138.0.254.174 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Brazil

Internet Service Provider: Assunet Ltda - ME

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	Excessive failed login attempts on port 587	2019-08-27 19:13:28

Comments on same subnet:

IP	Type	Details	Datetime
138.0.254.130	attackspam	Sep 29 10:45:03 host postfix/smtps/smtpd\[2999\]: warning: unknown\[138.0.254.130\]: SASL PLAIN authentication failed:	2020-09-30 01:49:30
138.0.254.130	attackbotsspam	Sep 29 10:45:03 host postfix/smtps/smtpd\[2999\]: warning: unknown\[138.0.254.130\]: SASL PLAIN authentication failed:	2020-09-29 17:49:21
138.0.254.182	attackbots	Unauthorized connection attempt from IP address 138.0.254.182 on Port 465(SMTPS)	2020-08-31 22:57:30
138.0.254.204	attack	(smtpauth) Failed SMTP AUTH login from 138.0.254.204 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-28 08:22:26 plain authenticator failed for ([138.0.254.204]) [138.0.254.204]: 535 Incorrect authentication data (set_id=adabavazeh@nazeranyekta.com)	2020-07-28 16:55:56
138.0.254.204	attack	Brute force attempt	2020-07-25 15:29:58
138.0.254.65	attackspam	138.0.254.65 (BR/Brazil/-), 10 distributed smtpauth attacks on account [info] in the last 3600 secs; ID: DAN	2020-07-08 02:01:53
138.0.254.40	attackspam	Jun 16 08:34:52 mail.srvfarm.net postfix/smtps/smtpd[1063772]: warning: unknown[138.0.254.40]: SASL PLAIN authentication failed: Jun 16 08:34:52 mail.srvfarm.net postfix/smtps/smtpd[1063772]: lost connection after AUTH from unknown[138.0.254.40] Jun 16 08:38:49 mail.srvfarm.net postfix/smtpd[1067539]: lost connection after CONNECT from unknown[138.0.254.40] Jun 16 08:44:09 mail.srvfarm.net postfix/smtpd[1072325]: warning: unknown[138.0.254.40]: SASL PLAIN authentication failed: Jun 16 08:44:10 mail.srvfarm.net postfix/smtpd[1072325]: lost connection after AUTH from unknown[138.0.254.40]	2020-06-16 17:25:01
138.0.254.73	attackspambots	Brute force attempt	2020-06-07 17:48:11
138.0.254.111	attackspam	Unauthorized SMTP/IMAP/POP3 connection attempt	2019-09-11 13:10:38
138.0.254.103	attackspambots	$f2bV_matches	2019-09-02 23:12:01
138.0.254.41	attack	failed_logins	2019-08-30 01:57:54

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 138.0.254.174
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 61278
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;138.0.254.174.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019082601 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Tue Aug 27 19:13:23 CST 2019
;; MSG SIZE  rcvd: 117

