125.64.94.133 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: ChinaNet Sichuan Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	scans once in preceeding hours on the ports (in chronological order) 32760 resulting in total of 3 scans from 125.64.0.0/13 block.	2020-10-11 01:32:26
attackspam	Tried our host z.	2020-09-12 23:50:50
attackspam	Port scanning [8 denied]	2020-09-12 15:53:20
attackbotsspam	Port scan: Attack repeated for 24 hours	2020-09-12 07:39:56
attackbotsspam	Telnet Server BruteForce Attack	2020-09-12 01:42:52
attackspambots	MultiHost/MultiPort Probe, Scan, Hack -	2020-09-11 17:34:08
attack	[N10.H2.VM2] Port Scanner Detected Blocked by UFW	2020-08-28 17:28:32

Comments on same subnet:

IP	Type	Details	Datetime
125.64.94.136	attackbots	TCP (SYN) 125.64.94.136:40563 -> port 12000, len 44	2020-10-13 23:59:13
125.64.94.136	attackbots	=Multiport scan 187 ports : 1 13 22 31 32(x2) 38 70 82 111 113 123 280 322 497 510 517(x2) 518 523 548(x2) 556 587(x2) 620 623 636 731 783(x2) 898 990 994 995(x2) 1042(x2) 1080 1200 1241 1344 1400 1443 1503 1505 1521 1604 1830 1883 1900 1901 1967 2000 2010 2030 2052 2080(x3) 2086 2095 2181 2252 2332 2375(x2) 2404 2406(x2) 2443 2600 2601(x2) 2604 2715 2869 3075(x2) 3097 3260 3299 3310 3311 3333 3352 3372 3388 3390 3443 3520 3522 3525 3526 3529 3689 3774 3940 4022 4155 4430 4440 4444 4700 5007 5051 5061 5094 5269 5280 5353 5570 5672 5683 5900 5901 5902 5938 5984 6001(x2) 6112 6346 6443 6544 6666(x3) 6667 6669 6679 6697 6699 6881(x2) 6969 6998 7000 7001 7007 7077 7144 7199 7200(x2) 7778 8000 8001 8002 8004 8006 8007 8009(x2) 8030 8060 8069 8086 8123 8182 8332 8333 8500 8554 8880 8881(x2) 8884 8889 8899(x2) 9002 9030 9080 9300 9446(x3) 9595 9801 9944 9993 10000 10250 10255 10443 11371 12999 13666 13722 14534 15002 16514 16923 16993 19150 19999 20332 22335 25565 26470 27017(x2) 27018 31337 3....	2020-10-13 07:51:07
125.64.94.136	attackbotsspam	TCP (SYN) 125.64.94.136:41809 -> port 50200, len 44	2020-10-07 06:39:26
125.64.94.136	attackspambots	Automatic report - Banned IP Access	2020-10-06 22:57:41
125.64.94.136	attackspam	firewall-block, port(s): 5427/tcp, 50111/tcp	2020-10-06 14:42:44
125.64.94.136	attack	TCP (SYN) 125.64.94.136:44297 -> port 50050, len 44	2020-09-22 20:55:43
125.64.94.136	attack	firewall-block, port(s): 1040/tcp, 4506/tcp, 5357/tcp, 40001/tcp	2020-09-22 05:04:54
125.64.94.136	attack	TCP (SYN) 125.64.94.136:52792 -> port 901, len 44	2020-09-20 00:40:07
125.64.94.136	attackspam	proto=tcp . spt=40362 . dpt=995 . src=125.64.94.136 . dst=xx.xx.4.1 . Found on Binary Defense (40)	2020-09-19 16:28:15
125.64.94.136	attackspambots	scans 3 times in preceeding hours on the ports (in chronological order) 8800 4949 15001 resulting in total of 5 scans from 125.64.0.0/13 block.	2020-09-18 22:39:06
125.64.94.136	attackspam	Found on Binary Defense / proto=6 . srcport=38676 . dstport=16993 . (77)	2020-09-18 14:53:34
125.64.94.136	attackbots	Hacking	2020-09-18 05:10:01
125.64.94.136	attack	firewall-block, port(s): 48649/tcp	2020-09-13 22:51:12
125.64.94.136	attackspambots	32/tcp 9864/tcp 32757/udp... [2020-09-09/13]118pkt,92pt.(tcp),20pt.(udp)	2020-09-13 14:47:58
125.64.94.136	attack	SmallBizIT.US 5 packets to tcp(22,512,902,2080,4911)	2020-09-13 06:31:28

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 125.64.94.133
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31380
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;125.64.94.133.			IN	A

;; AUTHORITY SECTION:
.			378	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020082800 1800 900 604800 86400

;; Query time: 17 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Aug 28 17:28:27 CST 2020
;; MSG SIZE  rcvd: 117

