1.52.120.94 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Viet Nam

Internet Service Provider: FPT Telecom

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	1.52.120.94 - - [18/Oct/2019:07:39:23 -0400] "GET /?page=products&action=..%2f..%2fetc%2fpasswd%00&manufacturerID=61&productID=4701-RIM&linkID=16812 HTTP/1.1" 200 17420 "https://exitdevice.com/?page=products&action=..%2f..%2fetc%2fpasswd%00&manufacturerID=61&productID=4701-RIM&linkID=16812" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0" ...	2019-10-18 23:31:43

Type

Details

Datetime

attack

1.52.120.94 - - [18/Oct/2019:07:39:23 -0400] "GET /?page=products&action=..%2f..%2fetc%2fpasswd%00&manufacturerID=61&productID=4701-RIM&linkID=16812 HTTP/1.1" 200 17420 "https://exitdevice.com/?page=products&action=..%2f..%2fetc%2fpasswd%00&manufacturerID=61&productID=4701-RIM&linkID=16812" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0"
...

2019-10-18 23:31:43

Comments on same subnet:

IP	Type	Details	Datetime
1.52.120.203	attack	Unauthorized connection attempt from IP address 1.52.120.203 on Port 445(SMB)	2020-02-29 14:25:16
1.52.120.128	attackspambots	Unauthorized connection attempt from IP address 1.52.120.128 on Port 445(SMB)	2019-07-13 09:16:40

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 1.52.120.94
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9034
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;1.52.120.94.			IN	A

;; AUTHORITY SECTION:
.			412	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019101800 1800 900 604800 86400

;; Query time: 141 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Oct 18 23:31:37 CST 2019
;; MSG SIZE  rcvd: 115

Host info

Host 94.120.52.1.in-addr.arpa not found: 2(SERVFAIL)

Nslookup info:

;; Got SERVFAIL reply from 183.60.83.19, trying next server
Server:		183.60.82.98
Address:	183.60.82.98#53

** server can't find 94.120.52.1.in-addr.arpa: SERVFAIL

Related IP info:

Related comments:

IP	Type	Details	Datetime
189.112.238.75	attackbotsspam	Unauthorized connection attempt from IP address 189.112.238.75 on Port 445(SMB)	2019-09-27 04:02:01
183.82.97.75	attackbotsspam	Unauthorized connection attempt from IP address 183.82.97.75 on Port 445(SMB)	2019-09-27 03:55:50
198.108.66.144	attackbots	5900/tcp 5432/tcp [2019-09-11/26]2pkt	2019-09-27 04:12:39
59.125.68.147	attackbots	Unauthorized connection attempt from IP address 59.125.68.147 on Port 445(SMB)	2019-09-27 04:12:06
113.231.82.230	attackspam	Honeypot attack, port: 23, PTR: PTR record not found	2019-09-27 03:51:36
118.24.23.196	attackbots	Unauthorized SSH login attempts	2019-09-27 03:34:34
113.161.90.185	attackbotsspam	Unauthorized connection attempt from IP address 113.161.90.185 on Port 445(SMB)	2019-09-27 03:46:59
156.199.136.218	attack	Telnet/23 MH Probe, BF, Hack -	2019-09-27 03:53:25
121.119.148.253	attackbotsspam	wget call in url	2019-09-27 04:09:17
104.236.239.60	attack	Sep 26 09:52:23 lcprod sshd\[11499\]: Invalid user sinusbot from 104.236.239.60 Sep 26 09:52:23 lcprod sshd\[11499\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.239.60 Sep 26 09:52:25 lcprod sshd\[11499\]: Failed password for invalid user sinusbot from 104.236.239.60 port 39811 ssh2 Sep 26 09:56:10 lcprod sshd\[11847\]: Invalid user fb from 104.236.239.60 Sep 26 09:56:10 lcprod sshd\[11847\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.239.60	2019-09-27 03:58:44
49.159.28.192	attack	Unauthorized connection attempt from IP address 49.159.28.192 on Port 445(SMB)	2019-09-27 04:07:14
86.127.113.133	attackspambots	Automatic report - Port Scan Attack	2019-09-27 03:43:20
185.40.4.67	attack	\[2019-09-26 15:38:13\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '185.40.4.67:60329' - Wrong password \[2019-09-26 15:38:13\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-26T15:38:13.202-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="9999",SessionID="0x7f1e1c1e96b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.40.4.67/60329",Challenge="2708c52b",ReceivedChallenge="2708c52b",ReceivedHash="b54807677cb40478354dcf014371d9db" \[2019-09-26 15:38:47\] NOTICE\[1948\] chan_sip.c: Registration from '\' failed for '185.40.4.67:58816' - Wrong password \[2019-09-26 15:38:47\] SECURITY\[2006\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-09-26T15:38:47.998-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="222222",SessionID="0x7f1e1c1e96b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.40.4.67	2019-09-27 03:50:48
13.235.226.185	attackspambots	/test/wp-login.php	2019-09-27 03:45:14
60.220.230.21	attack	Sep 26 20:14:08 mail1 sshd\[17411\]: Invalid user adminttd from 60.220.230.21 port 34255 Sep 26 20:14:08 mail1 sshd\[17411\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.220.230.21 Sep 26 20:14:11 mail1 sshd\[17411\]: Failed password for invalid user adminttd from 60.220.230.21 port 34255 ssh2 Sep 26 20:21:56 mail1 sshd\[21031\]: Invalid user boon from 60.220.230.21 port 34200 Sep 26 20:21:56 mail1 sshd\[21031\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.220.230.21 ...	2019-09-27 03:57:23

Recently Reported IPs

37.20.200.50	86.189.202.120	236.41.236.145	54.47.210.111
87.251.227.187	239.58.226.96	54.74.213.212	69.173.146.7
171.115.104.82	230.25.204.179	60.50.212.36	159.203.201.251
200.100.56.79	178.176.175.215	172.247.109.217	176.99.138.154
185.79.242.253	106.13.110.74	5.197.247.33	129.211.110.175