City: Bad Langensalza
Region: Thuringia
Country: Germany
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 109.73.30.15
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19753
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;109.73.30.15. IN A
;; AUTHORITY SECTION:
. 261 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2020031901 1800 900 604800 86400
;; Query time: 101 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Mar 20 05:44:12 CST 2020
;; MSG SIZE rcvd: 116Host 15.30.73.109.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 15.30.73.109.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 192.210.190.60 | attack | Attempting to access Wordpress login on a honeypot or private system. |
2020-09-01 06:46:56 |
| 157.230.109.166 | attack | Failed password for root from 157.230.109.166 port 49976 ssh2 |
2020-09-01 07:00:18 |
| 119.45.119.141 | attackspambots | SSH Brute-Forcing (server2) |
2020-09-01 06:52:07 |
| 75.137.147.184 | attackbots | SSH Invalid Login |
2020-09-01 06:52:58 |
| 80.82.68.202 | attackbotsspam | "Path Traversal Attack (/../) - Matched Data: /../ found within REQUEST_URI_RAW: /wp-content/plugins/abtest/abtest_admin.php?action=../../../wp-config.php" |
2020-09-01 07:17:56 |
| 218.204.17.44 | attackspam | Aug 31 23:36:01 OPSO sshd\[21250\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.204.17.44 user=root Aug 31 23:36:03 OPSO sshd\[21250\]: Failed password for root from 218.204.17.44 port 59227 ssh2 Aug 31 23:39:38 OPSO sshd\[21833\]: Invalid user danko from 218.204.17.44 port 50559 Aug 31 23:39:38 OPSO sshd\[21833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.204.17.44 Aug 31 23:39:39 OPSO sshd\[21833\]: Failed password for invalid user danko from 218.204.17.44 port 50559 ssh2 |
2020-09-01 07:20:06 |
| 111.231.71.53 | attackbotsspam | Aug 31 23:23:22 srv-ubuntu-dev3 sshd[4339]: Invalid user domain from 111.231.71.53 Aug 31 23:23:22 srv-ubuntu-dev3 sshd[4339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.71.53 Aug 31 23:23:22 srv-ubuntu-dev3 sshd[4339]: Invalid user domain from 111.231.71.53 Aug 31 23:23:23 srv-ubuntu-dev3 sshd[4339]: Failed password for invalid user domain from 111.231.71.53 port 48602 ssh2 Aug 31 23:27:30 srv-ubuntu-dev3 sshd[4728]: Invalid user svn from 111.231.71.53 Aug 31 23:27:30 srv-ubuntu-dev3 sshd[4728]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.71.53 Aug 31 23:27:30 srv-ubuntu-dev3 sshd[4728]: Invalid user svn from 111.231.71.53 Aug 31 23:27:32 srv-ubuntu-dev3 sshd[4728]: Failed password for invalid user svn from 111.231.71.53 port 47730 ssh2 Aug 31 23:31:31 srv-ubuntu-dev3 sshd[5216]: Invalid user uat from 111.231.71.53 ... |
2020-09-01 07:00:47 |
| 5.45.207.88 | attackspam | [Tue Sep 01 04:11:17.753727 2020] [:error] [pid 9470:tid 140501331568384] [client 5.45.207.88:64648] [client 5.45.207.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "X01ndc80y9t-9ILXj1vO2AAAAZU"] ... |
2020-09-01 07:05:27 |
| 106.13.233.83 | attack | Aug 31 18:29:08 george sshd[10875]: Invalid user test1 from 106.13.233.83 port 40510 Aug 31 18:29:08 george sshd[10875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.233.83 Aug 31 18:29:10 george sshd[10875]: Failed password for invalid user test1 from 106.13.233.83 port 40510 ssh2 Aug 31 18:32:49 george sshd[10939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.233.83 user=root Aug 31 18:32:51 george sshd[10939]: Failed password for root from 106.13.233.83 port 36558 ssh2 ... |
2020-09-01 07:16:33 |
| 200.119.110.137 | attackspambots | Unauthorised access (Sep 1) SRC=200.119.110.137 LEN=52 TTL=112 ID=10927 DF TCP DPT=445 WINDOW=8192 SYN |
2020-09-01 06:54:50 |
| 139.155.127.59 | attackbots | (sshd) Failed SSH login from 139.155.127.59 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 1 00:02:52 s1 sshd[29097]: Invalid user pd from 139.155.127.59 port 34578 Sep 1 00:02:54 s1 sshd[29097]: Failed password for invalid user pd from 139.155.127.59 port 34578 ssh2 Sep 1 00:07:02 s1 sshd[29303]: Invalid user demo from 139.155.127.59 port 59930 Sep 1 00:07:04 s1 sshd[29303]: Failed password for invalid user demo from 139.155.127.59 port 59930 ssh2 Sep 1 00:11:25 s1 sshd[29550]: Invalid user ubuntu from 139.155.127.59 port 57046 |
2020-09-01 06:55:06 |
| 182.16.245.54 | attackspam | Spam |
2020-09-01 06:59:51 |
| 73.189.20.216 | attackspambots | Port 22 Scan, PTR: None |
2020-09-01 06:55:39 |
| 123.206.190.82 | attackbots | Banned for a week because repeated abuses, for example SSH, but not only |
2020-09-01 06:50:19 |
| 219.112.215.167 | attackbotsspam | port scan and connect, tcp 23 (telnet) |
2020-09-01 07:08:34 |