104.238.99.66 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: unknown

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
104.238.99.130	attack	10 attempts against mh-misc-ban on leaf	2020-02-11 03:59:18
104.238.99.51	attackbotsspam	[munged]::443 104.238.99.51 - - [22/Dec/2019:07:31:18 +0100] "POST /[munged]: HTTP/1.1" 200 9445 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-12-22 14:52:07
104.238.99.51	attackbotsspam	104.238.99.51 - - \[25/Nov/2019:05:58:26 +0100\] "POST /wp-login.php HTTP/1.0" 200 2406 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - \[25/Nov/2019:05:58:28 +0100\] "POST /wp-login.php HTTP/1.0" 200 2364 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - \[25/Nov/2019:05:58:31 +0100\] "POST /wp-login.php HTTP/1.0" 200 2374 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"	2019-11-25 13:53:17
104.238.99.51	attackbotsspam	104.238.99.51 - - [17/Nov/2019:15:43:52 +0100] "GET /wp-login.php HTTP/1.1" 200 1896 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - [17/Nov/2019:15:43:53 +0100] "POST /wp-login.php HTTP/1.1" 200 2294 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - [17/Nov/2019:15:43:54 +0100] "GET /wp-login.php HTTP/1.1" 200 1896 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - [17/Nov/2019:15:43:55 +0100] "POST /wp-login.php HTTP/1.1" 200 2268 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - [17/Nov/2019:15:44:01 +0100] "GET /wp-login.php HTTP/1.1" 200 1896 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.238.99.51 - - [17/Nov/2019:15:44:02 +0100] "POST /wp-login.php HTTP/1.1" 200 2269 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-11-18 00:41:49
104.238.99.130	attackbots	Automatic report - Banned IP Access	2019-11-17 04:13:19
104.238.99.51	attackbots	WordPress login Brute force / Web App Attack on client site.	2019-11-12 01:10:06
104.238.99.130	attackspambots	(imapd) Failed IMAP login from 104.238.99.130 (US/United States/ip-104-238-99-130.ip.secureserver.net): 1 in the last 3600 secs	2019-10-22 19:22:45
104.238.99.130	attack	WordPress brute force	2019-10-20 06:22:53
104.238.99.51	attack	WordPress login Brute force / Web App Attack on client site.	2019-10-19 15:49:46
104.238.99.51	attackspam	Wordpress Admin Login attack	2019-10-15 15:54:33
104.238.99.51	attackbotsspam	MYH,DEF GET /wp-login.php	2019-10-10 07:45:55

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.238.99.66
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9444
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;104.238.99.66.			IN	A

;; AUTHORITY SECTION:
.			600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2022021701 1800 900 604800 86400

;; Query time: 27 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Feb 18 03:49:06 CST 2022
;; MSG SIZE  rcvd: 106

