103.74.121.142

Basic Info

City: unknown

Region: unknown

Country: Viet Nam

Internet Service Provider: Bachkim Network Solutions JSC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspambots	php WP PHPmyadamin ABUSE blocked for 12h	2020-02-12 04:30:05
attackspambots	WordPress XMLRPC scan :: 103.74.121.142 0.076 BYPASS [15/Dec/2019:04:07:50 0000] [censored_2] "POST /xmlrpc.php HTTP/1.1" 200 236 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-12-15 14:14:01
attackbots	Request to REST API ///wp-json/wp/v2/users/	2019-12-11 02:58:01
attack	Automatic report - XMLRPC Attack	2019-11-09 00:27:50
attack	Automatic report - XMLRPC Attack	2019-10-19 21:31:24
attackbots	WordPress wp-login brute force :: 103.74.121.142 0.132 BYPASS [11/Oct/2019:17:06:34 1100] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-10-11 18:15:02
attackbotsspam	Automatic report - Banned IP Access	2019-10-07 20:16:09
attackbotsspam	Automatic report - Banned IP Access	2019-09-08 02:49:33
attack	wp-login / xmlrpc attacks Firefox version 62.0 running on Linux Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0	2019-09-02 05:22:15
attackbotsspam	WordPress wp-login brute force :: 103.74.121.142 0.052 BYPASS [25/Aug/2019:08:57:13 1000] [censored_4] "POST /wp-login.php HTTP/1.1" 200 3989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-08-25 07:47:18

Comments on same subnet:

IP	Type	Details	Datetime
103.74.121.154	attack	103.74.121.154 - - [31/Mar/2020:05:53:16 +0200] "GET /wp-login.php HTTP/1.1" 200 5807 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 103.74.121.154 - - [31/Mar/2020:05:53:19 +0200] "POST /wp-login.php HTTP/1.1" 200 6587 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 103.74.121.154 - - [31/Mar/2020:05:53:21 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-03-31 14:11:11
103.74.121.31	attack	Honeypot attack, port: 445, PTR: mail.vpigroup.vn.	2020-03-07 18:41:07
103.74.121.31	attackbotsspam	1579795338 - 01/23/2020 17:02:18 Host: 103.74.121.31/103.74.121.31 Port: 445 TCP Blocked	2020-01-24 05:47:54

Type

Details

Datetime

103.74.121.154

attack

103.74.121.154 - - [31/Mar/2020:05:53:16 +0200] "GET /wp-login.php HTTP/1.1" 200 5807 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
103.74.121.154 - - [31/Mar/2020:05:53:19 +0200] "POST /wp-login.php HTTP/1.1" 200 6587 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
103.74.121.154 - - [31/Mar/2020:05:53:21 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

2020-03-31 14:11:11

103.74.121.31

attack

Honeypot attack, port: 445, PTR: mail.vpigroup.vn.

2020-03-07 18:41:07

103.74.121.31

attackbotsspam

1579795338 - 01/23/2020 17:02:18 Host: 103.74.121.31/103.74.121.31 Port: 445 TCP Blocked

2020-01-24 05:47:54

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 103.74.121.142
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 26864
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;103.74.121.142.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019082401 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Aug 25 07:47:11 CST 2019
;; MSG SIZE  rcvd: 118

Host info

142.121.74.103.in-addr.arpa domain name pointer sv121142.bkns.vn.

