104.197.12.42 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: unknown

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
104.197.12.57	attack	(mod_security) mod_security (id:920350) triggered by 104.197.12.57 (US/-/57.12.197.104.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/08 04:21:24 [error] 84060#0: 137266 [client 104.197.12.57] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159686048493.022923"] [ref "o0,17v21,17"], client: 104.197.12.57, [redacted] request: "GET / HTTP/1.1" [redacted]	2020-08-08 16:42:42
104.197.125.150	attackspam	SSH/22 MH Probe, BF, Hack -	2019-12-26 02:25:36
104.197.124.40	attackbotsspam	RDPBruteVIL	2019-12-20 02:32:29
104.197.122.218	attackspambots	2019-08-11T00:11:03.146484hz01.yumiweb.com sshd\[11418\]: Invalid user warehouse from 104.197.122.218 port 50368 2019-08-11T00:16:26.731638hz01.yumiweb.com sshd\[11429\]: Invalid user warehouse from 104.197.122.218 port 54016 2019-08-11T00:21:47.372170hz01.yumiweb.com sshd\[11443\]: Invalid user web from 104.197.122.218 port 57664 ...	2019-08-11 13:49:38

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.197.12.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 38235
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;104.197.12.42.			IN	A

;; AUTHORITY SECTION:
.			515	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2022022500 1800 900 604800 86400

;; Query time: 13 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Feb 26 00:54:06 CST 2022
;; MSG SIZE  rcvd: 106

Host info

42.12.197.104.in-addr.arpa domain name pointer 42.12.197.104.bc.googleusercontent.com.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
42.12.197.104.in-addr.arpa	name = 42.12.197.104.bc.googleusercontent.com.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
64.71.32.85	attack	64.71.32.85 - - [11/Oct/2020:05:44:25 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" 64.71.32.85 - - [11/Oct/2020:05:48:30 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" 64.71.32.85 - - [11/Oct/2020:05:48:30 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" ...	2020-10-11 13:38:33
192.173.14.138	attackbotsspam	Brute forcing email accounts	2020-10-11 13:29:58
41.33.126.139	attackbotsspam	Port Scan: TCP/443	2020-10-11 13:40:02
195.54.160.180	attackbotsspam	Oct 11 06:35:54 ajax sshd[22680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 11 06:35:56 ajax sshd[22680]: Failed password for invalid user system from 195.54.160.180 port 14992 ssh2	2020-10-11 13:39:13
106.12.215.238	attack	Oct 11 04:46:16 staging sshd[296353]: Invalid user prueba1 from 106.12.215.238 port 34512 Oct 11 04:46:16 staging sshd[296353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.215.238 Oct 11 04:46:16 staging sshd[296353]: Invalid user prueba1 from 106.12.215.238 port 34512 Oct 11 04:46:18 staging sshd[296353]: Failed password for invalid user prueba1 from 106.12.215.238 port 34512 ssh2 ...	2020-10-11 13:30:25
111.229.43.185	attackspam	Oct 11 02:00:38 cho sshd[400371]: Failed password for invalid user user2 from 111.229.43.185 port 47446 ssh2 Oct 11 02:04:48 cho sshd[400533]: Invalid user admin from 111.229.43.185 port 36802 Oct 11 02:04:48 cho sshd[400533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.43.185 Oct 11 02:04:48 cho sshd[400533]: Invalid user admin from 111.229.43.185 port 36802 Oct 11 02:04:50 cho sshd[400533]: Failed password for invalid user admin from 111.229.43.185 port 36802 ssh2 ...	2020-10-11 14:02:44
106.13.144.207	attackbotsspam	"fail2ban match"	2020-10-11 14:04:12
154.127.32.116	attackbotsspam	154.127.32.116 (BJ/Benin/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 11 01:46:32 server2 sshd[11944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=154.127.32.116 user=root Oct 11 01:46:34 server2 sshd[11944]: Failed password for root from 154.127.32.116 port 57854 ssh2 Oct 11 01:44:13 server2 sshd[10788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.241.244.92 user=root Oct 11 01:44:15 server2 sshd[10788]: Failed password for root from 121.241.244.92 port 41628 ssh2 Oct 11 01:47:41 server2 sshd[12513]: Failed password for root from 35.226.132.241 port 34668 ssh2 Oct 11 01:45:09 server2 sshd[10876]: Failed password for root from 15.207.188.39 port 33646 ssh2 IP Addresses Blocked:	2020-10-11 13:48:27
46.142.164.107	attackbots	TCP (SYN) 46.142.164.107:35736 -> port 22, len 44	2020-10-11 13:37:44
37.139.0.44	attack	SSH bruteforce	2020-10-11 13:36:31
77.83.175.161	attack	fake user registration/login attempts	2020-10-11 13:57:07
51.254.203.205	attack	IP blocked	2020-10-11 14:03:14
112.238.78.55	attackbots	port scan and connect, tcp 23 (telnet)	2020-10-11 13:51:32
49.88.112.70	attack	Oct 11 07:40:07 buvik sshd[27746]: Failed password for root from 49.88.112.70 port 44140 ssh2 Oct 11 07:40:10 buvik sshd[27746]: Failed password for root from 49.88.112.70 port 44140 ssh2 Oct 11 07:40:12 buvik sshd[27746]: Failed password for root from 49.88.112.70 port 44140 ssh2 ...	2020-10-11 13:44:40
190.210.231.34	attackspam	Oct 11 07:29:36 vm1 sshd[17561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.210.231.34 Oct 11 07:29:38 vm1 sshd[17561]: Failed password for invalid user test from 190.210.231.34 port 52147 ssh2 ...	2020-10-11 13:58:10

Recently Reported IPs

104.197.104.161	104.197.114.42	104.197.101.252	104.197.122.39
104.197.116.73	104.197.10.134	104.197.130.38	104.197.116.139
104.197.14.238	103.209.82.134	104.197.122.201	104.197.134.7
104.197.143.21	103.209.82.22	103.209.82.242	103.209.83.14
103.209.83.154	103.209.83.90	103.209.86.165	103.209.87.186