104.168.44.143

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: ColoCrossing

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	Dec 13 11:33:12 ny01 sshd[31066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143 Dec 13 11:33:14 ny01 sshd[31066]: Failed password for invalid user newsletter from 104.168.44.143 port 43130 ssh2 Dec 13 11:39:50 ny01 sshd[31739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143	2019-12-14 00:46:02
attackbotsspam	web-1 [ssh_2] SSH Attack	2019-12-11 23:38:51
attackbotsspam	Dec 10 01:53:55 hpm sshd\[17064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143 user=root Dec 10 01:53:58 hpm sshd\[17064\]: Failed password for root from 104.168.44.143 port 34136 ssh2 Dec 10 02:01:01 hpm sshd\[17755\]: Invalid user Administrator from 104.168.44.143 Dec 10 02:01:01 hpm sshd\[17755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143 Dec 10 02:01:03 hpm sshd\[17755\]: Failed password for invalid user Administrator from 104.168.44.143 port 54488 ssh2	2019-12-10 20:05:03

Type

Details

Datetime

attackspam

Dec 13 11:33:12 ny01 sshd[31066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143
Dec 13 11:33:14 ny01 sshd[31066]: Failed password for invalid user newsletter from 104.168.44.143 port 43130 ssh2
Dec 13 11:39:50 ny01 sshd[31739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143

2019-12-14 00:46:02

attackbotsspam

web-1 [ssh_2] SSH Attack

2019-12-11 23:38:51

attackbotsspam

Dec 10 01:53:55 hpm sshd\[17064\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143  user=root
Dec 10 01:53:58 hpm sshd\[17064\]: Failed password for root from 104.168.44.143 port 34136 ssh2
Dec 10 02:01:01 hpm sshd\[17755\]: Invalid user Administrator from 104.168.44.143
Dec 10 02:01:01 hpm sshd\[17755\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.143
Dec 10 02:01:03 hpm sshd\[17755\]: Failed password for invalid user Administrator from 104.168.44.143 port 54488 ssh2

2019-12-10 20:05:03

Comments on same subnet:

