104.248.165.249

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: unknown

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
104.248.165.138	attackspam	Lines containing failures of 104.248.165.138 (max 1000) Oct 7 10:36:19 archiv sshd[24269]: Did not receive identification string from 104.248.165.138 port 44542 Oct 7 10:36:45 archiv sshd[24272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.165.138 user=r.r Oct 7 10:36:47 archiv sshd[24272]: Failed password for r.r from 104.248.165.138 port 47326 ssh2 Oct 7 10:36:47 archiv sshd[24272]: Received disconnect from 104.248.165.138 port 47326:11: Normal Shutdown, Thank you for playing [preauth] Oct 7 10:36:47 archiv sshd[24272]: Disconnected from 104.248.165.138 port 47326 [preauth] Oct 7 10:37:12 archiv sshd[24275]: Invalid user oracle from 104.248.165.138 port 51628 Oct 7 10:37:12 archiv sshd[24275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.165.138 Oct 7 10:37:14 archiv sshd[24275]: Failed password for invalid user oracle from 104.248.165.138 port 51628 ssh2 Oct........ ------------------------------	2020-10-09 01:29:59
104.248.165.138	attackbots	2020-10-08T04:38:00.787232devel sshd[11462]: Failed password for root from 104.248.165.138 port 59648 ssh2 2020-10-08T04:38:24.234947devel sshd[11531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.165.138 user=root 2020-10-08T04:38:25.835949devel sshd[11531]: Failed password for root from 104.248.165.138 port 60070 ssh2	2020-10-08 17:26:13
104.248.165.195	attack	104.248.165.195 - - [07/Aug/2020:04:52:59 +0100] "POST /wp-login.php HTTP/1.1" 200 2345 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.248.165.195 - - [07/Aug/2020:04:53:05 +0100] "POST /wp-login.php HTTP/1.1" 200 2329 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.248.165.195 - - [07/Aug/2020:04:53:06 +0100] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-07 16:22:21
104.248.165.195	attack	104.248.165.195 - - [03/Aug/2020:20:51:48 +0100] "POST /wp-login.php HTTP/1.1" 200 1996 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.248.165.195 - - [03/Aug/2020:20:51:59 +0100] "POST /wp-login.php HTTP/1.1" 200 1929 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.248.165.195 - - [03/Aug/2020:20:51:59 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-08-04 04:09:04
104.248.165.195	attack	Automatic report - Banned IP Access	2020-07-11 16:42:38
104.248.165.195	attack	Automatic report - XMLRPC Attack	2020-06-23 15:16:36
104.248.165.195	attack	104.248.165.195 - - [08/Jun/2020:16:38:06 +0200] "GET /wp-login.php HTTP/1.1" 200 5861 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.248.165.195 - - [08/Jun/2020:16:38:08 +0200] "POST /wp-login.php HTTP/1.1" 200 6112 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 104.248.165.195 - - [08/Jun/2020:16:38:14 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-06-09 01:49:32

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.248.165.249
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 37917
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;104.248.165.249.		IN	A

;; AUTHORITY SECTION:
.			431	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2022022500 1800 900 604800 86400

;; Query time: 103 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Feb 25 20:24:46 CST 2022
;; MSG SIZE  rcvd: 108

Host info

249.165.248.104.in-addr.arpa domain name pointer ortiz.nyzo.co.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
249.165.248.104.in-addr.arpa	name = ortiz.nyzo.co.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
51.255.168.127	attackspambots	Nov 1 13:02:02 srv01 sshd[30819]: Invalid user vrbetic from 51.255.168.127 Nov 1 13:02:02 srv01 sshd[30819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.ip-51-255-168.eu Nov 1 13:02:02 srv01 sshd[30819]: Invalid user vrbetic from 51.255.168.127 Nov 1 13:02:03 srv01 sshd[30819]: Failed password for invalid user vrbetic from 51.255.168.127 port 54584 ssh2 Nov 1 13:05:56 srv01 sshd[31033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.ip-51-255-168.eu user=root Nov 1 13:05:59 srv01 sshd[31033]: Failed password for root from 51.255.168.127 port 37286 ssh2 ...	2019-11-01 23:31:12
182.184.112.215	attackspambots	Automatic report - Banned IP Access	2019-11-01 23:32:41
179.232.1.252	attackbotsspam	2019-11-01T14:45:44.775921abusebot-4.cloudsearch.cf sshd\[9842\]: Invalid user c1b62d5 from 179.232.1.252 port 56464	2019-11-01 23:12:54
150.109.52.25	attackbots	Nov 1 12:45:32 ns381471 sshd[18752]: Failed password for root from 150.109.52.25 port 38632 ssh2	2019-11-01 23:46:18
132.232.59.136	attack	Nov 1 11:50:31 anodpoucpklekan sshd[88435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.232.59.136 user=root Nov 1 11:50:33 anodpoucpklekan sshd[88435]: Failed password for root from 132.232.59.136 port 33900 ssh2 ...	2019-11-01 23:23:23
185.79.68.130	attackbotsspam	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-01 23:11:12
185.254.120.12	attackspambots	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-01 23:22:54
82.214.118.6	attackbots	82.214.118.6 - - \[01/Nov/2019:13:02:33 +0000\] "POST /wp-login.php HTTP/1.1" 200 4358 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 82.214.118.6 - - \[01/Nov/2019:13:02:34 +0000\] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" ...	2019-11-01 23:24:06
50.197.162.169	attack	2019-11-01 H=50-197-162-169-static.hfc.comcastbusiness.net \[50.197.162.169\] F=\ rejected RCPT \: Mail not accepted. 50.197.162.169 is listed at a DNSBL. 2019-11-01 H=50-197-162-169-static.hfc.comcastbusiness.net \[50.197.162.169\] F=\ rejected RCPT \: Mail not accepted. 50.197.162.169 is listed at a DNSBL. 2019-11-01 H=50-197-162-169-static.hfc.comcastbusiness.net \[50.197.162.169\] F=\ rejected RCPT \<REMOVED@REMOVED.de\>: Mail not accepted. 50.197.162.169 is listed at a DNSBL.	2019-11-01 23:33:36
125.214.49.105	attackbotsspam	Automatic report - CMS Brute-Force Attack	2019-11-01 23:41:30
186.66.88.2	attackbots	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-01 23:04:24
5.39.82.197	attack	Nov 1 21:03:03 webhost01 sshd[13517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.39.82.197 Nov 1 21:03:06 webhost01 sshd[13517]: Failed password for invalid user Rapido123 from 5.39.82.197 port 39224 ssh2 ...	2019-11-01 23:22:10
41.210.128.37	attackspam	5x Failed Password	2019-11-01 22:59:44
217.7.239.117	attack	Triggered by Fail2Ban at Vostok web server	2019-11-01 23:35:02
66.240.236.119	attackspambots	port scan and connect, tcp 465 (smtps)	2019-11-01 23:25:15

Recently Reported IPs

101.109.63.138	104.248.166.129	104.248.166.156	104.248.166.184
104.248.166.226	104.248.166.232	104.248.166.234	104.248.166.131
104.248.166.240	101.109.63.140	104.248.166.13	104.248.166.247
101.109.63.147	101.109.63.148	101.109.63.165	101.109.63.166
76.232.12.213	101.109.63.17	101.109.63.172	101.109.63.176