Host info

Host 174.254.0.138.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 174.254.0.138.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
129.211.29.208	attack	Sep 22 05:52:07 v22019058497090703 sshd[16729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.29.208 Sep 22 05:52:08 v22019058497090703 sshd[16729]: Failed password for invalid user vps from 129.211.29.208 port 33178 ssh2 Sep 22 05:57:14 v22019058497090703 sshd[17282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.211.29.208 ...	2019-09-22 12:36:49
149.56.100.237	attack	Sep 21 17:52:50 tdfoods sshd\[22515\]: Invalid user ju from 149.56.100.237 Sep 21 17:52:50 tdfoods sshd\[22515\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=237.ip-149-56-100.net Sep 21 17:52:52 tdfoods sshd\[22515\]: Failed password for invalid user ju from 149.56.100.237 port 37378 ssh2 Sep 21 17:57:22 tdfoods sshd\[22905\]: Invalid user student from 149.56.100.237 Sep 21 17:57:22 tdfoods sshd\[22905\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=237.ip-149-56-100.net	2019-09-22 12:32:04
193.32.160.136	attack	Sep 22 05:56:40 webserver postfix/smtpd\[17498\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.136\]: 454 4.7.1 \: Relay access denied\; from=\<9huskssv9lp5z9@colormusic.ru\> to=\ proto=ESMTP helo=\<\[193.32.160.145\]\> Sep 22 05:56:40 webserver postfix/smtpd\[17498\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.136\]: 454 4.7.1 \: Relay access denied\; from=\<9huskssv9lp5z9@colormusic.ru\> to=\ proto=ESMTP helo=\<\[193.32.160.145\]\> Sep 22 05:56:40 webserver postfix/smtpd\[17498\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.136\]: 454 4.7.1 \: Relay access denied\; from=\<9huskssv9lp5z9@colormusic.ru\> to=\ proto=ESMTP helo=\<\[193.32.160.145\]\> Sep 22 05:56:40 webserver postfix/smtpd\[17498\]: NOQUEUE: reject: RCPT from unknown\[193.32.160.136\]: 454 4.7.1 \: Relay access denied\; from=\<9h ...	2019-09-22 13:03:02
185.244.215.211	attackbots	Sep 22 05:57:09 h2177944 kernel: \[2000973.768919\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.244.215.211 DST=85.214.117.9 LEN=52 TOS=0x02 PREC=0x00 TTL=54 ID=6446 DF PROTO=TCP SPT=60187 DPT=444 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 Sep 22 05:57:09 h2177944 kernel: \[2000973.770433\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.244.215.211 DST=85.214.117.9 LEN=52 TOS=0x02 PREC=0x00 TTL=54 ID=6447 DF PROTO=TCP SPT=60188 DPT=442 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 Sep 22 05:57:09 h2177944 kernel: \[2000974.242869\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.244.215.211 DST=85.214.117.9 LEN=52 TOS=0x02 PREC=0x00 TTL=54 ID=6456 DF PROTO=TCP SPT=60295 DPT=441 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 Sep 22 05:57:09 h2177944 kernel: \[2000974.288244\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=185.244.215.211 DST=85.214.117.9 LEN=52 TOS=0x02 PREC=0x00 TTL=54 ID=6457 DF PROTO=TCP SPT=60315 DPT=439 WINDOW=8192 RES=0x00 CWR ECE SYN URGP=0 Sep 22 05:57:09 h2177944 kernel: \[2000974.294146\] \[UFW BLOCK\] IN=venet0 OUT=	2019-09-22 12:41:23
221.122.67.66	attack	Invalid user yyy from 221.122.67.66 port 52818	2019-09-22 13:00:28
167.114.145.139	attackbots	Invalid user oki from 167.114.145.139 port 45500	2019-09-22 13:07:28
51.75.126.115	attackspambots	Sep 22 00:32:09 debian sshd\[2549\]: Invalid user ubnt from 51.75.126.115 port 34414 Sep 22 00:32:09 debian sshd\[2549\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.126.115 Sep 22 00:32:10 debian sshd\[2549\]: Failed password for invalid user ubnt from 51.75.126.115 port 34414 ssh2 ...	2019-09-22 12:38:34
120.52.152.16	attackbotsspam	104/tcp 5555/tcp 162/tcp... [2019-07-22/09-22]1712pkt,316pt.(tcp)	2019-09-22 13:03:50
41.111.135.196	attackspambots	Sep 21 18:20:46 hpm sshd\[9562\]: Invalid user lms from 41.111.135.196 Sep 21 18:20:46 hpm sshd\[9562\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.111.135.196 Sep 21 18:20:47 hpm sshd\[9562\]: Failed password for invalid user lms from 41.111.135.196 port 57018 ssh2 Sep 21 18:24:42 hpm sshd\[9948\]: Invalid user gk from 41.111.135.196 Sep 21 18:24:42 hpm sshd\[9948\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.111.135.196	2019-09-22 12:30:38
123.207.167.233	attackbotsspam	Sep 21 18:23:20 auw2 sshd\[22508\]: Invalid user ghost from 123.207.167.233 Sep 21 18:23:20 auw2 sshd\[22508\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.167.233 Sep 21 18:23:22 auw2 sshd\[22508\]: Failed password for invalid user ghost from 123.207.167.233 port 42504 ssh2 Sep 21 18:28:41 auw2 sshd\[23074\]: Invalid user rabbitmq from 123.207.167.233 Sep 21 18:28:41 auw2 sshd\[23074\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.167.233	2019-09-22 12:59:31
207.154.239.128	attack	$f2bV_matches	2019-09-22 12:39:57
188.226.226.82	attackbots	Sep 22 06:15:25 meumeu sshd[28379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.226.226.82 Sep 22 06:15:27 meumeu sshd[28379]: Failed password for invalid user Administrator from 188.226.226.82 port 58160 ssh2 Sep 22 06:19:53 meumeu sshd[538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.226.226.82 ...	2019-09-22 12:36:24
118.24.178.224	attack	Sep 22 06:47:50 docs sshd\[48504\]: Invalid user astrogildo from 118.24.178.224Sep 22 06:47:51 docs sshd\[48504\]: Failed password for invalid user astrogildo from 118.24.178.224 port 58456 ssh2Sep 22 06:52:12 docs sshd\[48777\]: Invalid user M from 118.24.178.224Sep 22 06:52:14 docs sshd\[48777\]: Failed password for invalid user M from 118.24.178.224 port 33592 ssh2Sep 22 06:56:35 docs sshd\[48854\]: Invalid user ADMINISTRATOR from 118.24.178.224Sep 22 06:56:37 docs sshd\[48854\]: Failed password for invalid user ADMINISTRATOR from 118.24.178.224 port 37010 ssh2 ...	2019-09-22 12:57:28
190.249.131.5	attack	Sep 22 06:45:26 MK-Soft-VM4 sshd[2081]: Failed password for proxy from 190.249.131.5 port 54803 ssh2 ...	2019-09-22 12:52:42
81.147.105.145	attackbots	Automatic report - Port Scan Attack	2019-09-22 12:31:36

Recently Reported IPs

195.158.250.221	87.195.203.140	112.135.146.165	149.129.251.229
206.165.65.46	167.225.34.20	38.122.240.200	125.76.225.11
149.195.192.151	117.249.157.225	57.175.227.3	113.71.192.218
116.216.99.124	24.187.204.172	156.143.251.160	74.27.239.123
162.243.116.224	123.235.246.229	242.211.179.89	187.163.126.189