112.137.138.4 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Viet Nam

Internet Service Provider: VietNam National University Ha Noi

Hostname: unknown

Organization: unknown

Usage Type: University/College/School

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	May 20 22:01:05 nextcloud sshd\[13627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.137.138.4 user=root May 20 22:01:07 nextcloud sshd\[13627\]: Failed password for root from 112.137.138.4 port 49928 ssh2 May 20 22:49:46 nextcloud sshd\[9218\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.137.138.4 user=root	2020-05-21 05:04:31
attack	C1,DEF GET /phpMyAdmin/scripts/setup.php	2020-05-15 15:06:49

Type

Details

Datetime

attack

May 20 22:01:05 nextcloud sshd\[13627\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.137.138.4  user=root
May 20 22:01:07 nextcloud sshd\[13627\]: Failed password for root from 112.137.138.4 port 49928 ssh2
May 20 22:49:46 nextcloud sshd\[9218\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.137.138.4  user=root

2020-05-21 05:04:31

attack

C1,DEF GET /phpMyAdmin/scripts/setup.php

2020-05-15 15:06:49

Comments on same subnet:

No discussion about this subnet yet..

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 112.137.138.4
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 53730
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;112.137.138.4.			IN	A

;; AUTHORITY SECTION:
.			519	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020051401 1800 900 604800 86400

;; Query time: 94 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri May 15 15:06:45 CST 2020
;; MSG SIZE  rcvd: 117

Host info

Host 4.138.137.112.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 4.138.137.112.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
36.90.3.227	attack	Automatic report - XMLRPC Attack	2020-06-07 01:10:44
177.225.140.10	attack	Automatic report - XMLRPC Attack	2020-06-07 01:09:04
192.241.202.169	attack	Jun 6 11:33:25 vps46666688 sshd[19226]: Failed password for root from 192.241.202.169 port 58412 ssh2 ...	2020-06-07 01:31:48
106.13.184.7	attackbots	Jun 6 22:47:40 dhoomketu sshd[536419]: Failed password for root from 106.13.184.7 port 35274 ssh2 Jun 6 22:48:33 dhoomketu sshd[536435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.184.7 user=root Jun 6 22:48:35 dhoomketu sshd[536435]: Failed password for root from 106.13.184.7 port 45612 ssh2 Jun 6 22:49:33 dhoomketu sshd[536454]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.184.7 user=root Jun 6 22:49:35 dhoomketu sshd[536454]: Failed password for root from 106.13.184.7 port 56006 ssh2 ...	2020-06-07 01:32:36
185.234.216.198	attackspam	GET /.env	2020-06-07 01:07:59
27.102.67.108	attack	Unauthorized connection attempt from IP address 27.102.67.108 on Port 445(SMB)	2020-06-07 01:06:03
79.124.62.55	attackspambots	" "	2020-06-07 00:56:32
211.252.85.17	attackspam	2020-06-06T12:36:56.8512301495-001 sshd[38025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.252.85.17 user=root 2020-06-06T12:36:59.3075321495-001 sshd[38025]: Failed password for root from 211.252.85.17 port 42802 ssh2 2020-06-06T12:45:16.9361291495-001 sshd[38415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.252.85.17 user=root 2020-06-06T12:45:19.0337621495-001 sshd[38415]: Failed password for root from 211.252.85.17 port 46324 ssh2 2020-06-06T12:49:46.6454681495-001 sshd[38543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.252.85.17 user=root 2020-06-06T12:49:48.1431191495-001 sshd[38543]: Failed password for root from 211.252.85.17 port 48084 ssh2 ...	2020-06-07 01:23:19
184.168.146.39	attackbotsspam	Automatic report - XMLRPC Attack	2020-06-07 01:22:08
190.39.58.69	attackspambots	20/6/6@09:47:36: FAIL: Alarm-Network address from=190.39.58.69 ...	2020-06-07 01:02:43
222.186.180.130	attack	Jun 6 17:27:06 ip-172-31-61-156 sshd[2617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.130 user=root Jun 6 17:27:08 ip-172-31-61-156 sshd[2617]: Failed password for root from 222.186.180.130 port 34221 ssh2 Jun 6 17:27:10 ip-172-31-61-156 sshd[2617]: Failed password for root from 222.186.180.130 port 34221 ssh2 Jun 6 17:27:12 ip-172-31-61-156 sshd[2617]: Failed password for root from 222.186.180.130 port 34221 ssh2 ...	2020-06-07 01:35:35
74.56.131.113	attack	20 attempts against mh-ssh on echoip	2020-06-07 01:33:26
113.186.31.107	attack	Automatic report - Port Scan Attack	2020-06-07 01:03:49
121.42.142.188	attackbotsspam	121.42.142.188 - - [06/Jun/2020:06:29:36 -0600] "HEAD /dede/login.php HTTP/1.1" 301 235 "-" "-" ...	2020-06-07 01:32:10
114.36.6.160	attackbotsspam	TCP (SYN) 114.36.6.160:52190 -> port 23, len 44	2020-06-07 01:25:15

Recently Reported IPs

183.81.85.70	111.79.76.106	165.22.109.68	221.17.37.35
217.182.75.172	123.13.109.74	148.152.60.13	145.121.242.229
57.162.238.11	67.206.200.122	180.183.59.71	103.123.215.73
123.16.232.212	36.85.118.156	97.71.140.229	188.246.236.106
47.240.61.178	20.49.2.147	189.132.59.102	201.247.40.134