IP	Type	Details	Datetime
104.168.44.234	attackbots	(sshd) Failed SSH login from 104.168.44.234 (US/United States/104-168-44-234-host.colocrossing.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 11 10:27:58 server sshd[8862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.234 user=root Sep 11 10:28:00 server sshd[8862]: Failed password for root from 104.168.44.234 port 58941 ssh2 Sep 11 10:33:47 server sshd[10512]: Invalid user admin from 104.168.44.234 port 40915 Sep 11 10:33:49 server sshd[10512]: Failed password for invalid user admin from 104.168.44.234 port 40915 ssh2 Sep 11 10:38:06 server sshd[11726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.234 user=root	2020-09-12 00:00:24
104.168.44.234	attackspam	Sep 9 14:06:52 rudra sshd[463388]: reveeclipse mapping checking getaddrinfo for 104-168-44-234-host.colocrossing.com [104.168.44.234] failed - POSSIBLE BREAK-IN ATTEMPT! Sep 9 14:06:52 rudra sshd[463388]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.234 user=r.r Sep 9 14:06:54 rudra sshd[463388]: Failed password for r.r from 104.168.44.234 port 50812 ssh2 Sep 9 14:06:54 rudra sshd[463388]: Received disconnect from 104.168.44.234: 11: Bye Bye [preauth] Sep 9 14:12:34 rudra sshd[464223]: reveeclipse mapping checking getaddrinfo for 104-168-44-234-host.colocrossing.com [104.168.44.234] failed - POSSIBLE BREAK-IN ATTEMPT! Sep 9 14:12:34 rudra sshd[464223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.234 user=r.r Sep 9 14:12:37 rudra sshd[464223]: Failed password for r.r from 104.168.44.234 port 35947 ssh2 Sep 9 14:12:37 rudra sshd[464223]: Received disconne........ -------------------------------	2020-09-11 16:00:51
104.168.44.234	attackspambots	5x Failed Password	2020-09-11 08:12:37
104.168.44.234	attackbotsspam	Aug 26 19:14:18 vzhost sshd[17838]: reveeclipse mapping checking getaddrinfo for 104-168-44-234-host.colocrossing.com [104.168.44.234] failed - POSSIBLE BREAK-IN ATTEMPT! Aug 26 19:14:18 vzhost sshd[17838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.234 user=r.r Aug 26 19:14:20 vzhost sshd[17838]: Failed password for r.r from 104.168.44.234 port 53638 ssh2 Aug 26 19:28:26 vzhost sshd[20952]: reveeclipse mapping checking getaddrinfo for 104-168-44-234-host.colocrossing.com [104.168.44.234] failed - POSSIBLE BREAK-IN ATTEMPT! Aug 26 19:28:26 vzhost sshd[20952]: Invalid user palash from 104.168.44.234 Aug 26 19:28:26 vzhost sshd[20952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.234 Aug 26 19:28:28 vzhost sshd[20952]: Failed password for invalid user palash from 104.168.44.234 port 33171 ssh2 Aug 26 19:32:28 vzhost sshd[21845]: reveeclipse mapping checking geta........ -------------------------------	2020-08-27 07:58:19
104.168.44.142	attackbots	Flask-IPban - exploit URL requested:/TP/public/index.php	2020-06-14 05:40:42
104.168.44.158	attack	Port Scan detected from 104.168.44.158 (NL/Netherlands/North Holland/Amsterdam/104-168-44-158-host.colocrossing.com). 4 hits in the last 45 seconds	2020-04-30 15:50:42
104.168.44.166	attackbotsspam	Lines containing failures of 104.168.44.166 Apr 28 19:19:17 UTC__SANYALnet-Labs__cac12 sshd[9912]: Connection from 104.168.44.166 port 49337 on 64.137.176.96 port 22 Apr 28 19:19:17 UTC__SANYALnet-Labs__cac12 sshd[9912]: Did not receive identification string from 104.168.44.166 port 49337 Apr 28 19:19:21 UTC__SANYALnet-Labs__cac12 sshd[9913]: Connection from 104.168.44.166 port 52003 on 64.137.176.96 port 22 Apr 28 19:19:22 UTC__SANYALnet-Labs__cac12 sshd[9913]: Address 104.168.44.166 maps to 104-168-44-166-host.colocrossing.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Apr 28 19:19:22 UTC__SANYALnet-Labs__cac12 sshd[9913]: User r.r from 104.168.44.166 not allowed because not listed in AllowUsers Apr 28 19:19:22 UTC__SANYALnet-Labs__cac12 sshd[9913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.166 user=r.r Apr 28 19:19:24 UTC__SANYALnet-Labs__cac12 sshd[9913]: Failed password for invali........ ------------------------------	2020-04-30 14:26:06
104.168.44.166	attackbotsspam	Lines containing failures of 104.168.44.166 Apr 28 19:19:17 UTC__SANYALnet-Labs__cac12 sshd[9912]: Connection from 104.168.44.166 port 49337 on 64.137.176.96 port 22 Apr 28 19:19:17 UTC__SANYALnet-Labs__cac12 sshd[9912]: Did not receive identification string from 104.168.44.166 port 49337 Apr 28 19:19:21 UTC__SANYALnet-Labs__cac12 sshd[9913]: Connection from 104.168.44.166 port 52003 on 64.137.176.96 port 22 Apr 28 19:19:22 UTC__SANYALnet-Labs__cac12 sshd[9913]: Address 104.168.44.166 maps to 104-168-44-166-host.colocrossing.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Apr 28 19:19:22 UTC__SANYALnet-Labs__cac12 sshd[9913]: User r.r from 104.168.44.166 not allowed because not listed in AllowUsers Apr 28 19:19:22 UTC__SANYALnet-Labs__cac12 sshd[9913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.168.44.166 user=r.r Apr 28 19:19:24 UTC__SANYALnet-Labs__cac12 sshd[9913]: Failed password for invali........ ------------------------------	2020-04-30 04:08:35

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.168.44.143
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60386
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;104.168.44.143.			IN	A

;; AUTHORITY SECTION:
.			563	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121000 1800 900 604800 86400

;; Query time: 120 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Dec 10 20:04:59 CST 2019
;; MSG SIZE  rcvd: 118

