139.199.228.154

Basic Info

City: Beijing

Region: Beijing

Country: China

Internet Service Provider: Tencent Cloud Computing (Beijing) Co. Ltd.

Hostname: unknown

Organization: Shenzhen Tencent Computer Systems Company Limited

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	Exploited Host.	2020-07-26 02:24:36
attack	Brute-force attempt banned	2020-06-29 13:36:03
attack	$f2bV_matches	2020-06-13 16:16:57
attack	frenzy	2020-06-07 17:27:33
attackspam	Invalid user uko from 139.199.228.154 port 60180	2020-05-24 02:18:52
attackbots	May 13 08:50:03 ns382633 sshd\[474\]: Invalid user porn from 139.199.228.154 port 54096 May 13 08:50:03 ns382633 sshd\[474\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 May 13 08:50:05 ns382633 sshd\[474\]: Failed password for invalid user porn from 139.199.228.154 port 54096 ssh2 May 13 08:54:24 ns382633 sshd\[1355\]: Invalid user deploy from 139.199.228.154 port 34934 May 13 08:54:24 ns382633 sshd\[1355\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154	2020-05-13 16:14:06
attackspam	k+ssh-bruteforce	2020-05-10 14:26:02
attack	May 4 15:57:12 plex sshd[11844]: Invalid user wh from 139.199.228.154 port 46960	2020-05-05 03:36:46
attack	invalid user	2020-05-03 18:49:36
attack	Invalid user dylan from 139.199.228.154 port 36700	2020-05-01 18:02:48
attackspam	Apr 14 22:41:10 srv-ubuntu-dev3 sshd[35369]: Invalid user bmuuser from 139.199.228.154 Apr 14 22:41:10 srv-ubuntu-dev3 sshd[35369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 Apr 14 22:41:10 srv-ubuntu-dev3 sshd[35369]: Invalid user bmuuser from 139.199.228.154 Apr 14 22:41:12 srv-ubuntu-dev3 sshd[35369]: Failed password for invalid user bmuuser from 139.199.228.154 port 47230 ssh2 Apr 14 22:43:44 srv-ubuntu-dev3 sshd[35742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 user=root Apr 14 22:43:46 srv-ubuntu-dev3 sshd[35742]: Failed password for root from 139.199.228.154 port 45694 ssh2 Apr 14 22:46:04 srv-ubuntu-dev3 sshd[36141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 user=root Apr 14 22:46:07 srv-ubuntu-dev3 sshd[36141]: Failed password for root from 139.199.228.154 port 44150 ssh2 Apr 14 22:48:34 srv- ...	2020-04-15 06:54:20
attackspam	SSH Invalid Login	2020-04-12 07:19:03
attackspambots	Mar 29 03:32:44 firewall sshd[2447]: Invalid user yev from 139.199.228.154 Mar 29 03:32:46 firewall sshd[2447]: Failed password for invalid user yev from 139.199.228.154 port 33242 ssh2 Mar 29 03:39:38 firewall sshd[2785]: Invalid user rica from 139.199.228.154 ...	2020-03-29 17:02:55
attackspambots	20 attempts against mh-ssh on echoip	2020-03-25 02:04:07
attackspam	Feb 12 22:32:46 server sshd\[17178\]: Invalid user aqjava from 139.199.228.154 Feb 12 22:32:46 server sshd\[17178\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 Feb 12 22:32:48 server sshd\[17178\]: Failed password for invalid user aqjava from 139.199.228.154 port 56226 ssh2 Feb 13 12:01:38 server sshd\[30434\]: Invalid user catego from 139.199.228.154 Feb 13 12:01:38 server sshd\[30434\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 ...	2020-02-13 19:11:56
attackbots	$f2bV_matches	2020-02-07 02:33:43
attackbots	SSH invalid-user multiple login try	2020-01-29 14:11:15
attackbots	Unauthorized connection attempt detected from IP address 139.199.228.154 to port 2220 [J]	2020-01-16 16:54:15
attackbotsspam	$f2bV_matches	2020-01-12 00:15:52
attackspambots	2019-11-16T15:56:33.204483abusebot-3.cloudsearch.cf sshd\[12864\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 user=root	2019-11-17 00:11:55
attackspambots	Nov 16 09:29:56 MK-Soft-VM7 sshd[15900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 Nov 16 09:29:58 MK-Soft-VM7 sshd[15900]: Failed password for invalid user nandan from 139.199.228.154 port 54858 ssh2 ...	2019-11-16 16:35:10
attackspambots	Nov 15 15:35:18 meumeu sshd[5765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 Nov 15 15:35:20 meumeu sshd[5765]: Failed password for invalid user siuta from 139.199.228.154 port 56232 ssh2 Nov 15 15:41:34 meumeu sshd[6537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.154 ...	2019-11-16 02:19:00
attackspam	web-1 [ssh] SSH Attack	2019-11-15 05:39:47
attack	Nov 12 05:38:01 firewall sshd[30703]: Invalid user thorerik from 139.199.228.154 Nov 12 05:38:03 firewall sshd[30703]: Failed password for invalid user thorerik from 139.199.228.154 port 59338 ssh2 Nov 12 05:42:27 firewall sshd[30858]: Invalid user nivea from 139.199.228.154 ...	2019-11-12 17:06:40
attackspam	2019-08-16T21:59:57.419128abusebot-8.cloudsearch.cf sshd\[24642\]: Invalid user postgres from 139.199.228.154 port 54340	2019-08-17 06:02:53
attack	kp-sea2-01 recorded 2 login violations from 139.199.228.154 and was blocked at 2019-07-06 05:50:13. 139.199.228.154 has been blocked on 21 previous occasions. 139.199.228.154's first attempt was recorded at 2019-05-15 18:26:23	2019-07-06 15:59:48

