106.12.54.25 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: Beijing Baidu Netcom Science and Technology Co. Ltd.

Hostname: unknown

Organization: unknown

Usage Type: Search Engine Spider

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	TCP (SYN) 106.12.54.25:52677 -> port 11579, len 44	2020-06-19 17:01:01
attack	$f2bV_matches	2020-06-17 08:43:11
attackspam	May 27 11:55:15 ws26vmsma01 sshd[105071]: Failed password for root from 106.12.54.25 port 46268 ssh2 ...	2020-05-27 20:39:19
attackspambots	(sshd) Failed SSH login from 106.12.54.25 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 7 02:25:54 srv sshd[28790]: Invalid user deploy from 106.12.54.25 port 32984 Apr 7 02:25:56 srv sshd[28790]: Failed password for invalid user deploy from 106.12.54.25 port 32984 ssh2 Apr 7 02:42:23 srv sshd[29205]: Invalid user admin from 106.12.54.25 port 54526 Apr 7 02:42:25 srv sshd[29205]: Failed password for invalid user admin from 106.12.54.25 port 54526 ssh2 Apr 7 02:46:41 srv sshd[29258]: Invalid user denny from 106.12.54.25 port 52236	2020-04-07 09:36:37

Comments on same subnet:

IP	Type	Details	Datetime
106.12.54.13	attackspam	SSH login attempts.	2020-07-08 14:29:54
106.12.54.13	attackspambots	Jul 4 21:38:23 vps1 sshd[2213182]: Failed password for root from 106.12.54.13 port 57904 ssh2 Jul 4 21:42:08 vps1 sshd[2213308]: Invalid user yiyi from 106.12.54.13 port 49916 ...	2020-07-05 06:26:39
106.12.54.183	attack	Jun 13 11:24:22 [host] sshd[1526]: pam_unix(sshd:a Jun 13 11:24:24 [host] sshd[1526]: Failed password Jun 13 11:28:09 [host] sshd[1776]: Invalid user an	2020-06-13 17:43:39
106.12.54.183	attackbotsspam	5x Failed Password	2020-06-05 19:24:25
106.12.54.183	attackspambots	May 22 01:09:43 firewall sshd[3464]: Invalid user xbh from 106.12.54.183 May 22 01:09:45 firewall sshd[3464]: Failed password for invalid user xbh from 106.12.54.183 port 42750 ssh2 May 22 01:14:03 firewall sshd[3637]: Invalid user gnf from 106.12.54.183 ...	2020-05-22 15:46:51
106.12.54.183	attackspam	2020-05-12T05:32:19.6961561495-001 sshd[12077]: Invalid user test from 106.12.54.183 port 34392 2020-05-12T05:32:19.6994211495-001 sshd[12077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.183 2020-05-12T05:32:19.6961561495-001 sshd[12077]: Invalid user test from 106.12.54.183 port 34392 2020-05-12T05:32:21.5604261495-001 sshd[12077]: Failed password for invalid user test from 106.12.54.183 port 34392 ssh2 2020-05-12T05:36:03.2941151495-001 sshd[12257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.183 user=root 2020-05-12T05:36:04.9089891495-001 sshd[12257]: Failed password for root from 106.12.54.183 port 54238 ssh2 ...	2020-05-12 18:56:13
106.12.54.183	attackspam	May 7 07:54:59 localhost sshd\[3269\]: Invalid user local from 106.12.54.183 May 7 07:54:59 localhost sshd\[3269\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.183 May 7 07:55:01 localhost sshd\[3269\]: Failed password for invalid user local from 106.12.54.183 port 59048 ssh2 May 7 07:56:54 localhost sshd\[3474\]: Invalid user kamimura from 106.12.54.183 May 7 07:56:54 localhost sshd\[3474\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.183 ...	2020-05-07 16:00:04
106.12.54.13	attackspambots	Apr 27 05:42:07 Ubuntu-1404-trusty-64-minimal sshd\[1830\]: Invalid user ef from 106.12.54.13 Apr 27 05:42:07 Ubuntu-1404-trusty-64-minimal sshd\[1830\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 Apr 27 05:42:10 Ubuntu-1404-trusty-64-minimal sshd\[1830\]: Failed password for invalid user ef from 106.12.54.13 port 45114 ssh2 Apr 27 05:59:26 Ubuntu-1404-trusty-64-minimal sshd\[9152\]: Invalid user admin from 106.12.54.13 Apr 27 05:59:26 Ubuntu-1404-trusty-64-minimal sshd\[9152\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13	2020-04-27 12:36:19
106.12.54.13	attack	Apr 24 12:50:19 srv01 sshd[1301]: Invalid user elena from 106.12.54.13 port 49192 Apr 24 12:50:19 srv01 sshd[1301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 Apr 24 12:50:19 srv01 sshd[1301]: Invalid user elena from 106.12.54.13 port 49192 Apr 24 12:50:20 srv01 sshd[1301]: Failed password for invalid user elena from 106.12.54.13 port 49192 ssh2 Apr 24 12:53:46 srv01 sshd[1524]: Invalid user accampo from 106.12.54.13 port 40450 ...	2020-04-24 19:08:08
106.12.54.13	attackbotsspam	Invalid user angel from 106.12.54.13 port 41948	2020-04-18 14:17:30
106.12.54.13	attackbotsspam	Apr 7 18:30:48 f sshd\[3557\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 user=root Apr 7 18:30:50 f sshd\[3557\]: Failed password for root from 106.12.54.13 port 56428 ssh2 Apr 7 18:41:27 f sshd\[3800\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 ...	2020-04-07 20:40:45
106.12.54.13	attack	$f2bV_matches	2020-04-05 21:31:32
106.12.54.13	attack	Mar 24 19:27:51 jane sshd[28574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 Mar 24 19:27:53 jane sshd[28574]: Failed password for invalid user jf from 106.12.54.13 port 55468 ssh2 ...	2020-03-25 06:31:32
106.12.54.13	attackspam	Mar 19 09:37:20 server sshd\[30573\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 user=root Mar 19 09:37:21 server sshd\[30573\]: Failed password for root from 106.12.54.13 port 59094 ssh2 Mar 19 09:46:55 server sshd\[418\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 user=root Mar 19 09:46:58 server sshd\[418\]: Failed password for root from 106.12.54.13 port 39786 ssh2 Mar 19 09:51:01 server sshd\[1452\]: Invalid user suporte from 106.12.54.13 Mar 19 09:51:01 server sshd\[1452\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.54.13 ...	2020-03-19 16:19:21
106.12.54.13	attack	Mar 8 05:27:09 plusreed sshd[17371]: Invalid user xgridcontroller from 106.12.54.13 ...	2020-03-08 17:41:19

