104.148.3.3 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: Global Frag Networks

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbotsspam	01/15/2020-23:51:19.016127 104.148.3.3 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433	2020-01-16 15:41:53
attackbots	Portscan or hack attempt detected by psad/fwsnort	2019-11-21 06:46:26
attackbotsspam	10/25/2019-23:45:01.508282 104.148.3.3 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433	2019-10-26 18:35:56

Type

Details

Datetime

attackbotsspam

01/15/2020-23:51:19.016127 104.148.3.3 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

2020-01-16 15:41:53

attackbots

Portscan or hack attempt detected by psad/fwsnort

2019-11-21 06:46:26

attackbotsspam

10/25/2019-23:45:01.508282 104.148.3.3 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433

2019-10-26 18:35:56

Comments on same subnet:

No discussion about this subnet yet..

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.148.3.3
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 50717
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;104.148.3.3.			IN	A

;; AUTHORITY SECTION:
.			461	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019102600 1800 900 604800 86400

;; Query time: 90 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Oct 26 18:35:53 CST 2019
;; MSG SIZE  rcvd: 115

Host info

Host 3.3.148.104.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 3.3.148.104.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
78.94.204.238	attackbotsspam	port scan and connect, tcp 80 (http)	2020-01-02 06:03:18
45.136.108.120	attack	Jan 1 21:43:26 h2177944 kernel: \[1110036.889895\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.108.120 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=40603 PROTO=TCP SPT=44777 DPT=1537 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 1 21:43:26 h2177944 kernel: \[1110036.889906\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.108.120 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=40603 PROTO=TCP SPT=44777 DPT=1537 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 1 22:01:17 h2177944 kernel: \[1111107.584825\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.108.120 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=19495 PROTO=TCP SPT=44777 DPT=1715 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 1 22:01:17 h2177944 kernel: \[1111107.584838\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.108.120 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=249 ID=19495 PROTO=TCP SPT=44777 DPT=1715 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 1 22:41:21 h2177944 kernel: \[1113511.002021\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=45.136.108.120 DST=85.214.	2020-01-02 05:41:35
109.235.71.192	attackspam	SSH Brute Force	2020-01-02 05:49:52
182.143.107.40	attackbotsspam	Jan 1 09:35:50 eola postfix/smtpd[20335]: connect from unknown[182.143.107.40] Jan 1 09:35:50 eola postfix/smtpd[20333]: connect from unknown[182.143.107.40] Jan 1 09:35:50 eola postfix/smtpd[20333]: lost connection after CONNECT from unknown[182.143.107.40] Jan 1 09:35:50 eola postfix/smtpd[20333]: disconnect from unknown[182.143.107.40] commands=0/0 Jan 1 09:35:54 eola postfix/smtpd[20335]: lost connection after AUTH from unknown[182.143.107.40] Jan 1 09:35:54 eola postfix/smtpd[20335]: disconnect from unknown[182.143.107.40] ehlo=1 auth=0/1 commands=1/2 Jan 1 09:35:54 eola postfix/smtpd[20333]: connect from unknown[182.143.107.40] Jan 1 09:36:00 eola postfix/smtpd[20333]: lost connection after AUTH from unknown[182.143.107.40] Jan 1 09:36:00 eola postfix/smtpd[20333]: disconnect from unknown[182.143.107.40] ehlo=1 auth=0/1 commands=1/2 Jan 1 09:36:01 eola postfix/smtpd[20335]: connect from unknown[182.143.107.40] Jan 1 09:36:09 eola postfix/smtpd[20335]: l........ -------------------------------	2020-01-02 05:52:25
220.134.218.112	attack	Jan 1 17:46:42 MK-Soft-VM7 sshd[19604]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.134.218.112 Jan 1 17:46:44 MK-Soft-VM7 sshd[19604]: Failed password for invalid user stolze from 220.134.218.112 port 53812 ssh2 ...	2020-01-02 05:35:55
185.176.27.54	attackbotsspam	01/01/2020-21:38:28.099912 185.176.27.54 Protocol: 6 ET DROP Dshield Block Listed Source group 1	2020-01-02 05:54:19
46.173.6.46	attack	Unauthorized connection attempt detected from IP address 46.173.6.46 to port 5555	2020-01-02 06:04:16
209.235.67.49	attackspam	Invalid user wiesmeier from 209.235.67.49 port 48359	2020-01-02 06:06:48
5.172.14.241	attackspambots	Jan 1 11:41:37 ldap01vmsma01 sshd[110845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.172.14.241 Jan 1 11:41:39 ldap01vmsma01 sshd[110845]: Failed password for invalid user service from 5.172.14.241 port 3643 ssh2 ...	2020-01-02 06:00:05
177.69.237.49	attackbots	Jan 1 17:22:11 [host] sshd[4555]: Invalid user 12345 from 177.69.237.49 Jan 1 17:22:11 [host] sshd[4555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.69.237.49 Jan 1 17:22:13 [host] sshd[4555]: Failed password for invalid user 12345 from 177.69.237.49 port 38764 ssh2	2020-01-02 05:43:02
36.82.102.222	attackbots	Jan 1 18:23:07 mail sshd[8034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.82.102.222 Jan 1 18:23:09 mail sshd[8034]: Failed password for invalid user asterisk from 36.82.102.222 port 38447 ssh2 ...	2020-01-02 05:27:34
125.212.207.205	attackbots	Jan 1 16:22:47 localhost sshd\[39982\]: Invalid user varnish from 125.212.207.205 port 52430 Jan 1 16:22:47 localhost sshd\[39982\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.207.205 Jan 1 16:22:50 localhost sshd\[39982\]: Failed password for invalid user varnish from 125.212.207.205 port 52430 ssh2 Jan 1 16:25:26 localhost sshd\[40041\]: Invalid user stiff from 125.212.207.205 port 44218 Jan 1 16:25:26 localhost sshd\[40041\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.207.205 ...	2020-01-02 05:37:42
182.186.112.85	attackbotsspam	Jan 1 15:43:05 grey postfix/smtpd\[23588\]: NOQUEUE: reject: RCPT from unknown\[182.186.112.85\]: 554 5.7.1 Service unavailable\; Client host \[182.186.112.85\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[182.186.112.85\]\; from=\ to=\ proto=ESMTP helo=\<\[182.186.112.85\]\> ...	2020-01-02 05:26:38
58.65.136.170	attack	$f2bV_matches	2020-01-02 05:33:01
218.92.0.191	attack	Jan 1 22:31:22 dcd-gentoo sshd[8622]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups Jan 1 22:31:24 dcd-gentoo sshd[8622]: error: PAM: Authentication failure for illegal user root from 218.92.0.191 Jan 1 22:31:22 dcd-gentoo sshd[8622]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups Jan 1 22:31:24 dcd-gentoo sshd[8622]: error: PAM: Authentication failure for illegal user root from 218.92.0.191 Jan 1 22:31:22 dcd-gentoo sshd[8622]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups Jan 1 22:31:24 dcd-gentoo sshd[8622]: error: PAM: Authentication failure for illegal user root from 218.92.0.191 Jan 1 22:31:24 dcd-gentoo sshd[8622]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.191 port 22507 ssh2 ...	2020-01-02 05:32:02

Recently Reported IPs

104.209.45.242	36.57.70.58	140.143.36.172	146.168.30.89
200.94.197.120	42.188.231.155	45.82.32.28	72.167.190.229
41.60.233.71	106.54.219.195	200.125.166.227	136.243.21.13
112.244.87.159	114.225.220.148	37.76.137.93	212.119.233.55
114.225.222.162	77.228.171.163	148.251.20.137	52.192.157.251