1.55.94.48 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Viet Nam

Internet Service Provider: FPT Broadband Service

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Attempt to attack host OS, exploiting network vulnerabilities, on 18-03-2020 13:10:21.	2020-03-18 23:56:12

Comments on same subnet:

IP	Type	Details	Datetime
1.55.94.31	attackbotsspam	1597722639 - 08/18/2020 05:50:39 Host: 1.55.94.31/1.55.94.31 Port: 445 TCP Blocked	2020-08-18 17:45:21
1.55.94.104	attack	Unauthorized connection attempt from IP address 1.55.94.104 on Port 445(SMB)	2020-08-01 03:16:16
1.55.94.170	attackspam	1594122901 - 07/07/2020 13:55:01 Host: 1.55.94.170/1.55.94.170 Port: 445 TCP Blocked	2020-07-08 04:02:30
1.55.94.99	attackbots	Attempt to attack host OS, exploiting network vulnerabilities, on 13-04-2020 18:20:07.	2020-04-14 02:19:52
1.55.94.244	attack	1586145282 - 04/06/2020 05:54:42 Host: 1.55.94.244/1.55.94.244 Port: 445 TCP Blocked	2020-04-06 14:50:16
1.55.94.204	attack	Honeypot attack, port: 445, PTR: PTR record not found	2020-02-11 20:13:49
1.55.94.98	attackbots	Email rejected due to spam filtering	2020-02-08 09:44:01
1.55.94.18	attackspambots	Unauthorized connection attempt detected from IP address 1.55.94.18 to port 445	2019-12-31 21:25:49
1.55.94.121	attack	1577112821 - 12/23/2019 15:53:41 Host: 1.55.94.121/1.55.94.121 Port: 445 TCP Blocked	2019-12-24 06:13:56
1.55.94.114	attackspambots	Unauthorised access (Nov 26) SRC=1.55.94.114 LEN=52 TTL=108 ID=18914 DF TCP DPT=445 WINDOW=8192 SYN	2019-11-26 15:44:40
1.55.94.196	attackbots	Autoban 1.55.94.196 AUTH/CONNECT	2019-11-18 22:08:47
1.55.94.137	attack	Attempt to attack host OS, exploiting network vulnerabilities, on 22-10-2019 12:45:21.	2019-10-23 02:00:22

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 1.55.94.48
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2193
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;1.55.94.48.			IN	A

;; AUTHORITY SECTION:
.			446	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020031800 1800 900 604800 86400

;; Query time: 181 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Mar 18 23:56:05 CST 2020
;; MSG SIZE  rcvd: 114

Host info

Host 48.94.55.1.in-addr.arpa not found: 2(SERVFAIL)

Nslookup info:

;; Got SERVFAIL reply from 183.60.83.19, trying next server
Server:		183.60.82.98
Address:	183.60.82.98#53

** server can't find 48.94.55.1.in-addr.arpa: SERVFAIL

Related IP info:

Related comments:

