1.63.164.142 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: China Unicom Heilongjiang Province Network

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	Jun 23 12:59:32 srv-4 sshd\[24852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.63.164.142 user=root Jun 23 12:59:34 srv-4 sshd\[24852\]: Failed password for root from 1.63.164.142 port 13873 ssh2 Jun 23 12:59:42 srv-4 sshd\[24852\]: Failed password for root from 1.63.164.142 port 13873 ssh2 ...	2019-06-23 20:48:01

Type

Details

Datetime

attackbots

Jun 23 12:59:32 srv-4 sshd\[24852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.63.164.142  user=root
Jun 23 12:59:34 srv-4 sshd\[24852\]: Failed password for root from 1.63.164.142 port 13873 ssh2
Jun 23 12:59:42 srv-4 sshd\[24852\]: Failed password for root from 1.63.164.142 port 13873 ssh2
...

2019-06-23 20:48:01

Comments on same subnet:

No discussion about this subnet yet..

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 1.63.164.142
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28460
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;1.63.164.142.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019062300 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Jun 23 20:47:52 CST 2019
;; MSG SIZE  rcvd: 116

Host info

Host 142.164.63.1.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 142.164.63.1.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
103.87.46.86	attackspam	Jun 13 22:40:58 mail.srvfarm.net postfix/smtpd[1286847]: warning: unknown[103.87.46.86]: SASL PLAIN authentication failed: Jun 13 22:40:58 mail.srvfarm.net postfix/smtpd[1286847]: lost connection after AUTH from unknown[103.87.46.86] Jun 13 22:43:25 mail.srvfarm.net postfix/smtpd[1294826]: warning: unknown[103.87.46.86]: SASL PLAIN authentication failed: Jun 13 22:43:25 mail.srvfarm.net postfix/smtpd[1294826]: lost connection after AUTH from unknown[103.87.46.86] Jun 13 22:43:44 mail.srvfarm.net postfix/smtpd[1287062]: warning: unknown[103.87.46.86]: SASL PLAIN authentication failed:	2020-06-14 08:37:08
222.186.30.167	attack	Jun 14 02:50:09 v22018053744266470 sshd[9104]: Failed password for root from 222.186.30.167 port 51751 ssh2 Jun 14 02:50:18 v22018053744266470 sshd[9115]: Failed password for root from 222.186.30.167 port 35093 ssh2 ...	2020-06-14 08:52:14
134.122.50.199	attackspambots	Auto Fail2Ban report, multiple SMTP login attempts.	2020-06-14 09:02:54
189.240.225.205	attackspambots	Jun 14 00:19:40 ns37 sshd[23015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.240.225.205	2020-06-14 08:50:41
158.69.0.38	attack	Scanned 1 times in the last 24 hours on port 22	2020-06-14 08:57:00
45.89.174.46	attack	[2020-06-13 20:30:24] NOTICE[1273] chan_sip.c: Registration from '' failed for '45.89.174.46:64406' - Wrong password [2020-06-13 20:30:24] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-13T20:30:24.072-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="6459",SessionID="0x7f31c0311868",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.89.174.46/64406",Challenge="6e6b311c",ReceivedChallenge="6e6b311c",ReceivedHash="ff25d3255165897261df1e2c02d9b3fc" [2020-06-13 20:31:13] NOTICE[1273] chan_sip.c: Registration from '' failed for '45.89.174.46:59690' - Wrong password [2020-06-13 20:31:13] SECURITY[1288] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-06-13T20:31:13.384-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="3295",SessionID="0x7f31c018ea98",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.89.174.46/596 ...	2020-06-14 08:51:29
46.38.145.254	attackbots	Rude login attack (844 tries in 1d)	2020-06-14 08:40:57
203.198.104.24	attackspam	Automatic report - Port Scan Attack	2020-06-14 09:15:16
181.45.101.120	attackbotsspam	SASL PLAIN auth failed: ruser=...	2020-06-14 09:13:10
62.234.182.174	attackbotsspam	SSH Attack	2020-06-14 09:13:24
122.117.243.229	attackspam	Port probing on unauthorized port 23	2020-06-14 08:44:15
13.75.140.64	attack	2020-06-14 02:23:32 dovecot_login authenticator failed for $ADMIN$ \[13.75.140.64\]: 535 Incorrect authentication data $set_id=support@opso.it$ 2020-06-14 02:25:23 dovecot_login authenticator failed for $ADMIN$ \[13.75.140.64\]: 535 Incorrect authentication data $set_id=support@opso.it$ 2020-06-14 02:27:15 dovecot_login authenticator failed for $ADMIN$ \[13.75.140.64\]: 535 Incorrect authentication data $set_id=support@opso.it$ 2020-06-14 02:29:06 dovecot_login authenticator failed for $ADMIN$ \[13.75.140.64\]: 535 Incorrect authentication data $set_id=support@opso.it$ 2020-06-14 02:30:56 dovecot_login authenticator failed for $ADMIN$ \[13.75.140.64\]: 535 Incorrect authentication data $set_id=support@opso.it$	2020-06-14 08:47:21
138.68.50.18	attackbots	Jun 13 23:03:10 vps sshd[899884]: Failed password for invalid user mmadmin from 138.68.50.18 port 39616 ssh2 Jun 13 23:04:09 vps sshd[903541]: Invalid user Welkome$#1234 from 138.68.50.18 port 49994 Jun 13 23:04:09 vps sshd[903541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.50.18 Jun 13 23:04:11 vps sshd[903541]: Failed password for invalid user Welkome$#1234 from 138.68.50.18 port 49994 ssh2 Jun 13 23:05:09 vps sshd[911289]: Invalid user meres from 138.68.50.18 port 60372 ...	2020-06-14 09:19:01
114.231.105.233	attackspambots	Jun 13 20:59:47 delaware postfix/smtpd[7644]: warning: hostname 233.105.231.114.broad.nt.js.dynamic.163data.com.cn does not resolve to address 114.231.105.233: Name or service not known Jun 13 20:59:47 delaware postfix/smtpd[7644]: connect from unknown[114.231.105.233] Jun 13 20:59:48 delaware postfix/smtpd[7644]: NOQUEUE: reject: RCPT from unknown[114.231.105.233]: 554 5.7.1 Service unavailable; Client host [114.231.105.233] blocked using ix.dnsbl.xxxxxx.net; Your e-mail service was detected by spam.over.port25.me (NiX Spam) as spamming at Sat, 13 Jun 2020 17:07:07 +0200. Your admin should vishostname hxxp://www.dnsbl.xxxxxx.net/lookup.php?value=114.231.105.233; from=x@x helo= Jun 13 20:59:48 delaware postfix/smtpd[7644]: disconnect from unknown[114.231.105.233] ehlo=1 mail=1 rcpt=0/1 quhostname=1 commands=3/4 Jun 13 20:59:48 delaware postfix/smtpd[7644]: warning: hostname 233.105.231.114.broad.nt.js.dynamic.163data.com.cn does not resolve to address 114.231......... -------------------------------	2020-06-14 09:06:44
144.172.73.37	attackspam	SSH-BruteForce	2020-06-14 08:55:01

Recently Reported IPs

52.166.142.94	185.149.121.150	124.156.194.166	58.97.14.130
2607:f298:5:101b::d4c:9764	123.163.135.83	51.15.82.142	39.69.196.130
187.107.16.106	235.17.215.117	93.41.133.245	110.246.231.250
190.7.30.187	18.26.80.64	45.5.164.193	62.143.236.153
223.17.202.7	167.99.220.148	104.152.187.226	37.24.143.134