Host info

66.99.238.104.in-addr.arpa domain name pointer ip-104-238-99-66.ip.secureserver.net.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
66.99.238.104.in-addr.arpa	name = ip-104-238-99-66.ip.secureserver.net.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
121.229.26.104	attack	Aug 20 15:07:42 sip sshd[1368921]: Invalid user ftpuser from 121.229.26.104 port 37044 Aug 20 15:07:44 sip sshd[1368921]: Failed password for invalid user ftpuser from 121.229.26.104 port 37044 ssh2 Aug 20 15:14:12 sip sshd[1368967]: Invalid user user03 from 121.229.26.104 port 39742 ...	2020-08-21 01:52:52
110.49.40.5	attackbotsspam	Unauthorized connection attempt from IP address 110.49.40.5 on Port 445(SMB)	2020-08-21 01:34:31
123.57.181.90	attackbotsspam	2020-08-20 14:02:35,948 fail2ban.actions: WARNING [ssh] Ban 123.57.181.90	2020-08-21 01:37:30
189.27.175.83	attack	Unauthorized connection attempt from IP address 189.27.175.83 on Port 445(SMB)	2020-08-21 02:00:16
114.247.91.140	attack	Automatic report BANNED IP	2020-08-21 01:42:34
139.199.18.200	attackbots	Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)	2020-08-21 01:44:20
61.94.63.110	attack	Automatic report - Port Scan Attack	2020-08-21 01:48:44
139.99.192.189	attackbotsspam	[2020-08-20 13:04:00] NOTICE[1185] chan_sip.c: Registration from '"433"' failed for '139.99.192.189:24345' - Wrong password [2020-08-20 13:04:00] SECURITY[1203] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-20T13:04:00.923-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="433",SessionID="0x7f10c4242e18",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/139.99.192.189/24345",Challenge="30913389",ReceivedChallenge="30913389",ReceivedHash="9fb9071820225e43def5d486887d2635" [2020-08-20 13:12:33] NOTICE[1185] chan_sip.c: Registration from '"435"' failed for '139.99.192.189:44577' - Wrong password [2020-08-20 13:12:33] SECURITY[1203] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-20T13:12:33.025-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="435",SessionID="0x7f10c41b0fe8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/139. ...	2020-08-21 01:46:29
190.192.40.18	attackspambots	Aug 20 16:50:48 rush sshd[30856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.192.40.18 Aug 20 16:50:50 rush sshd[30856]: Failed password for invalid user user from 190.192.40.18 port 57444 ssh2 Aug 20 16:53:27 rush sshd[30972]: Failed password for root from 190.192.40.18 port 59268 ssh2 ...	2020-08-21 01:35:16
81.12.4.4	attackspam	Unauthorized connection attempt from IP address 81.12.4.4 on Port 445(SMB)	2020-08-21 02:06:11
69.254.62.212	attackbots	2020-08-20T15:52:48.340984ks3355764 sshd[13467]: Invalid user ts3server from 69.254.62.212 port 3489 2020-08-20T15:52:49.995116ks3355764 sshd[13467]: Failed password for invalid user ts3server from 69.254.62.212 port 3489 ssh2 ...	2020-08-21 01:40:17
140.143.128.66	attack	2020-08-20T12:10:18.884841vps-d63064a2 sshd[3917]: Invalid user mwb from 140.143.128.66 port 44882 2020-08-20T12:10:20.913221vps-d63064a2 sshd[3917]: Failed password for invalid user mwb from 140.143.128.66 port 44882 ssh2 2020-08-20T12:16:21.342738vps-d63064a2 sshd[3953]: User root from 140.143.128.66 not allowed because not listed in AllowUsers 2020-08-20T12:16:21.358608vps-d63064a2 sshd[3953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=140.143.128.66 user=root 2020-08-20T12:16:21.342738vps-d63064a2 sshd[3953]: User root from 140.143.128.66 not allowed because not listed in AllowUsers 2020-08-20T12:16:23.544764vps-d63064a2 sshd[3953]: Failed password for invalid user root from 140.143.128.66 port 48018 ssh2 ...	2020-08-21 01:37:15
128.199.241.52	attackspam	Lines containing failures of 128.199.241.52 Aug 20 14:08:57 new sshd[14474]: Invalid user habib from 128.199.241.52 port 47172 Aug 20 14:08:57 new sshd[14474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.241.52 Aug 20 14:08:59 new sshd[14474]: Failed password for invalid user habib from 128.199.241.52 port 47172 ssh2 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=128.199.241.52	2020-08-21 01:44:49
186.103.184.227	attack	Aug 20 19:28:47 jane sshd[27447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.103.184.227 Aug 20 19:28:49 jane sshd[27447]: Failed password for invalid user git from 186.103.184.227 port 55394 ssh2 ...	2020-08-21 02:11:50
31.46.247.94	attack	31.46.247.94 - - [20/Aug/2020:12:59:44 +0100] "POST /wp-login.php HTTP/1.1" 503 18281 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" 31.46.247.94 - - [20/Aug/2020:13:02:16 +0100] "POST /xmlrpc.php HTTP/1.1" 503 18281 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" 31.46.247.94 - - [20/Aug/2020:13:02:16 +0100] "POST /wp-login.php HTTP/1.1" 503 18281 "-" "Mozilla/5.0 (X11; Linux i686; rv:2.0.1) Gecko/20100101 Firefox/4.0.1" ...	2020-08-21 01:58:12

Recently Reported IPs

104.238.98.112	104.239.135.142	104.239.140.204	104.239.136.174
104.239.138.29	104.239.144.221	104.239.144.36	104.239.144.143
104.239.144.80	104.239.144.237	104.239.150.20	104.239.142.149
104.239.154.250	104.239.155.219	104.239.147.8	104.239.155.63
104.239.157.42	104.239.156.110	104.239.163.59	104.239.163.28