IP	Type	Details	Datetime
43.252.138.55	attack	43.252.138.55 - - [23/Sep/2019:14:11:39 +0800] "POST /data/data.asp HTTP/1.1" 404 232 "https://ipinfo.asytech.cn/data/data.asp" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" 43.252.138.55 - - [23/Sep/2019:14:11:48 +0800] "POST /inc/config.asp HTTP/1.1" 404 232 "https://ipinfo.asytech.cn/inc/config.asp" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" 43.252.138.55 - - [23/Sep/2019:14:12:23 +0800] "POST /sitemap/templates/met/SqlIn.asp HTTP/1.1" 404 232 "https://ipinfo.asytech.cn/sitemap/templates/met/SqlIn.asp" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" 43.252.138.55 - - [23/Sep/2019:14:12:34 +0800] "POST /plus/mytag_js.php?aid=511348 HTTP/1.1" 404 232 "https://ipinfo.asytech.cn/plus/mytag_js.php?aid=511348" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" 43.252.138.55 - - [23/Sep/2019:14:12:36 +0800] "POST /Templates/red.asp HTTP/1.1" 404 232 "https://ipinfo.asytech.cn/Templates/red.asp" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" 43.252.138.55 - - [23/Sep/2019:14:12:37 +0800] "POST /plus/mytag_js.php?aid=8080 HTTP/1.1" 404 232 "https://ipinfo.asytech.cn/plus/mytag_js.php?aid=8080" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"	2019-09-23 14:14:03
115.192.253.56	attackbots	Sep 23 07:13:55 markkoudstaal sshd[23951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.192.253.56 Sep 23 07:13:57 markkoudstaal sshd[23951]: Failed password for invalid user ge from 115.192.253.56 port 49722 ssh2 Sep 23 07:18:10 markkoudstaal sshd[24356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.192.253.56	2019-09-23 14:03:44
77.42.106.7	attackspam	Automatic report - Port Scan Attack	2019-09-23 13:48:24
201.252.29.132	attack	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/201.252.29.132/ US - 1H : (322) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : US NAME ASN : ASN7303 IP : 201.252.29.132 CIDR : 201.252.24.0/21 PREFIX COUNT : 1591 UNIQUE IP COUNT : 4138752 WYKRYTE ATAKI Z ASN7303 : 1H - 1 3H - 3 6H - 3 12H - 6 24H - 11 INFO : SERVER - ABB - Looking for resource vulnerabilities Detected and Blocked by ADMIN - data recovery	2019-09-23 14:27:29
78.187.8.192	attackspam	MultiHost/MultiPort Probe, Scan, Hack -	2019-09-23 14:15:55
189.100.208.204	attackbotsspam	19/9/22@23:56:34: FAIL: IoT-SSH address from=189.100.208.204 ...	2019-09-23 13:48:53
75.31.93.181	attackbotsspam	2019-09-23T11:59:20.087764enmeeting.mahidol.ac.th sshd\[2337\]: Invalid user clerk from 75.31.93.181 port 29236 2019-09-23T11:59:20.103527enmeeting.mahidol.ac.th sshd\[2337\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=75.31.93.181 2019-09-23T11:59:22.491188enmeeting.mahidol.ac.th sshd\[2337\]: Failed password for invalid user clerk from 75.31.93.181 port 29236 ssh2 ...	2019-09-23 14:02:54
54.37.233.163	attackbots	Sep 22 19:44:03 web1 sshd\[9067\]: Invalid user login from 54.37.233.163 Sep 22 19:44:03 web1 sshd\[9067\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.233.163 Sep 22 19:44:05 web1 sshd\[9067\]: Failed password for invalid user login from 54.37.233.163 port 52072 ssh2 Sep 22 19:48:10 web1 sshd\[9535\]: Invalid user demo from 54.37.233.163 Sep 22 19:48:10 web1 sshd\[9535\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.233.163	2019-09-23 13:50:29
222.186.175.212	attackbotsspam	Sep 23 07:41:55 srv206 sshd[20028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.212 user=root Sep 23 07:41:57 srv206 sshd[20028]: Failed password for root from 222.186.175.212 port 52498 ssh2 Sep 23 07:42:01 srv206 sshd[20028]: Failed password for root from 222.186.175.212 port 52498 ssh2 Sep 23 07:41:55 srv206 sshd[20028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.212 user=root Sep 23 07:41:57 srv206 sshd[20028]: Failed password for root from 222.186.175.212 port 52498 ssh2 Sep 23 07:42:01 srv206 sshd[20028]: Failed password for root from 222.186.175.212 port 52498 ssh2 ...	2019-09-23 13:53:36
77.247.110.201	attackspambots	\[2019-09-23 05:51:44\] NOTICE\[14660\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '77.247.110.201:59124' \(callid: 976112485-805759515-16720256\) - Failed to authenticate \[2019-09-23 05:51:44\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeResponseFailed",EventTV="2019-09-23T05:51:44.390+0200",Severity="Error",Service="PJSIP",EventVersion="1",AccountID="\",SessionID="976112485-805759515-16720256",LocalAddress="IPV4/UDP/188.40.118.248/5060",RemoteAddress="IPV4/UDP/77.247.110.201/59124",Challenge="1569210704/1eb8742c80313f7c2e15819bfebd9c72",Response="eb89fbce1c8c829cb0318208522bf18d",ExpectedResponse="" \[2019-09-23 05:51:44\] NOTICE\[2943\] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '\' failed for '77.247.110.201:59124' \(callid: 976112485-805759515-16720256\) - Failed to authenticate \[2019-09-23 05:51:44\] SECURITY\[1715\] res_security_log.c: SecurityEvent="ChallengeRespon	2019-09-23 14:12:50
95.170.233.76	attackbotsspam	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/95.170.233.76/ SK - 1H : (4) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : SK NAME ASN : ASN16006 IP : 95.170.233.76 CIDR : 95.170.232.0/22 PREFIX COUNT : 9 UNIQUE IP COUNT : 11264 WYKRYTE ATAKI Z ASN16006 : 1H - 1 3H - 1 6H - 1 12H - 1 24H - 1 INFO : SERVER - ABB - Looking for resource vulnerabilities Detected and Blocked by ADMIN - data recovery	2019-09-23 13:52:27
106.12.42.110	attackspambots	Sep 23 07:20:07 ns41 sshd[29620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.42.110 Sep 23 07:20:10 ns41 sshd[29620]: Failed password for invalid user pi from 106.12.42.110 port 41656 ssh2 Sep 23 07:29:29 ns41 sshd[30010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.42.110	2019-09-23 13:45:10
79.249.255.117	attackbotsspam	Automatic report - SSH Brute-Force Attack	2019-09-23 13:44:36
190.102.251.54	attackspam	WordPress XMLRPC scan :: 190.102.251.54 0.132 BYPASS [23/Sep/2019:13:56:22 1000] [censored_1] "GET /xmlrpc.php HTTP/1.1" 405 53 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"	2019-09-23 13:59:46
93.97.217.81	attack	2019-09-23T05:49:11.293827abusebot-2.cloudsearch.cf sshd\[2971\]: Invalid user admin from 93.97.217.81 port 43286	2019-09-23 14:26:21

Recently Reported IPs

94.153.125.9	23.110.92.203	116.206.8.63	71.222.157.155
1.1.172.96	116.26.206.147	41.38.17.134	51.51.83.120
216.254.147.84	223.206.219.40	15.216.94.139	144.165.64.180
60.155.115.13	174.164.55.62	128.136.19.247	34.158.200.153
135.219.14.189	212.129.127.35	49.77.199.237	180.73.119.182