City: unknown
Region: unknown
Country: Virgin Islands (BRITISH)
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.254.97.138
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54022
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;104.254.97.138. IN A
;; AUTHORITY SECTION:
. 261 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022030501 1800 900 604800 86400
;; Query time: 26 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Mar 06 10:23:02 CST 2022
;; MSG SIZE rcvd: 107b'Host 138.97.254.104.in-addr.arpa not found: 2(SERVFAIL)
'server can't find 104.254.97.138.in-addr.arpa: SERVFAIL| IP | Type | Details | Datetime |
|---|---|---|---|
| 123.25.239.124 | attack | 1597031649 - 08/10/2020 05:54:09 Host: 123.25.239.124/123.25.239.124 Port: 445 TCP Blocked |
2020-08-10 14:35:07 |
| 60.212.191.66 | attackspambots | Lines containing failures of 60.212.191.66 Aug 9 18:07:39 penfold sshd[24810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.212.191.66 user=r.r Aug 9 18:07:40 penfold sshd[24810]: Failed password for r.r from 60.212.191.66 port 36025 ssh2 Aug 9 18:07:41 penfold sshd[24810]: Received disconnect from 60.212.191.66 port 36025:11: Bye Bye [preauth] Aug 9 18:07:41 penfold sshd[24810]: Disconnected from authenticating user r.r 60.212.191.66 port 36025 [preauth] Aug 9 18:13:49 penfold sshd[25318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.212.191.66 user=r.r Aug 9 18:13:51 penfold sshd[25318]: Failed password for r.r from 60.212.191.66 port 58568 ssh2 Aug 9 18:13:52 penfold sshd[25318]: Received disconnect from 60.212.191.66 port 58568:11: Bye Bye [preauth] Aug 9 18:13:52 penfold sshd[25318]: Disconnected from authenticating user r.r 60.212.191.66 port 58568 [preauth] Aug 9........ ------------------------------ |
2020-08-10 14:54:02 |
| 218.77.100.184 | attack | (eximsyntax) Exim syntax errors from 218.77.100.184 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-10 08:24:02 SMTP call from [218.77.100.184] dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f? ?") |
2020-08-10 14:31:50 |
| 40.118.203.172 | attackspambots | (mod_security) mod_security (id:930130) triggered by 40.118.203.172 (US/-/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/10 04:30:59 [error] 483729#0: *77591 [client 40.118.203.172] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `PmFromFile' with parameter `restricted-files.data' against variable `REQUEST_FILENAME' (Value: `/.env' ) [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "105"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [redacted] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [redacted] [uri "/.env"] [unique_id "159703385947.899545"] [ref "o0,5v4,5t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase"], client: 40.118.203.172, [redacted] request: "GET /.env HTTP/1.1" [redacted] |
2020-08-10 15:05:57 |
| 52.177.165.30 | attack | Tried to connect to TCP Port on PC |
2020-08-10 14:47:08 |
| 222.252.34.170 | attackbots | IP 222.252.34.170 attacked honeypot on port: 1433 at 8/9/2020 8:53:08 PM |
2020-08-10 14:45:05 |
| 218.92.0.215 | attackbotsspam | Aug 10 02:48:38 plusreed sshd[22327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.215 user=root Aug 10 02:48:40 plusreed sshd[22327]: Failed password for root from 218.92.0.215 port 13021 ssh2 ... |
2020-08-10 14:50:58 |
| 111.0.123.73 | attack | Aug 10 06:45:24 terminus sshd[9429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.0.123.73 user=r.r Aug 10 06:45:27 terminus sshd[9429]: Failed password for r.r from 111.0.123.73 port 41640 ssh2 Aug 10 06:49:04 terminus sshd[9464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.0.123.73 user=r.r Aug 10 06:49:05 terminus sshd[9464]: Failed password for r.r from 111.0.123.73 port 34288 ssh2 Aug 10 06:52:34 terminus sshd[9498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.0.123.73 user=r.r Aug 10 06:52:35 terminus sshd[9498]: Failed password for r.r from 111.0.123.73 port 55158 ssh2 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=111.0.123.73 |
2020-08-10 14:30:16 |
| 161.35.6.20 | attack | Port scan on 3 port(s): 3153 3158 30540 |
2020-08-10 14:27:18 |
| 165.22.94.219 | attackbots | 165.22.94.219 - - [10/Aug/2020:04:54:09 +0100] "POST /wp-login.php HTTP/1.1" 200 1791 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 165.22.94.219 - - [10/Aug/2020:04:54:10 +0100] "POST /wp-login.php HTTP/1.1" 200 1772 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 165.22.94.219 - - [10/Aug/2020:04:54:15 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ... |
2020-08-10 14:29:44 |
| 118.24.70.248 | attackspambots | Banned for a week because repeated abuses, for example SSH, but not only |
2020-08-10 14:51:50 |
| 218.92.0.246 | attackbots | Aug 10 08:35:47 nextcloud sshd\[6093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.246 user=root Aug 10 08:35:49 nextcloud sshd\[6093\]: Failed password for root from 218.92.0.246 port 59964 ssh2 Aug 10 08:36:03 nextcloud sshd\[6093\]: Failed password for root from 218.92.0.246 port 59964 ssh2 |
2020-08-10 14:43:45 |
| 177.54.250.146 | attack | (smtpauth) Failed SMTP AUTH login from 177.54.250.146 (BR/Brazil/146.reverso.250.54.177): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-10 08:24:00 plain authenticator failed for ([177.54.250.146]) [177.54.250.146]: 535 Incorrect authentication data (set_id=info) |
2020-08-10 14:40:55 |
| 122.140.102.56 | attack | Unauthorised access (Aug 10) SRC=122.140.102.56 LEN=40 TTL=46 ID=34353 TCP DPT=8080 WINDOW=12637 SYN Unauthorised access (Aug 9) SRC=122.140.102.56 LEN=40 TTL=46 ID=39607 TCP DPT=8080 WINDOW=50357 SYN |
2020-08-10 14:53:32 |
| 223.171.46.146 | attack | $f2bV_matches |
2020-08-10 14:55:46 |