134.48.5.7 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States of America

Internet Service Provider: Marquette University

Hostname: unknown

Organization: unknown

Usage Type: University/College/School

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	Feb 23 14:29:00 MK-Soft-VM3 sshd[16876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.48.5.7 Feb 23 14:29:02 MK-Soft-VM3 sshd[16876]: Failed password for invalid user jmiller from 134.48.5.7 port 43976 ssh2 ...	2020-02-23 21:49:15

Type

Details

Datetime

attackspam

Feb 23 14:29:00 MK-Soft-VM3 sshd[16876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.48.5.7 
Feb 23 14:29:02 MK-Soft-VM3 sshd[16876]: Failed password for invalid user jmiller from 134.48.5.7 port 43976 ssh2
...

2020-02-23 21:49:15

Comments on same subnet:

IP	Type	Details	Datetime
134.48.5.250	attack	Jan 9 14:11:33 lakhesis sshd[31144]: Invalid user mlsmhostnameh from 134.48.5.250 port 52842 Jan 9 14:11:33 lakhesis sshd[31144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.48.5.250 Jan 9 14:11:35 lakhesis sshd[31144]: Failed password for invalid user mlsmhostnameh from 134.48.5.250 port 52842 ssh2 Jan 9 14:14:35 lakhesis sshd[32198]: Invalid user hta from 134.48.5.250 port 57002 Jan 9 14:14:35 lakhesis sshd[32198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.48.5.250 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=134.48.5.250	2020-01-09 21:44:17

Type

Details

Datetime

134.48.5.250

attack

Jan  9 14:11:33 lakhesis sshd[31144]: Invalid user mlsmhostnameh from 134.48.5.250 port 52842
Jan  9 14:11:33 lakhesis sshd[31144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.48.5.250
Jan  9 14:11:35 lakhesis sshd[31144]: Failed password for invalid user mlsmhostnameh from 134.48.5.250 port 52842 ssh2
Jan  9 14:14:35 lakhesis sshd[32198]: Invalid user hta from 134.48.5.250 port 57002
Jan  9 14:14:35 lakhesis sshd[32198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.48.5.250

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=134.48.5.250

2020-01-09 21:44:17

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 134.48.5.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 15323
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;134.48.5.7.			IN	A

;; AUTHORITY SECTION:
.			575	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020022300 1800 900 604800 86400

;; Query time: 125 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Feb 23 21:49:11 CST 2020
;; MSG SIZE  rcvd: 114

Host info

7.5.48.134.in-addr.arpa domain name pointer ubicompgpu.mscs.mu.edu.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
7.5.48.134.in-addr.arpa	name = ubicompgpu.mscs.mu.edu.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
217.74.9.110	attack	WordPress brute force	2019-07-12 21:52:37
73.170.237.204	attack	2019-07-12T13:54:21.868709abusebot-8.cloudsearch.cf sshd\[27304\]: Invalid user wqa from 73.170.237.204 port 40536	2019-07-12 22:18:08
188.0.2.8	attack	Brute force attempt	2019-07-12 21:31:01
193.112.171.144	attackspambots	WordPress brute force	2019-07-12 22:07:00
119.42.175.200	attack	2019-07-12T13:25:01.650885abusebot-4.cloudsearch.cf sshd\[834\]: Invalid user ts3server from 119.42.175.200 port 47818	2019-07-12 21:36:41
117.93.113.103	attack	Caught in portsentry honeypot	2019-07-12 21:37:07
45.122.223.63	attackspam	www.goldgier.de 45.122.223.63 \[12/Jul/2019:13:24:17 +0200\] "POST /wp-login.php HTTP/1.1" 200 8723 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" www.goldgier.de 45.122.223.63 \[12/Jul/2019:13:24:19 +0200\] "POST /wp-login.php HTTP/1.1" 200 8723 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" www.goldgier.de 45.122.223.63 \[12/Jul/2019:13:24:22 +0200\] "POST /wp-login.php HTTP/1.1" 200 8723 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"	2019-07-12 21:48:05
192.241.244.232	attackspambots	Automatic report - Web App Attack	2019-07-12 22:13:05
117.93.112.150	attack	port scan and connect, tcp 8080 (http-proxy)	2019-07-12 22:21:33
213.142.129.165	attackbotsspam	WordPress login Brute force / Web App Attack on client site.	2019-07-12 22:03:14
104.196.16.112	attackbotsspam	Jul 12 14:50:02 MK-Soft-Root2 sshd\[9076\]: Invalid user shadow from 104.196.16.112 port 45536 Jul 12 14:50:02 MK-Soft-Root2 sshd\[9076\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.196.16.112 Jul 12 14:50:04 MK-Soft-Root2 sshd\[9076\]: Failed password for invalid user shadow from 104.196.16.112 port 45536 ssh2 ...	2019-07-12 21:38:44
114.237.109.138	attackspam	Jul 12 12:40:40 elektron postfix/smtpd\[14191\]: NOQUEUE: reject: RCPT from unknown\[114.237.109.138\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[114.237.109.138\]\; from=\ to=\ proto=ESMTP helo=\ Jul 12 12:40:55 elektron postfix/smtpd\[12655\]: NOQUEUE: reject: RCPT from unknown\[114.237.109.138\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[114.237.109.138\]\; from=\ to=\ proto=ESMTP helo=\ Jul 12 12:41:32 elektron postfix/smtpd\[12655\]: NOQUEUE: reject: RCPT from unknown\[114.237.109.138\]: 450 4.7.1 Client host rejected: cannot find your hostname, \[114.237.109.138\]\; from=\ to=\ proto=ESMTP helo=\	2019-07-12 22:01:44
49.204.76.142	attackbotsspam	Jul 12 16:18:26 srv-4 sshd\[29000\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.204.76.142 user=root Jul 12 16:18:28 srv-4 sshd\[29000\]: Failed password for root from 49.204.76.142 port 37253 ssh2 Jul 12 16:24:29 srv-4 sshd\[29632\]: Invalid user ftpuser from 49.204.76.142 Jul 12 16:24:29 srv-4 sshd\[29632\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.204.76.142 ...	2019-07-12 21:40:58
13.95.8.102	attackspambots	Jul 12 08:24:51 vps200512 sshd\[20786\]: Invalid user maggie from 13.95.8.102 Jul 12 08:24:51 vps200512 sshd\[20786\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.95.8.102 Jul 12 08:24:53 vps200512 sshd\[20786\]: Failed password for invalid user maggie from 13.95.8.102 port 32836 ssh2 Jul 12 08:30:11 vps200512 sshd\[20959\]: Invalid user cisco from 13.95.8.102 Jul 12 08:30:11 vps200512 sshd\[20959\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.95.8.102	2019-07-12 21:59:11
114.64.249.90	attack	"POST /shh.php HTTP/1.1" 301 632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36" "POST /nnn.php HTTP/1.1" 301 632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"	2019-07-12 22:32:50

Recently Reported IPs

211.20.144.12	62.210.181.138	3.6.214.6	83.234.14.81
80.210.28.9	185.234.217.60	124.115.135.25	49.89.217.54
23.254.209.173	222.85.232.125	201.150.114.212	178.216.52.105
139.212.58.235	221.220.109.166	1.85.118.107	180.142.153.116
114.241.246.233	114.239.105.249	49.70.209.23	213.16.210.156