Host info

Host 133.94.64.125.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 133.94.64.125.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
220.134.214.250	attackspam	Telnet Server BruteForce Attack	2020-09-11 14:20:50
200.129.139.116	attackbots	200.129.139.116 (BR/Brazil/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 10 13:01:46 server5 sshd[27133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.129.139.116 user=root Sep 10 12:59:51 server5 sshd[26242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.207.6.163 user=root Sep 10 12:59:54 server5 sshd[26242]: Failed password for root from 115.207.6.163 port 48020 ssh2 Sep 10 12:58:24 server5 sshd[25422]: Failed password for root from 152.136.11.110 port 59980 ssh2 Sep 10 12:58:23 server5 sshd[25422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.11.110 user=root Sep 10 12:59:02 server5 sshd[25785]: Failed password for root from 82.65.27.68 port 51792 ssh2 IP Addresses Blocked:	2020-09-11 14:12:59
20.188.107.54	attackspam	Sep 10 20:59:22 * sshd[27076]: Failed password for root from 20.188.107.54 port 1024 ssh2	2020-09-11 14:19:47
170.80.241.27	attack	1599757031 - 09/10/2020 18:57:11 Host: 170.80.241.27/170.80.241.27 Port: 445 TCP Blocked	2020-09-11 14:11:11
162.158.106.128	attackbotsspam	srv02 DDoS Malware Target(80:http) ..	2020-09-11 14:08:29
122.100.215.82	attack	Sep 11 01:01:41 ssh2 sshd[78783]: User root from nz215l82.bb122100.ctm.net not allowed because not listed in AllowUsers Sep 11 01:01:41 ssh2 sshd[78783]: Failed password for invalid user root from 122.100.215.82 port 39552 ssh2 Sep 11 01:01:41 ssh2 sshd[78783]: Connection closed by invalid user root 122.100.215.82 port 39552 [preauth] ...	2020-09-11 14:09:51
79.30.149.58	attackspam	Sep 11 08:03:48 vps639187 sshd\[2833\]: Invalid user admin from 79.30.149.58 port 64900 Sep 11 08:03:48 vps639187 sshd\[2833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.30.149.58 Sep 11 08:03:50 vps639187 sshd\[2833\]: Failed password for invalid user admin from 79.30.149.58 port 64900 ssh2 ...	2020-09-11 14:23:25
212.70.149.4	attackspambots	Sep 11 07:44:51 relay postfix/smtpd\[30515\]: warning: unknown\[212.70.149.4\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 11 07:48:24 relay postfix/smtpd\[22190\]: warning: unknown\[212.70.149.4\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 11 07:51:58 relay postfix/smtpd\[30515\]: warning: unknown\[212.70.149.4\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 11 07:55:32 relay postfix/smtpd\[22191\]: warning: unknown\[212.70.149.4\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 11 07:59:06 relay postfix/smtpd\[22191\]: warning: unknown\[212.70.149.4\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ...	2020-09-11 14:04:09
218.191.190.121	attack	Sep 10 18:56:54 mail sshd[11802]: Failed password for root from 218.191.190.121 port 35097 ssh2	2020-09-11 14:22:09
119.247.94.100	attackspambots	TCP (SYN) 119.247.94.100:63019 -> port 23, len 44	2020-09-11 14:22:41
187.38.198.237	attack	Sep 10 10:18:46 server sshd[139321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.38.198.237 user=root Sep 10 10:18:48 server sshd[139321]: Failed password for root from 187.38.198.237 port 38908 ssh2 ...	2020-09-11 14:18:03
177.173.188.124	attackbots	Sep 10 18:56:47 andromeda sshd\[6691\]: Invalid user cablecom from 177.173.188.124 port 37608 Sep 10 18:56:49 andromeda sshd\[6691\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.173.188.124 Sep 10 18:56:51 andromeda sshd\[6691\]: Failed password for invalid user cablecom from 177.173.188.124 port 37608 ssh2	2020-09-11 14:25:08
200.84.96.112	attack	IP 200.84.96.112 attacked honeypot on port: 1433 at 9/10/2020 9:56:27 AM	2020-09-11 14:32:00
54.38.55.136	attack	54.38.55.136 (PL/Poland/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 10 12:57:14 server5 sshd[24882]: Failed password for root from 178.128.61.101 port 58388 ssh2 Sep 10 12:57:17 server5 sshd[24891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.120.37 user=root Sep 10 12:57:12 server5 sshd[24882]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.61.101 user=root Sep 10 12:53:03 server5 sshd[22713]: Failed password for root from 54.38.55.136 port 34870 ssh2 Sep 10 12:56:21 server5 sshd[24154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.30.236.149 user=root Sep 10 12:56:23 server5 sshd[24154]: Failed password for root from 123.30.236.149 port 11284 ssh2 IP Addresses Blocked: 178.128.61.101 (SG/Singapore/-) 68.183.120.37 (US/United States/-)	2020-09-11 14:03:43
85.234.166.93	attack	Sep 11 01:01:00 ssh2 sshd[78673]: Invalid user guest from 85.234.166.93 port 58642 Sep 11 01:01:00 ssh2 sshd[78673]: Failed password for invalid user guest from 85.234.166.93 port 58642 ssh2 Sep 11 01:01:00 ssh2 sshd[78673]: Connection closed by invalid user guest 85.234.166.93 port 58642 [preauth] ...	2020-09-11 14:18:20

Recently Reported IPs

103.45.179.194	5.188.84.59	34.230.76.253	200.194.15.145
118.99.94.96	172.105.249.120	122.155.164.118	9.138.79.128
117.80.83.208	183.166.147.67	193.148.18.89	115.79.109.73
113.163.4.204	188.80.49.202	183.166.137.163	116.48.102.218
111.230.200.244	14.245.106.93	254.92.131.63	91.1.58.36