Comments on same subnet:

IP	Type	Details	Datetime
139.199.228.133	attackbots	Oct 9 00:11:50 slaro sshd\[11211\]: Invalid user cron from 139.199.228.133 Oct 9 00:11:50 slaro sshd\[11211\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.133 Oct 9 00:11:53 slaro sshd\[11211\]: Failed password for invalid user cron from 139.199.228.133 port 12623 ssh2 ...	2020-10-09 06:46:27
139.199.228.133	attackspam	Oct 08 08:08:17 askasleikir sshd[43451]: Failed password for root from 139.199.228.133 port 28627 ssh2 Oct 08 08:13:33 askasleikir sshd[43485]: Failed password for root from 139.199.228.133 port 50069 ssh2	2020-10-08 23:09:21
139.199.228.133	attackspambots	Oct 8 08:45:15 buvik sshd[20213]: Failed password for root from 139.199.228.133 port 20378 ssh2 Oct 8 08:47:29 buvik sshd[20456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.133 user=root Oct 8 08:47:31 buvik sshd[20456]: Failed password for root from 139.199.228.133 port 33133 ssh2 ...	2020-10-08 15:04:38
139.199.228.133	attackbotsspam	[f2b] sshd bruteforce, retries: 1	2020-09-13 02:26:52
139.199.228.133	attack	...	2020-09-12 18:29:36
139.199.228.133	attackspam	SSH bruteforce	2020-09-09 03:36:03
139.199.228.133	attack	Sep 8 09:22:58 prox sshd[16697]: Failed password for root from 139.199.228.133 port 9016 ssh2	2020-09-08 19:14:22
139.199.228.133	attackspambots	Aug 31 13:32:34 django-0 sshd[27253]: Invalid user steam from 139.199.228.133 ...	2020-08-31 22:59:51
139.199.228.133	attackbots	Invalid user gilbert from 139.199.228.133 port 39354	2020-08-31 18:42:13
139.199.228.133	attackspam	Invalid user gilbert from 139.199.228.133 port 39354	2020-08-31 07:10:35
139.199.228.133	attackbots	Aug 19 11:53:15 vpn01 sshd[23299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.228.133 Aug 19 11:53:17 vpn01 sshd[23299]: Failed password for invalid user admin from 139.199.228.133 port 26786 ssh2 ...	2020-08-19 18:32:43
139.199.228.133	attackbots	SSH BruteForce Attack	2020-08-13 13:23:37
139.199.228.133	attackspambots	Aug 11 03:50:59 *** sshd[19498]: User root from 139.199.228.133 not allowed because not listed in AllowUsers	2020-08-11 17:17:16
139.199.228.133	attackbotsspam	Connection to SSH Honeypot - Detected by HoneypotDB	2020-08-07 16:54:14
139.199.228.133	attackspam	2020-07-30T05:51:59.494801centos sshd[11517]: Invalid user tym from 139.199.228.133 port 32224 2020-07-30T05:52:01.063348centos sshd[11517]: Failed password for invalid user tym from 139.199.228.133 port 32224 ssh2 2020-07-30T05:55:49.411446centos sshd[11728]: Invalid user yanze from 139.199.228.133 port 51714 ...	2020-07-30 12:33:21

