City: unknown
Region: unknown
Country: South Africa
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 102.140.75.106
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19305
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;102.140.75.106. IN A
;; AUTHORITY SECTION:
. 218 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2023102100 1800 900 604800 86400
;; Query time: 26 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Oct 22 02:02:37 CST 2023
;; MSG SIZE rcvd: 107b'Host 106.75.140.102.in-addr.arpa. not found: 3(NXDOMAIN)
'Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 106.75.140.102.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 80.82.77.227 | attack | 04/16/2020-01:19:39.536419 80.82.77.227 Protocol: 6 ET DROP Dshield Block Listed Source group 1 |
2020-04-16 14:41:47 |
| 198.245.62.64 | attackspam | 04/15/2020-23:54:00.463744 198.245.62.64 Protocol: 6 ET SCAN NMAP -sS window 1024 |
2020-04-16 14:19:03 |
| 45.143.220.112 | attack | port scan |
2020-04-16 14:30:29 |
| 178.154.200.157 | attackspambots | [Thu Apr 16 10:53:16.444176 2020] [:error] [pid 26533:tid 140327310583552] [client 178.154.200.157:38330] [client 178.154.200.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XpfWrAgMfcwBi0GyvasHrwAABO4"] ... |
2020-04-16 14:46:00 |
| 191.191.98.243 | attack | (sshd) Failed SSH login from 191.191.98.243 (BR/Brazil/bfbf62f3.virtua.com.br): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 16 05:45:12 amsweb01 sshd[10647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.191.98.243 user=root Apr 16 05:45:14 amsweb01 sshd[10647]: Failed password for root from 191.191.98.243 port 50655 ssh2 Apr 16 05:50:48 amsweb01 sshd[11270]: Invalid user teampspeak from 191.191.98.243 port 51789 Apr 16 05:50:49 amsweb01 sshd[11270]: Failed password for invalid user teampspeak from 191.191.98.243 port 51789 ssh2 Apr 16 05:53:34 amsweb01 sshd[11486]: Invalid user antje from 191.191.98.243 port 36667 |
2020-04-16 14:37:03 |
| 218.92.0.212 | attackspambots | $f2bV_matches |
2020-04-16 14:53:29 |
| 37.49.229.201 | attackbots | [2020-04-16 02:33:29] NOTICE[1170][C-00000db9] chan_sip.c: Call from '' (37.49.229.201:7886) to extension '6121553293520263' rejected because extension not found in context 'public'. [2020-04-16 02:33:29] NOTICE[1170][C-00000dba] chan_sip.c: Call from '' (37.49.229.201:7886) to extension '6121553293520263' rejected because extension not found in context 'public'. [2020-04-16 02:33:29] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-16T02:33:29.212-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="6121553293520263",SessionID="0x7f6c080e4658",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.229.201/7886",ACLName="no_extension_match" [2020-04-16 02:33:29] SECURITY[1184] res_security_log.c: SecurityEvent="FailedACL",EventTV="2020-04-16T02:33:29.212-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="6121553293520263",SessionID="0x7f6c08099cc8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP ... |
2020-04-16 14:49:25 |
| 157.245.40.65 | attackbotsspam | Apr 15 23:03:59 server1 sshd\[3059\]: Failed password for invalid user admin from 157.245.40.65 port 47196 ssh2 Apr 15 23:07:34 server1 sshd\[4097\]: Invalid user gitlab from 157.245.40.65 Apr 15 23:07:34 server1 sshd\[4097\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.40.65 Apr 15 23:07:36 server1 sshd\[4097\]: Failed password for invalid user gitlab from 157.245.40.65 port 54982 ssh2 Apr 15 23:11:13 server1 sshd\[5127\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.40.65 user=root ... |
2020-04-16 14:44:11 |
| 129.28.188.115 | attack | Apr 16 05:52:59 ns3164893 sshd[32177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.188.115 Apr 16 05:53:01 ns3164893 sshd[32177]: Failed password for invalid user ss3 from 129.28.188.115 port 36310 ssh2 ... |
2020-04-16 14:58:46 |
| 59.173.238.118 | attackbotsspam | Apr 16 05:53:06 debian-2gb-nbg1-2 kernel: \[9268169.170554\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=59.173.238.118 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=5124 PROTO=TCP SPT=48876 DPT=20063 WINDOW=1024 RES=0x00 SYN URGP=0 |
2020-04-16 14:54:30 |
| 218.92.0.148 | attackspambots | Apr 16 08:02:13 meumeu sshd[3540]: Failed password for root from 218.92.0.148 port 43374 ssh2 Apr 16 08:02:28 meumeu sshd[3540]: Failed password for root from 218.92.0.148 port 43374 ssh2 Apr 16 08:02:29 meumeu sshd[3540]: error: maximum authentication attempts exceeded for root from 218.92.0.148 port 43374 ssh2 [preauth] ... |
2020-04-16 14:23:51 |
| 158.69.192.35 | attackbots | Apr 16 08:12:15 roki sshd[6274]: Invalid user rosalba from 158.69.192.35 Apr 16 08:12:15 roki sshd[6274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.192.35 Apr 16 08:12:16 roki sshd[6274]: Failed password for invalid user rosalba from 158.69.192.35 port 36382 ssh2 Apr 16 08:19:19 roki sshd[6738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=158.69.192.35 user=root Apr 16 08:19:21 roki sshd[6738]: Failed password for root from 158.69.192.35 port 47300 ssh2 ... |
2020-04-16 14:20:35 |
| 149.202.18.215 | spam | spam e-mails |
2020-04-16 14:27:03 |
| 178.154.200.105 | attackspam | [Thu Apr 16 12:44:55.089344 2020] [:error] [pid 1527:tid 140331760490240] [client 178.154.200.105:33188] [client 178.154.200.105] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "Xpfw12lkhyDS5@56sEk1TAAAAZU"] ... |
2020-04-16 14:34:52 |
| 181.174.122.144 | attack | Automatic report - Port Scan Attack |
2020-04-16 14:41:32 |