Host info

143.44.168.104.in-addr.arpa domain name pointer 104-168-44-143-host.colocrossing.com.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
143.44.168.104.in-addr.arpa	name = 104-168-44-143-host.colocrossing.com.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
147.139.135.52	attackbots	Dec 28 21:09:25 localhost sshd[33679]: Failed password for invalid user caryn from 147.139.135.52 port 47630 ssh2 Dec 28 21:29:10 localhost sshd[34818]: Failed password for invalid user phil from 147.139.135.52 port 52248 ssh2 Dec 28 21:32:16 localhost sshd[34985]: Failed password for root from 147.139.135.52 port 45732 ssh2	2019-12-29 05:22:00
34.215.122.24	attackbotsspam	12/28/2019-22:42:16.602076 34.215.122.24 Protocol: 6 SURICATA TLS invalid record/traffic	2019-12-29 05:43:43
178.122.68.56	attackspambots	178.122.68.56 - - [28/Dec/2019:09:25:29 -0500] "GET /?page=..%2f..%2f..%2f..%2fetc%2fpasswd&action=view& HTTP/1.1" 200 17542 "https://ccbrass.com/?page=..%2f..%2f..%2f..%2fetc%2fpasswd&action=view&" "Mozilla/5.0 (Windows NT 10.0; WOW64; Rv:50.0) Gecko/20100101 Firefox/50.0" ...	2019-12-29 05:26:42
123.110.137.28	attack	Dec 28 15:25:04 grey postfix/smtpd\[28948\]: NOQUEUE: reject: RCPT from unknown\[123.110.137.28\]: 554 5.7.1 Service unavailable\; Client host \[123.110.137.28\] blocked using dul.dnsbl.sorbs.net\; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml\?123.110.137.28\; from=\ to=\ proto=ESMTP helo=\<123-110-137-28.best.dynamic.tbcnet.net.tw\> ...	2019-12-29 05:38:58
45.134.179.57	attackspam	Dec 28 22:18:18 mc1 kernel: \[1726688.942202\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.134.179.57 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=6901 PROTO=TCP SPT=50391 DPT=9800 WINDOW=1024 RES=0x00 SYN URGP=0 Dec 28 22:19:12 mc1 kernel: \[1726743.512739\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.134.179.57 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=5723 PROTO=TCP SPT=50391 DPT=9502 WINDOW=1024 RES=0x00 SYN URGP=0 Dec 28 22:25:47 mc1 kernel: \[1727137.701119\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.134.179.57 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=1346 PROTO=TCP SPT=50391 DPT=8600 WINDOW=1024 RES=0x00 SYN URGP=0 ...	2019-12-29 05:32:52
92.222.89.7	attackspambots	2019-12-28T14:19:12.879293abusebot-2.cloudsearch.cf sshd[12860]: Invalid user orders from 92.222.89.7 port 59784 2019-12-28T14:19:12.888502abusebot-2.cloudsearch.cf sshd[12860]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=7.ip-92-222-89.eu 2019-12-28T14:19:12.879293abusebot-2.cloudsearch.cf sshd[12860]: Invalid user orders from 92.222.89.7 port 59784 2019-12-28T14:19:15.532668abusebot-2.cloudsearch.cf sshd[12860]: Failed password for invalid user orders from 92.222.89.7 port 59784 ssh2 2019-12-28T14:22:49.656571abusebot-2.cloudsearch.cf sshd[12910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=7.ip-92-222-89.eu user=root 2019-12-28T14:22:52.091069abusebot-2.cloudsearch.cf sshd[12910]: Failed password for root from 92.222.89.7 port 35058 ssh2 2019-12-28T14:25:27.224412abusebot-2.cloudsearch.cf sshd[12915]: Invalid user lisa from 92.222.89.7 port 33030 ...	2019-12-29 05:28:16
180.244.28.235	attackbots	none	2019-12-29 05:58:04
184.105.247.219	attackspambots	3389BruteforceFW23	2019-12-29 05:50:11
103.203.39.156	attack	3389BruteforceFW23	2019-12-29 05:31:07
175.158.50.184	attackbots	Dec 28 23:37:58 www4 sshd\[459\]: Invalid user tayfun from 175.158.50.184 Dec 28 23:37:58 www4 sshd\[459\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.158.50.184 Dec 28 23:38:00 www4 sshd\[459\]: Failed password for invalid user tayfun from 175.158.50.184 port 26368 ssh2 ...	2019-12-29 05:40:57
45.227.254.30	attackbots	3389BruteforceFW22	2019-12-29 05:22:13
188.131.217.33	attack	$f2bV_matches	2019-12-29 05:38:38
85.93.20.66	attackbotsspam	20 attempts against mh_ha-misbehave-ban on lb.any-lamp.com	2019-12-29 05:33:41
103.76.22.118	attack	Dec 28 21:25:26 ArkNodeAT sshd\[5203\]: Invalid user teamspeak1 from 103.76.22.118 Dec 28 21:25:26 ArkNodeAT sshd\[5203\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.22.118 Dec 28 21:25:28 ArkNodeAT sshd\[5203\]: Failed password for invalid user teamspeak1 from 103.76.22.118 port 60760 ssh2	2019-12-29 05:59:29
203.195.178.83	attackbots	Automatic report - Banned IP Access	2019-12-29 05:49:22

Recently Reported IPs

196.75.142.50	36.71.234.198	113.176.166.45	114.104.227.172
138.91.120.70	119.18.38.2	111.90.150.90	93.126.11.249
114.252.37.85	112.175.114.111	96.84.240.89	92.222.83.168
175.24.131.84	201.187.103.18	45.224.28.70	202.173.121.187
192.99.15.15	139.5.147.78	117.78.32.133	111.72.194.98