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 106.12.54.25
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55564
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;106.12.54.25.			IN	A

;; AUTHORITY SECTION:
.			363	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020040600 1800 900 604800 86400

;; Query time: 100 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Apr 07 00:22:47 CST 2020
;; MSG SIZE  rcvd: 116

Host info

Host 25.54.12.106.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 25.54.12.106.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
138.197.166.233	attack	Aug 1 10:34:29 v22018076622670303 sshd\[26029\]: Invalid user max from 138.197.166.233 port 51900 Aug 1 10:34:29 v22018076622670303 sshd\[26029\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.166.233 Aug 1 10:34:30 v22018076622670303 sshd\[26029\]: Failed password for invalid user max from 138.197.166.233 port 51900 ssh2 ...	2019-08-01 16:58:59
185.30.176.191	attackbotsspam	Aug105:11:45server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.191\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\Aug105:06:28server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.191\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\Aug105:21:41server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.148\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\<2/RvvQWPF5 5HrCU\>Aug105:05:51server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.191\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\Aug105:05:53server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.148\,lip=	2019-08-01 16:37:48
186.103.223.10	attackbots	Aug 1 04:03:57 plusreed sshd[14222]: Invalid user jboss from 186.103.223.10 ...	2019-08-01 16:56:09
149.129.225.113	attackbotsspam	Jul 31 22:48:58 localhost kernel: [15871932.048494] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=149.129.225.113 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=31073 PROTO=TCP SPT=24139 DPT=52869 WINDOW=5643 RES=0x00 SYN URGP=0 Jul 31 22:48:58 localhost kernel: [15871932.048520] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=149.129.225.113 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=31073 PROTO=TCP SPT=24139 DPT=52869 SEQ=758669438 ACK=0 WINDOW=5643 RES=0x00 SYN URGP=0 Jul 31 23:26:19 localhost kernel: [15874173.061373] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=149.129.225.113 DST=[mungedIP2] LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=36150 PROTO=TCP SPT=24139 DPT=52869 WINDOW=5643 RES=0x00 SYN URGP=0 Jul 31 23:26:19 localhost kernel: [15874173.061403] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:84:78:ac:57:a8:41:08:00 SRC=149.129.225.113 DST=[mungedIP2] LEN=40 TO	2019-08-01 16:53:43
188.166.115.226	attackspam	Aug 1 11:25:29 [munged] sshd[27289]: Invalid user ckolling from 188.166.115.226 port 46522 Aug 1 11:25:29 [munged] sshd[27289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.115.226	2019-08-01 17:27:18
193.33.111.217	attack	Aug 1 12:15:19 areeb-Workstation sshd\[24665\]: Invalid user buildbot from 193.33.111.217 Aug 1 12:15:19 areeb-Workstation sshd\[24665\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.33.111.217 Aug 1 12:15:20 areeb-Workstation sshd\[24665\]: Failed password for invalid user buildbot from 193.33.111.217 port 53702 ssh2 ...	2019-08-01 17:19:08
