72.167.227.34
IPv4AS26496 · AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US · 72.167.192.0/18 · US registry
Observed 10 times. Targeted ports: 22. Country: United States. Reputation: attack source. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root.
| Indicator | Type | Tag | Source | Last seen |
|---|---|---|---|---|
| 72.167.227.34 | ip | honeypot, historical | 2026-10-09 04:47:22 | |
Honeypot infrastructure watch: Observed 10 times. Targeted ports: 22. Country: United States. Reputation: attack source. Alert categories: Misc activity. Signatures: ET INFO SSH session in progress on Expected Port. Usernames: root. | ||||
Passive DNS relationships
Observed relationships do not establish maliciousness.
| Hostname | IP | Last seen | Hits | Provenance |
|---|---|---|---|---|
| 34.227.167.72.host.secureserver.net | 72.167.227.34 | Oct 2026First seen: Oct 2026 | 3 | CTIDAO DNS |
Record details
A · First seen Oct 2026
Network ownership
BGP origin and registry data from Team Cymru.
AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US
Registry country is RIR assignment data, not IP geolocation.
Checked 10/9/2026, 4:48:03 AM
Popularity
Daily link and hosting prominence from top1m.org; not a security verdict or traffic estimate.
Not present in the current Top 1M lists.
Internet exposure
Current scanner state. Times mean last observed open, not open now.
| Port | Transport | Service | Product | Last observed open |
|---|---|---|---|---|
| 21 | tcp | ftp | Pure-FTPd | Oct 2, 2026 |
| 22 | tcp | ssh | OpenSSH | Oct 2, 2026 |
| 110 | tcp | pop3 | Dovecot pop3d | Oct 2, 2026 |
| 111 | tcp | rpcbind | — | Oct 2, 2026 |
| 143 | tcp | imap | Dovecot imapd | Oct 2, 2026 |
21/tcpftp
Pure-FTPd
Last observed open Oct 2, 2026
22/tcpssh
OpenSSH
Last observed open Oct 2, 2026
110/tcppop3
Dovecot pop3d
Last observed open Oct 2, 2026
111/tcprpcbind
Last observed open Oct 2, 2026
143/tcpimap
Dovecot imapd
Last observed open Oct 2, 2026
Public preview is limited to five services and excludes banners.
Search full Exposure dataTake this investigation further
1 public pDNS relationships are available. Account research adds exact timing, focused pivots, and matching paid-feed intelligence. Eligible logged-in entity visits cost 1 CTIDAO, including pivots, refreshes and returns.