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
142.121.74.103.in-addr.arpa	name = sv121142.bkns.vn.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
106.124.131.194	attackbotsspam	Nov 12 04:25:06 TORMINT sshd\[6143\]: Invalid user vgorder from 106.124.131.194 Nov 12 04:25:06 TORMINT sshd\[6143\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.124.131.194 Nov 12 04:25:08 TORMINT sshd\[6143\]: Failed password for invalid user vgorder from 106.124.131.194 port 52243 ssh2 ...	2019-11-12 19:35:39
223.100.164.221	attackspam	Nov 12 08:46:19 vps01 sshd[1815]: Failed password for root from 223.100.164.221 port 48171 ssh2	2019-11-12 19:40:53
1.203.80.78	attackbots	2019-11-12T11:25:42.687685abusebot-2.cloudsearch.cf sshd\[27310\]: Invalid user coffee from 1.203.80.78 port 33180	2019-11-12 19:40:04
103.91.54.100	attack	Nov 12 04:40:06 ny01 sshd[13837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.91.54.100 Nov 12 04:40:09 ny01 sshd[13837]: Failed password for invalid user developer from 103.91.54.100 port 34389 ssh2 Nov 12 04:44:45 ny01 sshd[14238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.91.54.100	2019-11-12 19:46:52
117.48.231.173	attackbotsspam	Nov 12 10:26:41 pl3server sshd[15186]: Invalid user webmail from 117.48.231.173 Nov 12 10:26:41 pl3server sshd[15186]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.48.231.173 Nov 12 10:26:44 pl3server sshd[15186]: Failed password for invalid user webmail from 117.48.231.173 port 42086 ssh2 Nov 12 10:26:44 pl3server sshd[15186]: Received disconnect from 117.48.231.173: 11: Bye Bye [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=117.48.231.173	2019-11-12 19:21:14
42.231.131.9	attackbots	Honeypot attack, port: 23, PTR: hn.kd.ny.adsl.	2019-11-12 19:36:57
129.204.50.75	attackbots	Nov 11 21:31:35 php1 sshd\[30989\]: Invalid user guest from 129.204.50.75 Nov 11 21:31:35 php1 sshd\[30989\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.50.75 Nov 11 21:31:38 php1 sshd\[30989\]: Failed password for invalid user guest from 129.204.50.75 port 60890 ssh2 Nov 11 21:36:25 php1 sshd\[31419\]: Invalid user dwairiuko from 129.204.50.75 Nov 11 21:36:25 php1 sshd\[31419\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.50.75	2019-11-12 19:39:37
52.196.10.77	attackspambots	xmlrpc attack	2019-11-12 19:25:30
193.233.160.70	attackbots	Received: from host58.vgnpwr.com (host58.vgnpwr.com [193.233.160.70]) by m0116272.mta.everyone.net (EON-INBOUND) with ESMTP id m0116272.5dc217b0.2f74e1 for <@antihotmail.com>; Mon, 11 Nov 2019 21:56:45 -0800 Message-ID: <8e7775cf3bec5abd9e60e6b5be6a64d8fb29c7e69e@vgnpwr.com> Reply-To: Arrigo Badolato From: Arrigo Badolato	2019-11-12 19:40:23
177.38.181.253	attackspambots	Honeypot attack, port: 23, PTR: 177-38-181-253.micks.com.br.	2019-11-12 19:42:49
119.63.133.86	attackbotsspam	Nov 11 23:12:45 web1 sshd\[7598\]: Invalid user oj123 from 119.63.133.86 Nov 11 23:12:45 web1 sshd\[7598\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.63.133.86 Nov 11 23:12:48 web1 sshd\[7598\]: Failed password for invalid user oj123 from 119.63.133.86 port 56386 ssh2 Nov 11 23:18:49 web1 sshd\[8122\]: Invalid user \#\#\#\#\#\#\# from 119.63.133.86 Nov 11 23:18:49 web1 sshd\[8122\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.63.133.86	2019-11-12 19:46:35
104.254.92.52	attackspam	(From clifford.schoenheimer@gmail.com) Would you like to post your ad on 1000's of Advertising sites monthly? Pay one flat rate and get virtually unlimited traffic to your site forever! Get more info by visiting: http://www.postmyads.tech	2019-11-12 19:54:09
92.255.95.242	attackspam	Nov 11 11:26:10 host sshd[6709]: User r.r from 92.255.95.242 not allowed because none of user's groups are listed in AllowGroups Nov 11 11:26:10 host sshd[6709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.95.242 user=r.r Nov 11 11:26:12 host sshd[6709]: Failed password for invalid user r.r from 92.255.95.242 port 45788 ssh2 Nov 11 11:26:12 host sshd[6709]: Received disconnect from 92.255.95.242 port 45788:11: Normal Shutdown, Thank you for playing [preauth] Nov 11 11:26:12 host sshd[6709]: Disconnected from invalid user r.r 92.255.95.242 port 45788 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=92.255.95.242	2019-11-12 19:43:12
140.143.227.43	attack	Nov 11 22:22:46 tdfoods sshd\[7956\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.227.43 user=root Nov 11 22:22:48 tdfoods sshd\[7956\]: Failed password for root from 140.143.227.43 port 52598 ssh2 Nov 11 22:27:54 tdfoods sshd\[8366\]: Invalid user portal from 140.143.227.43 Nov 11 22:27:54 tdfoods sshd\[8366\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.227.43 Nov 11 22:27:56 tdfoods sshd\[8366\]: Failed password for invalid user portal from 140.143.227.43 port 42358 ssh2	2019-11-12 19:53:15
183.239.61.55	attackspam	Nov 12 12:40:46 vps691689 sshd[32024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.239.61.55 Nov 12 12:40:49 vps691689 sshd[32024]: Failed password for invalid user vcsa from 183.239.61.55 port 39916 ssh2 ...	2019-11-12 19:50:29

Recently Reported IPs

187.125.58.115	52.25.188.227	106.159.78.61	31.11.135.51
89.127.243.111	204.91.175.176	210.223.13.133	11.63.204.149
147.204.69.154	20.78.68.111	106.62.88.194	156.87.71.2
45.64.203.208	48.117.195.240	101.143.186.209	94.49.178.218
206.216.227.251	176.233.122.211	75.116.142.88	27.219.47.18