked to Warzonerat malware. 144 sightings from 6 threat sources, last seen 2026-10-17.

Current activity

  • Known attacker — Seen launching attacks over the Internet.
  • Known scanner — Seen scanning hosts over the Internet.
  • VPN node — Provides anonymization that can hide an attacker.

MITRE ATT&CK associations

Malware families: WARZONERAT (S0670)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
HTTP Spammer StopForumSpam.com 2026-08-10 07:10:02 2026-10-17 11:11:02 attacker malicious-activity
VPN IPWhois.io 2026-09-18 07:47:33 2026-09-18 07:47:33 anonymization vpn
SSH Attacker AbuseIPDB 2026-08-11 19:41:58 2026-08-15 07:06:21 attacker malicious-activity
Bruteforce AbuseIPDB 2026-08-09 01:47:23 2026-08-15 07:06:21 attacker malicious-activity
Hacking AbuseIPDB 2026-08-08 05:05:19 2026-08-15 07:06:21 attacker malicious-activity
HTTP Scrapper AbuseIPDB 2026-08-08 23:02:13 2026-08-15 03:16:37 attacker malicious-activity
HTTP Attacker AbuseIPDB 2026-08-08 05:05:19 2026-08-13 16:01:45 attacker malicious-activity
SQL Injection AbuseIPDB 2026-08-08 05:06:02 2026-08-13 15:40:04 attacker malicious-activity
Port Scanner AbuseIPDB 2026-08-12 01:01:03 2026-08-13 15:07:35 attacker malicious-activity reconnaissance
DDoS Attacker AbuseIPDB 2026-08-12 03:03:45 2026-08-12 03:03:45 attacker malicious-activity
Mail Spammer AbuseIPDB 2026-08-12 03:03:45 2026-08-12 03:03:45 attacker malicious-activity
Malicious Host AbuseIPDB 2024-11-20 22:02:49 2026-08-10 13:57:58 attacker compromised malicious-activity
HTTP bot Blocklist.de 2024-11-20 09:09:56 2024-11-21 09:06:35 malicious-activity
Suspicious Host AbuseIPDB 2024-07-24 22:46:25 2024-11-18 14:35:02 anomalous-activity
Ave Maria ThreatFox Abuse.ch 2023-10-22 06:17:02 2023-10-24 05:18:36 malicious-activity S0670 WarzoneRAT
Mail Spammer Abuseat.org 2023-10-22 06:17:02 2023-10-22 06:17:02

Tags

avemariarat rat port:5200 ave_maria warzone rat warzonerat avemaria attacker spam bruteforce bot abuse

Whois information

AS name
AS210558 1337 Services GmbH
AS registry
ripencc
AS date
2019-08-07 00:00:00
AS CIDR
45.138.16.0/24
CIDR
45.138.16.0/24
Registrant
1337 Services GmbH
Address
Ludwig-Erhard-Str. 18 DE-20459 Hamburg Germany
City
Warsaw
Postal code
00-510
Country
PL — Poland 🇵🇱
Contact email
[email protected]
First indexed
2023-10-22 06:17:02
Last updated
2026-10-17 11:11:02

Malicious IPs in the same CIDR

45.138.16.184 45.138.16.62 45.138.16.95 45.138.16.214 45.138.16.70 45.138.16.237 45.138.16.189 45.138.16.240 45.138.16.156 45.138.16.159 45.138.16.222 45.138.16.110 45.138.16.69 45.138.16.231 45.138.16.127 45.138.16.44 45.138.16.42 45.138.16.99 45.138.16.121 45.138.16.76 45.138.16.125 45.138.16.164 45.138.16.239