104.206.128.42

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: AAA Enterprises

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	TCP (SYN) 104.206.128.42:50739 -> port 23, len 44	2020-10-06 02:55:43
attackbots	Icarus honeypot on github	2020-10-05 18:46:02
attackbotsspam	Found on CINS badguys / proto=6 . srcport=60186 . dstport=21 . (3194)	2020-09-28 04:59:00
attackspam	5900/tcp 23/tcp 5060/tcp... [2020-07-29/09-26]40pkt,8pt.(tcp),1pt.(udp)	2020-09-27 21:17:02
attackbots	5900/tcp 23/tcp 5060/tcp... [2020-07-29/09-26]40pkt,8pt.(tcp),1pt.(udp)	2020-09-27 12:58:06
attackbots	TCP (SYN) 104.206.128.42:60566 -> port 5060, len 44	2020-09-21 03:33:43
attackspambots	Found on CINS badguys / proto=17 . srcport=51289 . dstport=161 . (3700)	2020-09-20 19:42:00
attackspam	2020-09-03 18:59:53 Reject access to port(s):3389 1 times a day	2020-09-04 23:43:50
attack	2020-09-03 18:59:53 Reject access to port(s):3389 1 times a day	2020-09-04 15:14:43
attackbotsspam	ET CINS Active Threat Intelligence Poor Reputation IP group 91 - port: 5060 proto: tcp cat: Misc Attackbytes: 60	2020-09-04 07:37:53
attackspambots	21/tcp 3306/tcp 161/udp... [2020-05-05/07-05]51pkt,11pt.(tcp),1pt.(udp)	2020-07-06 02:17:41
attackspam	1590514879 - 05/26/2020 19:41:19 Host: 104.206.128.42/104.206.128.42 Port: 21 TCP Blocked	2020-05-27 05:52:57
attack	Unauthorized connection attempt detected from IP address 104.206.128.42 to port 3389	2020-05-05 15:59:03
attackspambots	ET CINS Active Threat Intelligence Poor Reputation IP group 99 - port: 3389 proto: TCP cat: Misc Attack	2020-05-03 06:40:08
attack	Unauthorized connection attempt detected from IP address 104.206.128.42 to port 1433	2020-05-02 00:38:35
attack	Unauthorized connection attempt detected from IP address 104.206.128.42 to port 3389	2020-04-24 05:02:26
attackbotsspam	Telnet/23 MH Probe, Scan, BF, Hack -	2020-04-23 21:39:39
attackbots	Port Scan: Events[1] countPorts[1]: 161 ..	2020-04-18 06:38:41
attackbots	Unauthorized connection attempt detected from IP address 104.206.128.42 to port 102	2020-04-03 12:55:55
attackspam	ET SCAN Suspicious inbound to MSSQL port 1433 - port: 1433 proto: TCP cat: Potentially Bad Traffic	2019-12-11 06:13:56
attackspambots	104.206.128.42 was recorded 7 times by 6 hosts attempting to connect to the following ports: 5900,3306,5432,3389,5060. Incident counter (4h, 24h, all-time): 7, 12, 217	2019-12-10 04:38:41
attackspambots	104.206.128.42 was recorded 5 times by 5 hosts attempting to connect to the following ports: 5432,1433,5900,3306. Incident counter (4h, 24h, all-time): 5, 7, 73	2019-11-16 01:54:55
attack	SNMP/161 Probe, BF, Hack -	2019-08-19 19:15:58
attackspambots	Honeypot hit.	2019-08-10 09:48:14
attack	Honeypot attack, port: 23, PTR: 42-128.206.104.serverhubrdns.in-addr.arpa.	2019-08-06 13:40:35
attackspambots	Honeypot attack, port: 23, PTR: 42-128.206.104.serverhubrdns.in-addr.arpa.	2019-07-25 04:21:44
attack	17.07.2019 18:47:36 Connection to port 3389 blocked by firewall	2019-07-18 03:34:07
attackbotsspam	Automatic report - Port Scan Attack	2019-07-16 06:21:23
attackbots	proto=tcp . spt=57246 . dpt=3389 . src=104.206.128.42 . dst=xx.xx.4.1 . (listed on CINS badguys Jul 05) (26)	2019-07-06 09:53:36

Comments on same subnet:

IP	Type	Details	Datetime
104.206.128.6	attackspambots	Automatic report - Banned IP Access	2020-10-09 02:32:26
104.206.128.6	attackbots	bruteforce, ssh, scan port	2020-10-08 18:31:18
104.206.128.34	attackbots	TCP (SYN) 104.206.128.34:62942 -> port 3389, len 44	2020-10-06 04:52:48
104.206.128.74	attackspambots	UDP 104.206.128.74:57326 -> port 161, len 71	2020-10-06 04:12:44
104.206.128.2	attackspambots	TCP (SYN) 104.206.128.2:60162 -> port 1433, len 44	2020-10-06 04:10:28
104.206.128.66	attackbotsspam	TCP (SYN) 104.206.128.66:63773 -> port 3306, len 44	2020-10-06 00:59:51
104.206.128.34	attack	MultiHost/MultiPort Probe, Scan, Hack -	2020-10-05 20:55:21
104.206.128.74	attackspambots	TCP (SYN) 104.206.128.74:55896 -> port 3389, len 44	2020-10-05 20:11:31
104.206.128.2	attackspambots	MultiHost/MultiPort Probe, Scan, Hack -	2020-10-05 20:09:04
104.206.128.34	attackbotsspam	Found on Alienvault / proto=6 . srcport=64630 . dstport=5900 . (3726)	2020-10-05 12:44:44
104.206.128.74	attackbots	TCP (SYN) 104.206.128.74:55896 -> port 3389, len 44	2020-10-05 12:03:44
104.206.128.2	attackspambots	Found on Binary Defense / proto=6 . srcport=52605 . dstport=21 FTP . (3566)	2020-10-05 12:01:30
104.206.128.6	attackbots	Telnet/23 MH Probe, Scan, BF, Hack -	2020-10-03 04:43:15
104.206.128.6	attack	Telnet/23 MH Probe, Scan, BF, Hack -	2020-10-03 00:05:15
104.206.128.6	attackbotsspam	Telnet/23 MH Probe, Scan, BF, Hack -	2020-10-02 20:36:03