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 139.199.228.154
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 6292
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;139.199.228.154.		IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019050200 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Thu May 02 20:08:41 +08 2019
;; MSG SIZE  rcvd: 119

Host info

Host 154.228.199.139.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

** server can't find 154.228.199.139.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
198.71.239.36	attack	WP_xmlrpc_attack	2019-06-29 15:02:53
89.46.105.154	attackspam	89.46.105.154 - - [28/Jun/2019:14:14:03 -0500] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 301 259 - "-" "-" 89.46.105.154 - - [28/Jun/2019:14:14:04 -0500] "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" 404 230 on "-" "-"	2019-06-29 15:23:02
92.119.160.11	attack	Jun 29 07:11:36 TCP Attack: SRC=92.119.160.11 DST=[Masked] LEN=40 TOS=0x08 PREC=0x20 TTL=240 PROTO=TCP SPT=50155 DPT=11667 WINDOW=1024 RES=0x00 SYN URGP=0	2019-06-29 15:14:02
27.147.130.67	attack	Invalid user allan from 27.147.130.67 port 34168 pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.147.130.67 Failed password for invalid user allan from 27.147.130.67 port 34168 ssh2 Invalid user uftp from 27.147.130.67 port 39636 pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.147.130.67	2019-06-29 15:07:02
89.40.115.49	attackspambots	Lines containing failures of 89.40.115.49 Jun 28 08:45:13 hvs postfix/smtpd[3935]: warning: hostname host49-115-40-89.static.arubacloud.fr does not resolve to address 89.40.115.49 Jun 28 08:45:13 hvs postfix/smtpd[3935]: connect from unknown[89.40.115.49] Jun x@x Jun 28 08:45:14 hvs postfix/smtpd[3935]: disconnect from unknown[89.40.115.49] ehlo=1 mail=1 rcpt=0/1 data=0/1 eclipset=1 quhostname=1 commands=4/6 Jun 28 09:10:29 hvs postfix/smtpd[4103]: warning: hostname host49-115-40-89.static.arubacloud.fr does not resolve to address 89.40.115.49 Jun 28 09:10:29 hvs postfix/smtpd[4103]: connect from unknown[89.40.115.49] Jun x@x Jun 28 09:10:30 hvs postfix/smtpd[4103]: disconnect from unknown[89.40.115.49] ehlo=1 mail=1 rcpt=0/1 data=0/1 eclipset=1 quhostname=1 commands=4/6 Jun 28 09:52:53 hvs postfix/smtpd[4389]: warning: hostname host49-115-40-89.static.arubacloud.fr does not resolve to address 89.40.115.49 Jun 28 09:52:53 hvs postfix/smtpd[4389]: connect from unknown[89......... ------------------------------	2019-06-29 15:29:21
31.185.104.20	attack	Jun 29 01:07:12 vps sshd[27841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.185.104.20 Jun 29 01:07:14 vps sshd[27841]: Failed password for invalid user guest from 31.185.104.20 port 34073 ssh2 Jun 29 01:07:17 vps sshd[27841]: Failed password for invalid user guest from 31.185.104.20 port 34073 ssh2 Jun 29 01:07:20 vps sshd[27850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.185.104.20 ...	2019-06-29 15:46:58
27.8.233.60	attack	TCP port 23 (Telnet) attempt blocked by firewall. [2019-06-29 01:07:48]	2019-06-29 15:05:09
