138.68.30.2 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	138.68.30.2 - - \[28/Dec/2019:20:38:27 +0100\] "POST /wp-login.php HTTP/1.0" 200 3080 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 138.68.30.2 - - \[28/Dec/2019:20:38:29 +0100\] "POST /wp-login.php HTTP/1.0" 200 3039 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 138.68.30.2 - - \[28/Dec/2019:20:38:32 +0100\] "POST /wp-login.php HTTP/1.0" 200 3048 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2019-12-29 06:02:51
attack	Automatic report - Banned IP Access	2019-11-26 00:59:16
attack	11/24/2019-07:29:55.129981 138.68.30.2 Protocol: 6 ET POLICY Cleartext WordPress Login	2019-11-24 14:45:51
attack	WordPress wp-login brute force :: 138.68.30.2 0.116 BYPASS [24/Oct/2019:14:45:53 1100] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2019-10-24 18:35:47
attack	plussize.fitness 138.68.30.2 \[20/Sep/2019:01:05:51 +0200\] "POST /wp-login.php HTTP/1.1" 200 5629 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" plussize.fitness 138.68.30.2 \[20/Sep/2019:01:05:52 +0200\] "POST /wp-login.php HTTP/1.1" 200 5582 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2019-09-20 09:02:58

Comments on same subnet:

IP	Type	Details	Datetime
138.68.30.68	attackbots	53413/udp 53413/udp 53413/udp... [2019-10-21/11-21]1223pkt,1pt.(udp)	2019-11-21 19:51:21
138.68.30.68	attack	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-10 19:55:08
138.68.30.68	attack	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-07 01:08:00
138.68.30.68	attackbots	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-01 00:43:09
138.68.30.68	attack	MultiHost/MultiPort Probe, Scan, Hack -	2019-10-30 20:32:01

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 138.68.30.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28306
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;138.68.30.2.			IN	A

;; AUTHORITY SECTION:
.			526	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019091902 1800 900 604800 86400

;; Query time: 423 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Sep 20 09:02:55 CST 2019
;; MSG SIZE  rcvd: 115

Host info

2.30.68.138.in-addr.arpa domain name pointer server.waydata.cloud.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
2.30.68.138.in-addr.arpa	name = server.waydata.cloud.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
190.116.177.61	attack	Unauthorized connection attempt from IP address 190.116.177.61 on Port 445(SMB)	2019-12-19 06:15:09
68.183.193.46	attack	Dec 18 17:24:52 plusreed sshd[8140]: Invalid user anju from 68.183.193.46 ...	2019-12-19 06:27:45
93.107.97.213	attackspambots	Unauthorized connection attempt from IP address 93.107.97.213 on Port 445(SMB)	2019-12-19 06:03:56
118.70.72.103	attackbotsspam	Dec 18 14:04:24 vtv3 sshd[30955]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.72.103 Dec 18 14:04:26 vtv3 sshd[30955]: Failed password for invalid user scydayah from 118.70.72.103 port 48856 ssh2 Dec 18 14:11:05 vtv3 sshd[2133]: Failed password for backup from 118.70.72.103 port 59888 ssh2 Dec 18 15:18:24 vtv3 sshd[1486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.72.103 Dec 18 15:18:26 vtv3 sshd[1486]: Failed password for invalid user jacquie from 118.70.72.103 port 36378 ssh2 Dec 18 15:25:19 vtv3 sshd[5011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.72.103 Dec 18 15:39:09 vtv3 sshd[11752]: Failed password for root from 118.70.72.103 port 60534 ssh2 Dec 18 15:46:10 vtv3 sshd[15176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.70.72.103 Dec 18 15:46:12 vtv3 sshd[15176]: Failed password for invalid user ad	2019-12-19 05:53:34
51.255.168.127	attack	k+ssh-bruteforce	2019-12-19 06:31:24
202.83.17.223	attackspambots	2019-12-18T19:06:32.083516Z 6b71a5c399e5 New connection: 202.83.17.223:49708 (172.17.0.5:2222) [session: 6b71a5c399e5] 2019-12-18T19:13:46.845658Z a814bd65835e New connection: 202.83.17.223:32860 (172.17.0.5:2222) [session: a814bd65835e]	2019-12-19 06:07:29
221.132.85.120	attackspam	$f2bV_matches	2019-12-19 06:25:49
40.92.5.22	attackspam	Dec 18 17:58:26 debian-2gb-vpn-nbg1-1 kernel: [1059470.724362] [UFW BLOCK] IN=eth0 OUT= MAC=96:00:00:38:96:44:d2:74:7f:6e:37:e3:08:00 SRC=40.92.5.22 DST=78.46.192.101 LEN=40 TOS=0x00 PREC=0x00 TTL=232 ID=29633 DF PROTO=TCP SPT=32398 DPT=25 WINDOW=0 RES=0x00 ACK RST URGP=0	2019-12-19 06:11:51
190.105.49.197	attackspambots	Unauthorized connection attempt from IP address 190.105.49.197 on Port 445(SMB)	2019-12-19 06:23:12
54.37.21.211	attackbots	Automatic report - XMLRPC Attack	2019-12-19 06:08:43
178.128.81.60	attackbotsspam	Dec 18 19:58:27 minden010 sshd[31585]: Failed password for root from 178.128.81.60 port 58018 ssh2 Dec 18 20:04:21 minden010 sshd[6514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.81.60 Dec 18 20:04:23 minden010 sshd[6514]: Failed password for invalid user nashalie from 178.128.81.60 port 36604 ssh2 ...	2019-12-19 06:06:22
105.112.97.174	attackspam	Unauthorized connection attempt detected from IP address 105.112.97.174 to port 445	2019-12-19 06:12:33
195.84.49.20	attackspam	$f2bV_matches	2019-12-19 05:54:14
37.49.230.63	attack	\[2019-12-18 16:56:21\] NOTICE\[2839\] chan_sip.c: Registration from '"1001" \' failed for '37.49.230.63:5589' - Wrong password \[2019-12-18 16:56:21\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-18T16:56:21.912-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1001",SessionID="0x7f0fb4234468",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.63/5589",Challenge="111feeed",ReceivedChallenge="111feeed",ReceivedHash="5ba726f739328f596cefb72550668ea2" \[2019-12-18 16:56:22\] NOTICE\[2839\] chan_sip.c: Registration from '"1001" \' failed for '37.49.230.63:5589' - Wrong password \[2019-12-18 16:56:22\] SECURITY\[2857\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-12-18T16:56:22.059-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1001",SessionID="0x7f0fb46c6168",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3	2019-12-19 06:00:15
95.216.69.22	attackspam	Unauthorized IMAP connection attempt	2019-12-19 06:24:22

Recently Reported IPs

112.93.179.29	60.177.20.184	197.230.162.139	64.52.109.3
223.92.103.179	157.48.13.106	36.72.84.55	99.91.17.49
183.82.2.251	117.99.94.72	52.152.101.182	40.112.220.142
210.96.71.209	51.36.79.141	116.3.100.201	81.129.137.222
125.105.25.151	89.151.252.102	134.255.89.120	204.169.189.224