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.206.128.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7714
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;104.206.128.42.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019060700 1800 900 604800 86400

;; Query time: 3 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Fri Jun 07 21:08:57 CST 2019
;; MSG SIZE  rcvd: 118

Host info

42.128.206.104.in-addr.arpa domain name pointer 42-128.206.104.serverhubrdns.in-addr.arpa.

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
42.128.206.104.in-addr.arpa	name = 42-128.206.104.serverhubrdns.in-addr.arpa.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
116.96.224.151	attackspam	Unauthorized connection attempt from IP address 116.96.224.151 on Port 445(SMB)	2019-09-07 06:49:46
40.73.25.111	attack	Sep 6 18:23:40 plusreed sshd[6492]: Invalid user support from 40.73.25.111 ...	2019-09-07 06:25:37
173.45.164.2	attackspambots	Sep 6 18:23:46 ny01 sshd[24018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.45.164.2 Sep 6 18:23:48 ny01 sshd[24018]: Failed password for invalid user 12345 from 173.45.164.2 port 34484 ssh2 Sep 6 18:27:19 ny01 sshd[25048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.45.164.2	2019-09-07 06:41:19
218.92.0.132	attackspambots	2019-09-06T22:31:56.758211centos sshd\[17106\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.132 user=root 2019-09-06T22:31:58.935589centos sshd\[17106\]: Failed password for root from 218.92.0.132 port 5973 ssh2 2019-09-06T22:32:02.313534centos sshd\[17106\]: Failed password for root from 218.92.0.132 port 5973 ssh2	2019-09-07 06:05:37
157.245.103.193	attackspambots	[Aegis] @ 2019-09-06 22:10:30 0100 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack	2019-09-07 06:06:23
103.27.202.18	attack	Sep 6 12:45:50 vps200512 sshd\[1086\]: Invalid user dbuser from 103.27.202.18 Sep 6 12:45:50 vps200512 sshd\[1086\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.27.202.18 Sep 6 12:45:52 vps200512 sshd\[1086\]: Failed password for invalid user dbuser from 103.27.202.18 port 55018 ssh2 Sep 6 12:51:13 vps200512 sshd\[1158\]: Invalid user appltest from 103.27.202.18 Sep 6 12:51:13 vps200512 sshd\[1158\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.27.202.18	2019-09-07 06:21:53
119.252.174.195	attack	$f2bV_matches	2019-09-07 06:36:54
181.210.16.132	attackspam	Looking for /www.sql.tar.gz, Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0	2019-09-07 06:24:52
179.216.145.14	attack	Unauthorized connection attempt from IP address 179.216.145.14 on Port 445(SMB)	2019-09-07 06:04:57
123.194.10.79	attack	Unauthorized connection attempt from IP address 123.194.10.79 on Port 445(SMB)	2019-09-07 06:29:36
222.186.42.117	attack	Sep 7 00:43:52 ArkNodeAT sshd\[25417\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.117 user=root Sep 7 00:43:54 ArkNodeAT sshd\[25417\]: Failed password for root from 222.186.42.117 port 39106 ssh2 Sep 7 00:44:01 ArkNodeAT sshd\[25419\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.117 user=root	2019-09-07 06:44:42
195.46.177.110	attackbotsspam	Unauthorized connection attempt from IP address 195.46.177.110 on Port 445(SMB)	2019-09-07 06:42:30
222.73.85.199	attack	Scanning random ports - tries to find possible vulnerable services	2019-09-07 06:31:53
218.98.40.150	attackspambots	Sep 7 00:04:07 saschabauer sshd[11497]: Failed password for root from 218.98.40.150 port 40806 ssh2 Sep 7 00:04:09 saschabauer sshd[11497]: Failed password for root from 218.98.40.150 port 40806 ssh2	2019-09-07 06:50:18
41.210.128.37	attack	Sep 6 23:23:09 Ubuntu-1404-trusty-64-minimal sshd\[24593\]: Invalid user www from 41.210.128.37 Sep 6 23:23:09 Ubuntu-1404-trusty-64-minimal sshd\[24593\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.210.128.37 Sep 6 23:23:11 Ubuntu-1404-trusty-64-minimal sshd\[24593\]: Failed password for invalid user www from 41.210.128.37 port 41891 ssh2 Sep 6 23:35:17 Ubuntu-1404-trusty-64-minimal sshd\[2164\]: Invalid user guest from 41.210.128.37 Sep 6 23:35:17 Ubuntu-1404-trusty-64-minimal sshd\[2164\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.210.128.37	2019-09-07 06:10:03

Recently Reported IPs

85.97.201.227	201.254.86.50	2.59.118.252	249.150.24.0
78.22.47.219	115.28.88.86	61.215.252.109	148.234.193.130
100.241.2.60	187.245.175.161	47.18.114.96	64.151.50.87
1.77.46.231	205.185.114.87	220.209.235.81	207.190.68.191
193.82.42.211	193.213.89.72	227.244.211.225	168.43.159.133