116.106.91.148

Basic Info

City: unknown

Region: unknown

Country: Viet Nam

Internet Service Provider: Viettel Group

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	445/tcp 445/tcp [2019-06-21]2pkt	2019-06-21 21:14:41

Comments on same subnet:

IP	Type	Details	Datetime
116.106.91.38	attack	TCP port 445 (SMB) attempt blocked by firewall. [2019-07-07 15:44:12]	2019-07-07 23:14:08

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 116.106.91.148
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57884
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;116.106.91.148.			IN	A

;; AUTHORITY SECTION:
.			3542	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019062100 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Fri Jun 21 21:14:32 CST 2019
;; MSG SIZE  rcvd: 118

Host info

Host 148.91.106.116.in-addr.arpa not found: 2(SERVFAIL)

Nslookup info:

;; Got SERVFAIL reply from 67.207.67.2, trying next server
Server:		67.207.67.3
Address:	67.207.67.3#53

** server can't find 148.91.106.116.in-addr.arpa: SERVFAIL

Related IP info:

Related comments:

IP	Type	Details	Datetime
189.201.236.238	attackspambots	Dec 24 04:04:11 our-server-hostname postfix/smtpd[27782]: connect from unknown[189.201.236.238] Dec x@x Dec 24 04:04:45 our-server-hostname postfix/smtpd[27782]: lost connection after RCPT from unknown[189.201.236.238] Dec 24 04:04:45 our-server-hostname postfix/smtpd[27782]: disconnect from unknown[189.201.236.238] Dec 24 06:05:41 our-server-hostname postfix/smtpd[17727]: connect from unknown[189.201.236.238] Dec x@x Dec x@x Dec x@x Dec x@x Dec x@x Dec x@x Dec x@x Dec x@x Dec x@x Dec x@x ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=189.201.236.238	2019-12-26 08:35:45
36.80.48.9	attackbotsspam	Dec 25 23:42:59 dev0-dcde-rnet sshd[31834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.80.48.9 Dec 25 23:43:02 dev0-dcde-rnet sshd[31834]: Failed password for invalid user amavis from 36.80.48.9 port 2049 ssh2 Dec 25 23:52:14 dev0-dcde-rnet sshd[31985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.80.48.9	2019-12-26 08:39:58
45.125.239.234	attack	Wordpress login scanning	2019-12-26 08:38:12
43.248.187.45	attackspam	2019-12-26T00:19:13.166457abusebot-8.cloudsearch.cf sshd[21695]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.248.187.45 user=root 2019-12-26T00:19:15.137978abusebot-8.cloudsearch.cf sshd[21695]: Failed password for root from 43.248.187.45 port 55363 ssh2 2019-12-26T00:19:17.135033abusebot-8.cloudsearch.cf sshd[21697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.248.187.45 user=root 2019-12-26T00:19:18.654818abusebot-8.cloudsearch.cf sshd[21697]: Failed password for root from 43.248.187.45 port 57051 ssh2 2019-12-26T00:19:20.686645abusebot-8.cloudsearch.cf sshd[21700]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.248.187.45 user=root 2019-12-26T00:19:22.953892abusebot-8.cloudsearch.cf sshd[21700]: Failed password for root from 43.248.187.45 port 58649 ssh2 2019-12-26T00:19:25.014455abusebot-8.cloudsearch.cf sshd[21702]: pam_unix(sshd:auth): authe ...	2019-12-26 08:42:59
187.116.157.249	attackspambots	Automatic report - Port Scan Attack	2019-12-26 08:20:53
198.108.66.80	attackspambots	Unauthorized connection attempt detected from IP address 198.108.66.80 to port 2323	2019-12-26 08:35:10
128.199.125.95	attackbots	$f2bV_matches	2019-12-26 08:36:34
222.186.173.238	attackbotsspam	Dec 25 19:23:08 TORMINT sshd\[26789\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238 user=root Dec 25 19:23:10 TORMINT sshd\[26789\]: Failed password for root from 222.186.173.238 port 61096 ssh2 Dec 25 19:23:26 TORMINT sshd\[26795\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238 user=root ...	2019-12-26 08:23:59
23.228.99.162	attackspambots	" "	2019-12-26 08:20:06
45.143.220.136	attackbots	\[2019-12-25 19:18:24\] NOTICE\[2839\] chan_sip.c: Registration from '"371" \' failed for '45.143.220.136:6146' - Wrong password \[2019-12-25 19:18:24\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-25T19:18:24.556-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="371",SessionID="0x7f0fb4bb5cd8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/45.143.220.136/6146",Challenge="7c77d379",ReceivedChallenge="7c77d379",ReceivedHash="fd5ecdee912ea5a74a7a9c8932689c0d" \[2019-12-25 19:18:24\] NOTICE\[2839\] chan_sip.c: Registration from '"371" \' failed for '45.143.220.136:6146' - Wrong password \[2019-12-25 19:18:24\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-25T19:18:24.655-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="371",SessionID="0x7f0fb4a5a908",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/4	2019-12-26 08:34:11
5.135.176.206	attackbotsspam	Dec 26 01:33:14 MK-Soft-Root1 sshd[15883]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.135.176.206 Dec 26 01:33:16 MK-Soft-Root1 sshd[15883]: Failed password for invalid user sabry from 5.135.176.206 port 56108 ssh2 ...	2019-12-26 08:51:34
37.52.247.230	attackbots	Unauthorised access (Dec 26) SRC=37.52.247.230 LEN=52 TTL=120 ID=4151 DF TCP DPT=445 WINDOW=8192 SYN	2019-12-26 08:41:50
189.51.120.98	attackbotsspam	$f2bV_matches	2019-12-26 08:37:33
101.91.160.243	attack	Invalid user smmsp from 101.91.160.243 port 41536	2019-12-26 08:46:00
110.49.70.247	attackbotsspam	[Aegis] @ 2019-12-25 23:52:05 0000 -> Attempted Administrator Privilege Gain: ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack	2019-12-26 08:31:11

Recently Reported IPs

221.124.215.2	125.160.114.5	195.205.96.16	36.72.218.97
106.56.115.39	81.218.182.52	45.121.41.10	182.254.230.122
222.86.134.221	111.119.221.158	103.117.156.50	81.215.203.68
43.143.94.170	186.3.185.199	86.175.191.112	122.142.211.160
182.76.83.26	123.234.250.87	1.160.198.13	1.75.49.171