125.161.105.160

Basic Info

City: unknown

Region: unknown

Country: Indonesia

Internet Service Provider: PT Telkom Indonesia

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-03 09:04:36,839 INFO [shellcode_manager] (125.161.105.160) no match, writing hexdump (e17b1928c9f5fa6e183cf29ebfaa48b0 :2279925) - MS17010 (EternalBlue)	2019-07-04 19:40:19

Type

Details

Datetime

attack

@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-03 09:04:36,839 INFO [shellcode_manager] (125.161.105.160) no match, writing hexdump (e17b1928c9f5fa6e183cf29ebfaa48b0 :2279925) - MS17010 (EternalBlue)

2019-07-04 19:40:19

Comments on same subnet:

IP	Type	Details	Datetime
125.161.105.129	attack	trying to access non-authorized port	2020-05-12 21:49:23
125.161.105.102	attackbots	Unauthorized connection attempt from IP address 125.161.105.102 on Port 445(SMB)	2020-04-14 21:01:15
125.161.105.249	attackspam	Automatic report - Port Scan Attack	2020-04-12 21:09:41
125.161.105.64	attackspambots	Unauthorized connection attempt from IP address 125.161.105.64 on Port 445(SMB)	2020-03-24 03:23:08
125.161.105.226	attackspam	Unauthorized connection attempt from IP address 125.161.105.226 on Port 445(SMB)	2020-02-28 23:15:25
125.161.105.70	attackspam	unauthorized connection attempt	2020-02-26 14:43:27
125.161.105.8	attackbots	Unauthorized connection attempt from IP address 125.161.105.8 on Port 445(SMB)	2020-02-22 18:09:06
125.161.105.236	attackbotsspam	Honeypot attack, port: 445, PTR: 236.subnet125-161-105.speedy.telkom.net.id.	2020-02-11 16:00:55
125.161.105.115	attackspambots	Unauthorized connection attempt from IP address 125.161.105.115 on Port 445(SMB)	2020-01-26 18:03:49
125.161.105.252	attack	Unauthorized connection attempt detected from IP address 125.161.105.252 to port 8080 [J]	2020-01-06 15:38:35
125.161.105.247	attackspam	Jan 1 03:05:07 pl3server sshd[27763]: reveeclipse mapping checking getaddrinfo for 247.subnet125-161-105.speedy.telkom.net.id [125.161.105.247] failed - POSSIBLE BREAK-IN ATTEMPT! Jan 1 03:05:07 pl3server sshd[27763]: Invalid user admin from 125.161.105.247 Jan 1 03:05:07 pl3server sshd[27763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.161.105.247 Jan 1 03:05:09 pl3server sshd[27763]: Failed password for invalid user admin from 125.161.105.247 port 15462 ssh2 Jan 1 03:05:09 pl3server sshd[27763]: Connection closed by 125.161.105.247 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=125.161.105.247	2020-01-02 19:51:07
125.161.105.215	attackbotsspam	1577889640 - 01/01/2020 15:40:40 Host: 125.161.105.215/125.161.105.215 Port: 445 TCP Blocked	2020-01-02 06:31:57
125.161.105.47	attackbotsspam	Unauthorised access (Dec 18) SRC=125.161.105.47 LEN=52 TTL=248 ID=11414 DF TCP DPT=445 WINDOW=8192 SYN Unauthorised access (Dec 18) SRC=125.161.105.47 LEN=52 TTL=248 ID=7716 DF TCP DPT=445 WINDOW=8192 SYN	2019-12-18 17:59:49
125.161.105.135	attack	Attempt to attack host OS, exploiting network vulnerabilities, on 25-11-2019 06:20:29.	2019-11-25 21:30:24
125.161.105.116	attackbots	Unauthorized IMAP connection attempt	2019-10-23 03:15:16

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 125.161.105.160
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 21354
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;125.161.105.160.		IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019070400 1800 900 604800 86400

;; Query time: 3 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Thu Jul 04 19:39:56 CST 2019
;; MSG SIZE  rcvd: 119