187.44.126.204	attackbotsspam	michaelklotzbier.de 187.44.126.204 \[01/Aug/2019:08:16:33 +0200\] "POST /wp-login.php HTTP/1.1" 200 5838 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" michaelklotzbier.de 187.44.126.204 \[01/Aug/2019:08:16:35 +0200\] "POST /wp-login.php HTTP/1.1" 200 5795 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2019-08-01 17:09:27
118.24.3.193	attackspambots	Aug 1 04:37:04 xb3 sshd[20790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.3.193 user=r.r Aug 1 04:37:06 xb3 sshd[20790]: Failed password for r.r from 118.24.3.193 port 39151 ssh2 Aug 1 04:37:06 xb3 sshd[20790]: Received disconnect from 118.24.3.193: 11: Bye Bye [preauth] Aug 1 05:23:11 xb3 sshd[7835]: Failed password for invalid user bruno from 118.24.3.193 port 52120 ssh2 Aug 1 05:23:11 xb3 sshd[7835]: Received disconnect from 118.24.3.193: 11: Bye Bye [preauth] Aug 1 05:27:00 xb3 sshd[3763]: Failed password for invalid user edward from 118.24.3.193 port 41211 ssh2 Aug 1 05:27:00 xb3 sshd[3763]: Received disconnect from 118.24.3.193: 11: Bye Bye [preauth] Aug 1 05:30:39 xb3 sshd[32153]: Failed password for invalid user user1 from 118.24.3.193 port 58624 ssh2 Aug 1 05:30:39 xb3 sshd[32153]: Received disconnect from 118.24.3.193: 11: Bye Bye [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?i	2019-08-01 17:10:38
95.48.54.106	attack	Apr 21 16:35:18 ubuntu sshd[8482]: Failed password for invalid user development from 95.48.54.106 port 39480 ssh2 Apr 21 16:37:40 ubuntu sshd[8568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.48.54.106 Apr 21 16:37:43 ubuntu sshd[8568]: Failed password for invalid user xl from 95.48.54.106 port 36722 ssh2	2019-08-01 17:04:17
185.30.176.148	attackspam	Aug105:11:45server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.191\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\Aug105:06:28server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.191\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\Aug105:21:41server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.148\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\<2/RvvQWPF5 5HrCU\>Aug105:05:51server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.191\,lip=148.251.104.77\,TLS:Connectionclosed\,session=\Aug105:05:53server4dovecot:imap-login:Disconnected$authfailed\,1attemptsin2secs$:user=\\,method=PLAIN\,rip=185.30.176.148\,lip=	2019-08-01 16:38:08
142.93.58.123	attackspambots	2019-08-01T05:26:33.780172abusebot-8.cloudsearch.cf sshd\[16483\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.58.123 user=root	2019-08-01 17:24:56
50.251.172.145	attackspam	Invalid user sage from 50.251.172.145 port 47904	2019-08-01 17:14:11
73.15.91.251	attackspam	Jun 30 04:52:12 dallas01 sshd[30690]: Failed password for invalid user sabrina from 73.15.91.251 port 58112 ssh2 Jun 30 04:53:56 dallas01 sshd[31122]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=73.15.91.251 Jun 30 04:53:58 dallas01 sshd[31122]: Failed password for invalid user mirc from 73.15.91.251 port 46948 ssh2	2019-08-01 16:39:05
184.22.218.187	attack	WordPress wp-login brute force :: 184.22.218.187 0.148 BYPASS [01/Aug/2019:13:25:49 1000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-08-01 17:13:12
80.90.39.22	attackspam	[SMB remote code execution attempt: port tcp/445] *(RWIN=1024)(08011046)	2019-08-01 17:22:15

Recently Reported IPs

168.197.157.2	103.62.30.179	95.29.123.150	59.45.76.90
185.60.107.18	111.62.253.9	113.162.176.196	84.20.241.7
190.201.113.70	121.201.66.99	122.222.161.213	41.233.66.183
95.68.208.118	95.62.150.43	201.243.6.95	190.144.62.29
101.133.86.179	185.48.39.23	198.102.200.241	248.170.158.69