104.26.12.48 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: unknown

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
104.26.12.141	attack	From: "Amazon.com" Amazon account phishing/fraud - MALICIOUS REDIRECT UBE aimanbauk ([40.87.105.33]) Microsoft Spam link parg.co = 178.238.224.248 Contabo GmbH – BLACKLISTED MALICIOUS REDIRECT: - sum.vn = 104.26.12.141, 104.26.13.141, 172.67.73.189 Cloudflare – blacklisted see https://www.phishtank.com/phish_detail.php?phish_id=6360304 - amazon.verification.kozow.com = 94.249.167.244 GHOSTnet GmbH – blacklisted see https://transparencyreport.google.com/safe-browsing/search?url=http%3A%2F%2Famazon.verification.kozow.com%2F%3F16shop SPF fxamplwo395845.com = aspmx.l.google.com 108.177.15.26, 108.177.15.27 Google	2020-07-30 03:35:15

Type

Details

Datetime

104.26.12.141

attack

From: "Amazon.com" 
Amazon account phishing/fraud - MALICIOUS REDIRECT

UBE aimanbauk ([40.87.105.33]) Microsoft

Spam link parg.co = 178.238.224.248 Contabo GmbH – BLACKLISTED MALICIOUS REDIRECT:
-	sum.vn = 104.26.12.141, 104.26.13.141, 172.67.73.189 Cloudflare – blacklisted see https://www.phishtank.com/phish_detail.php?phish_id=6360304
-	amazon.verification.kozow.com = 94.249.167.244 GHOSTnet GmbH – blacklisted see https://transparencyreport.google.com/safe-browsing/search?url=http%3A%2F%2Famazon.verification.kozow.com%2F%3F16shop

SPF fxamplwo395845.com = aspmx.l.google.com 108.177.15.26, 108.177.15.27 Google

2020-07-30 03:35:15

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.26.12.48
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 35796
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;104.26.12.48.			IN	A

;; AUTHORITY SECTION:
.			542	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2022021701 1800 900 604800 86400

;; Query time: 67 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Feb 18 04:03:19 CST 2022
;; MSG SIZE  rcvd: 105

Host info

Host 48.12.26.104.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 48.12.26.104.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
211.140.118.18	attackbotsspam	Oct 2 06:34:43 ncomp sshd[21309]: Invalid user new from 211.140.118.18 port 26694 Oct 2 06:34:43 ncomp sshd[21309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.140.118.18 Oct 2 06:34:43 ncomp sshd[21309]: Invalid user new from 211.140.118.18 port 26694 Oct 2 06:34:45 ncomp sshd[21309]: Failed password for invalid user new from 211.140.118.18 port 26694 ssh2	2020-10-02 15:12:40
159.65.51.91	attackbotsspam	159.65.51.91 - - \[02/Oct/2020:07:11:19 +0200\] "POST /wp-login.php HTTP/1.0" 200 9641 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 159.65.51.91 - - \[02/Oct/2020:07:11:20 +0200\] "POST /wp-login.php HTTP/1.0" 200 9456 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 159.65.51.91 - - \[02/Oct/2020:07:11:26 +0200\] "POST /wp-login.php HTTP/1.0" 200 9453 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"	2020-10-02 14:59:07
167.71.96.148	attack	Port scan denied	2020-10-02 14:57:25
87.173.195.172	attack	Total attacks: 4	2020-10-02 14:46:01
185.202.2.181	attack	RDP Brute-Force	2020-10-02 14:42:30
176.212.108.99	attackspambots	Icarus honeypot on github	2020-10-02 14:42:56
124.156.210.134	attackspam	Port scan denied	2020-10-02 15:09:52
45.237.140.120	attackbots	bruteforce detected	2020-10-02 15:06:56
176.113.115.143	attackspambots	TCP (SYN) 176.113.115.143:47811 -> port 3414, len 44	2020-10-02 15:18:01
51.254.156.114	attack	fail2ban: brute force SSH detected	2020-10-02 15:16:55
103.131.71.132	attackbotsspam	(mod_security) mod_security (id:210730) triggered by 103.131.71.132 (VN/Vietnam/bot-103-131-71-132.coccoc.com): 5 in the last 3600 secs	2020-10-02 14:55:28
185.242.85.136	attack	Phishing Attack	2020-10-02 15:14:22
117.4.250.205	attackspambots	445/tcp 445/tcp 445/tcp [2020-09-15/10-01]3pkt	2020-10-02 15:21:05
181.44.157.165	attackbotsspam	SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: cpe-181-44-157-165.telecentro-reversos.com.ar.	2020-10-02 15:14:38
192.241.239.15	attack	27017/tcp 161/udp 512/tcp... [2020-08-21/10-01]14pkt,13pt.(tcp),1pt.(udp)	2020-10-02 15:11:49

Recently Reported IPs

104.26.12.46	104.26.12.5	104.26.12.47	104.26.12.52
104.26.12.50	104.26.12.53	104.26.12.58	104.26.12.59
104.26.12.51	104.26.12.55	104.26.12.57	104.26.12.54
104.26.12.61	104.26.12.60	104.26.12.6	104.26.12.62
104.26.12.65	104.26.12.63	104.26.12.64	104.26.12.67