186.206.134.122	attackbots	Jun 28 20:32:05 carla sshd[27971]: reveeclipse mapping checking getaddrinfo for bace867a.virtua.com.br [186.206.134.122] failed - POSSIBLE BREAK-IN ATTEMPT! Jun 28 20:32:05 carla sshd[27971]: Invalid user sysadmin from 186.206.134.122 Jun 28 20:32:05 carla sshd[27971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.206.134.122 Jun 28 20:32:07 carla sshd[27971]: Failed password for invalid user sysadmin from 186.206.134.122 port 56082 ssh2 Jun 28 20:32:07 carla sshd[27972]: Received disconnect from 186.206.134.122: 11: Bye Bye Jun 28 20:35:57 carla sshd[27981]: reveeclipse mapping checking getaddrinfo for bace867a.virtua.com.br [186.206.134.122] failed - POSSIBLE BREAK-IN ATTEMPT! Jun 28 20:35:57 carla sshd[27981]: Invalid user super from 186.206.134.122 Jun 28 20:35:57 carla sshd[27981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.206.134.122 Jun 28 20:35:59 carla sshd[27981]:........ -------------------------------	2019-06-29 15:40:27
183.89.82.33	attack	Jun 29 00:57:38 master sshd[22263]: Failed password for invalid user admin from 183.89.82.33 port 33747 ssh2	2019-06-29 15:28:41
112.14.32.207	attackspambots	Jun 7 09:37:58 mercury auth[27085]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=josh@learnargentinianspanish.com rhost=112.14.32.207 ...	2019-06-29 15:33:27
157.55.39.221	attack	SQL injection:/index.php?menu_selected=143&language=150&sub_menu_selected=988&random=true&random=true&random=true&random=true&random=true&random=true&random=true&name=&name=&name=&name=&name=&name=&name=&name=&name=&name=&name=&name=&name=	2019-06-29 15:15:01
116.118.122.108	attackbotsspam	Jun 29 00:18:52 master sshd[22209]: Failed password for invalid user admin from 116.118.122.108 port 42802 ssh2	2019-06-29 15:17:45
202.43.168.66	attackspam	Jun 29 01:08:40 mail postfix/smtpd\[15494\]: NOQUEUE: reject: RCPT from unknown\[202.43.168.66\]: 554 5.7.1 Service unavailable\; Client host \[202.43.168.66\] blocked using zen.spamhaus.org\; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/202.43.168.66\; from=\ to=\ proto=ESMTP helo=\<\[185.180.222.147\]\>\ Jun 29 01:08:40 mail postfix/smtpd\[15494\]: NOQUEUE: reject: RCPT from unknown\[202.43.168.66\]: 554 5.7.1 Service unavailable\; Client host \[202.43.168.66\] blocked using zen.spamhaus.org\; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/202.43.168.66\; from=\ to=\ proto=ESMTP helo=\<\[185.180.222.147\]\>\ Jun 29 01:08:40 mail postfix/smtpd\[15494\]: NOQUEUE: reject: RCPT from unknown\[202.43.168.66\]: 554 5.7.1 Service unavailable\; Client host \[202.43.168.66\] blocked using zen.spamhaus.org\; https://www.spamhaus.org/sbl/query/SBLCSS /	2019-06-29 15:13:03
134.175.23.46	attack	Jun 29 07:58:45 localhost sshd\[51315\]: Invalid user l4d2server from 134.175.23.46 port 41346 Jun 29 07:58:45 localhost sshd\[51315\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.23.46 ...	2019-06-29 15:02:01
111.246.6.52	attackbotsspam	Honeypot attack, port: 23, PTR: 111-246-6-52.dynamic-ip.hinet.net.	2019-06-29 14:56:50

Recently Reported IPs

77.180.23.220	192.30.162.22	187.146.198.73	91.210.147.145
24.80.229.206	91.200.126.90	128.112.240.111	190.236.239.224
49.149.249.27	24.24.222.22	126.122.77.186	91.61.45.13
210.51.165.118	205.183.211.119	145.89.140.198	91.23.34.43
87.241.172.40	151.63.89.149	202.51.91.160	49.82.140.75