City: unknown
Region: unknown
Country: United States
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.21.94.78
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 14299
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;104.21.94.78. IN A
;; AUTHORITY SECTION:
. 600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022021701 1800 900 604800 86400
;; Query time: 61 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Feb 18 03:19:10 CST 2022
;; MSG SIZE rcvd: 105Host 78.94.21.104.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 78.94.21.104.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 113.72.122.232 | attack | [Fri Sep 11 23:59:39.517777 2020] [:error] [pid 11178:tid 139761675114240] [client 113.72.122.232:53700] [client 113.72.122.232] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "X1us@0ECWTRI1HmEdolN4wAAAI8"]
... |
2020-09-12 12:19:53 |
| 203.95.220.39 | attackbots | 1599843574 - 09/11/2020 18:59:34 Host: 203.95.220.39/203.95.220.39 Port: 445 TCP Blocked |
2020-09-12 12:22:44 |
| 104.223.197.227 | attackbotsspam | Sep 11 23:39:01 sshgateway sshd\[2750\]: Invalid user yuly from 104.223.197.227 Sep 11 23:39:01 sshgateway sshd\[2750\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.223.197.227 Sep 11 23:39:03 sshgateway sshd\[2750\]: Failed password for invalid user yuly from 104.223.197.227 port 51856 ssh2 |
2020-09-12 07:45:35 |
| 193.228.91.123 | attackbotsspam | Auto Fail2Ban report, multiple SSH login attempts. |
2020-09-12 12:03:44 |
| 189.37.74.166 | attackbotsspam | 1599843589 - 09/11/2020 18:59:49 Host: 189.37.74.166/189.37.74.166 Port: 445 TCP Blocked |
2020-09-12 12:11:55 |
| 58.18.113.10 | attackbots | Sep 11 22:56:14 sshgateway sshd\[28458\]: Invalid user postgres from 58.18.113.10 Sep 11 22:56:14 sshgateway sshd\[28458\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.18.113.10 Sep 11 22:56:17 sshgateway sshd\[28458\]: Failed password for invalid user postgres from 58.18.113.10 port 51228 ssh2 |
2020-09-12 07:48:44 |
| 120.88.46.226 | attack | Sep 11 19:40:13 sshgateway sshd\[958\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120-88-46-226.snat21.hns.net.in user=root Sep 11 19:40:15 sshgateway sshd\[958\]: Failed password for root from 120.88.46.226 port 48806 ssh2 Sep 11 19:43:14 sshgateway sshd\[1298\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120-88-46-226.snat21.hns.net.in user=root |
2020-09-12 12:08:02 |
| 192.141.222.2 | attack | Icarus honeypot on github |
2020-09-12 12:22:59 |
| 122.144.212.144 | attackbotsspam | Sep 12 05:47:34 lnxmail61 sshd[18247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.144.212.144 Sep 12 05:47:36 lnxmail61 sshd[18247]: Failed password for invalid user user from 122.144.212.144 port 41020 ssh2 Sep 12 05:53:12 lnxmail61 sshd[18761]: Failed password for root from 122.144.212.144 port 39874 ssh2 |
2020-09-12 12:10:30 |
| 186.234.80.146 | attackspambots | HTTP DDOS |
2020-09-12 12:00:33 |
| 14.165.48.93 | attackspambots | 20/9/11@12:53:58: FAIL: Alarm-Network address from=14.165.48.93 ... |
2020-09-12 07:44:03 |
| 103.76.252.6 | attack | $f2bV_matches |
2020-09-12 12:08:19 |
| 202.83.44.255 | attackspambots | Telnet Honeypot -> Telnet Bruteforce / Login |
2020-09-12 12:21:19 |
| 167.114.185.237 | attackbotsspam | Time: Sat Sep 12 05:05:15 2020 +0200 IP: 167.114.185.237 (CA/Canada/237.ip-167-114-185.net) Failures: 5 (sshd) Interval: 3600 seconds Blocked: Permanent Block [LF_SSHD] Log entries: Sep 12 04:51:16 mail-01 sshd[19079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.185.237 user=root Sep 12 04:51:18 mail-01 sshd[19079]: Failed password for root from 167.114.185.237 port 57844 ssh2 Sep 12 05:01:25 mail-01 sshd[24690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.185.237 user=root Sep 12 05:01:27 mail-01 sshd[24690]: Failed password for root from 167.114.185.237 port 51810 ssh2 Sep 12 05:05:10 mail-01 sshd[24985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.185.237 user=root |
2020-09-12 12:04:11 |
| 123.207.121.114 | attackbotsspam | (sshd) Failed SSH login from 123.207.121.114 (CN/China/Guangdong/Shenzhen/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 12 00:12:20 atlas sshd[9599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.121.114 user=root Sep 12 00:12:22 atlas sshd[9599]: Failed password for root from 123.207.121.114 port 35998 ssh2 Sep 12 00:17:03 atlas sshd[10706]: Invalid user zeitlinzeitlin from 123.207.121.114 port 38288 Sep 12 00:17:05 atlas sshd[10706]: Failed password for invalid user zeitlinzeitlin from 123.207.121.114 port 38288 ssh2 Sep 12 00:21:36 atlas sshd[11665]: Invalid user index from 123.207.121.114 port 40574 |
2020-09-12 12:25:55 |