Host info

160.105.161.125.in-addr.arpa domain name pointer 160.subnet125-161-105.speedy.telkom.net.id.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
160.105.161.125.in-addr.arpa	name = 160.subnet125-161-105.speedy.telkom.net.id.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
186.31.37.203	attack	ssh brute force	2019-09-27 19:53:34
213.6.17.2	attack	Sep 27 07:28:52 mail postfix/smtpd\[30351\]: NOQUEUE: reject: RCPT from unknown\[213.6.17.2\]: 554 5.7.1 Service unavailable\; Client host \[213.6.17.2\] blocked using zen.spamhaus.org\; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/213.6.17.2\; from=\ to=\ proto=ESMTP helo=\	2019-09-27 19:51:18
157.230.215.106	attackspambots	Sep 27 13:33:23 nextcloud sshd\[22123\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.215.106 user=mysql Sep 27 13:33:25 nextcloud sshd\[22123\]: Failed password for mysql from 157.230.215.106 port 48088 ssh2 Sep 27 13:37:15 nextcloud sshd\[28385\]: Invalid user rk from 157.230.215.106 Sep 27 13:37:15 nextcloud sshd\[28385\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.215.106 ...	2019-09-27 19:43:54
185.220.101.48	attack	langenachtfulda.de:80 185.220.101.48 - - \[27/Sep/2019:14:15:48 +0200\] "POST /xmlrpc.php HTTP/1.0" 301 503 "-" "Mozilla/5.0 \(Windows NT 6.1\; Win64\; x64\; rv:61.0\) Gecko/20100101 Firefox/61.0" langenachtfulda.de 185.220.101.48 \[27/Sep/2019:14:15:50 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 3777 "-" "Mozilla/5.0 \(Windows NT 6.1\; Win64\; x64\; rv:61.0\) Gecko/20100101 Firefox/61.0"	2019-09-27 20:28:16
47.184.222.96	attackbotsspam	ssh failed login	2019-09-27 20:28:50
111.40.50.194	attackspambots	Sep 27 08:37:30 markkoudstaal sshd[9780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.40.50.194 Sep 27 08:37:32 markkoudstaal sshd[9780]: Failed password for invalid user corinne from 111.40.50.194 port 54012 ssh2 Sep 27 08:41:59 markkoudstaal sshd[10261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.40.50.194	2019-09-27 20:12:54
14.49.38.114	attack	Sep 26 17:58:17 lcdev sshd\[13426\]: Invalid user artwork from 14.49.38.114 Sep 26 17:58:17 lcdev sshd\[13426\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.49.38.114 Sep 26 17:58:19 lcdev sshd\[13426\]: Failed password for invalid user artwork from 14.49.38.114 port 38752 ssh2 Sep 26 18:03:03 lcdev sshd\[13775\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.49.38.114 user=root Sep 26 18:03:05 lcdev sshd\[13775\]: Failed password for root from 14.49.38.114 port 50760 ssh2	2019-09-27 20:16:11
49.232.60.2	attackbotsspam	Sep 27 13:02:41 vps691689 sshd[8906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.232.60.2 Sep 27 13:02:42 vps691689 sshd[8906]: Failed password for invalid user zaqueu from 49.232.60.2 port 41454 ssh2 ...	2019-09-27 19:42:11
173.249.15.49	attackspam	Sep 27 12:54:55 vps647732 sshd[12400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.249.15.49 Sep 27 12:54:57 vps647732 sshd[12400]: Failed password for invalid user admin from 173.249.15.49 port 52232 ssh2 ...	2019-09-27 20:04:51
159.203.201.182	attackbotsspam	1521/tcp 17185/udp 8118/tcp... [2019-09-13/26]12pkt,9pt.(tcp),3pt.(udp)	2019-09-27 19:46:06
186.225.101.18	attackspambots	Attempt to attack host OS, exploiting network vulnerabilities, on 27-09-2019 04:45:20.	2019-09-27 19:58:45
77.247.110.135	attackbotsspam	\[2019-09-27 07:35:33\] SECURITY\[2006\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-27T07:35:33.416-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="2045701148333554002",SessionID="0x7f1e1c8be8a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.135/57586",ACLName="no_extension_match" \[2019-09-27 07:35:51\] SECURITY\[2006\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-27T07:35:51.717-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1604601148857315011",SessionID="0x7f1e1c2bed58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.135/57168",ACLName="no_extension_match" \[2019-09-27 07:36:01\] SECURITY\[2006\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-09-27T07:36:01.907-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="1166801148833566007",SessionID="0x7f1e1c1e96b8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.135/52578",	2019-09-27 19:41:24
51.38.80.173	attack	Invalid user postgres from 51.38.80.173 port 51920	2019-09-27 20:08:12
117.50.35.192	attackspambots	Sep 27 08:53:07 venus sshd\[13420\]: Invalid user mohitha from 117.50.35.192 port 59860 Sep 27 08:53:07 venus sshd\[13420\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.35.192 Sep 27 08:53:09 venus sshd\[13420\]: Failed password for invalid user mohitha from 117.50.35.192 port 59860 ssh2 ...	2019-09-27 20:11:44
165.22.110.16	attackspambots	Sep 27 02:11:16 sachi sshd\[3793\]: Invalid user sbserver from 165.22.110.16 Sep 27 02:11:16 sachi sshd\[3793\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.110.16 Sep 27 02:11:19 sachi sshd\[3793\]: Failed password for invalid user sbserver from 165.22.110.16 port 39346 ssh2 Sep 27 02:15:49 sachi sshd\[4237\]: Invalid user fz from 165.22.110.16 Sep 27 02:15:49 sachi sshd\[4237\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.110.16	2019-09-27 20:29:19

Recently Reported IPs

201.243.144.116	222.254.23.81	39.36.27.219	109.230.128.211
60.226.8.164	113.23.31.249	37.150.0.172	114.106.74.239
165.67.129.130	171.237.166.197	122.193.115.238	201.232.242.14
158.69.23.53	178.203.147.40	45.101.114.114	197.210.124.186
193.233.169.205	189.1.10.26	188.165.203.57	185.68.195.152