City: Beijing
Region: Beijing
Country: China
Internet Service Provider: Tencent Cloud Computing (Beijing) Co. Ltd.
Hostname: unknown
Organization: Shenzhen Tencent Computer Systems Company Limited
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attackspambots | Feb 23 03:22:13 motanud sshd\[30052\]: Invalid user andrew from 139.199.34.112 port 33302 Feb 23 03:22:13 motanud sshd\[30052\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.112 Feb 23 03:22:15 motanud sshd\[30052\]: Failed password for invalid user andrew from 139.199.34.112 port 33302 ssh2 |
2019-08-04 14:42:56 |
| attackspambots | SSH-BruteForce |
2019-07-31 14:25:08 |
| attack | Invalid user vsftpd from 139.199.34.112 port 55342 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.112 Failed password for invalid user vsftpd from 139.199.34.112 port 55342 ssh2 Invalid user anna from 139.199.34.112 port 36992 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.112 |
2019-06-30 12:46:36 |
| IP | Type | Details | Datetime |
|---|---|---|---|
| 139.199.34.54 | attackbots | May 2 09:56:18 santamaria sshd\[22903\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 user=root May 2 09:56:20 santamaria sshd\[22903\]: Failed password for root from 139.199.34.54 port 26637 ssh2 May 2 10:01:24 santamaria sshd\[22997\]: Invalid user vel from 139.199.34.54 May 2 10:01:24 santamaria sshd\[22997\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 ... |
2020-05-02 16:24:21 |
| 139.199.34.54 | attackspam | Apr 30 16:04:41 webhost01 sshd[21041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 Apr 30 16:04:43 webhost01 sshd[21041]: Failed password for invalid user ratna from 139.199.34.54 port 30154 ssh2 ... |
2020-04-30 17:33:19 |
| 139.199.34.54 | attackbotsspam | Apr 27 06:03:20 h2646465 sshd[789]: Invalid user gene from 139.199.34.54 Apr 27 06:03:20 h2646465 sshd[789]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 Apr 27 06:03:20 h2646465 sshd[789]: Invalid user gene from 139.199.34.54 Apr 27 06:03:22 h2646465 sshd[789]: Failed password for invalid user gene from 139.199.34.54 port 64556 ssh2 Apr 27 06:14:52 h2646465 sshd[2284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 user=root Apr 27 06:14:54 h2646465 sshd[2284]: Failed password for root from 139.199.34.54 port 45286 ssh2 Apr 27 06:17:48 h2646465 sshd[2869]: Invalid user ubuntu from 139.199.34.54 Apr 27 06:17:48 h2646465 sshd[2869]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 Apr 27 06:17:48 h2646465 sshd[2869]: Invalid user ubuntu from 139.199.34.54 Apr 27 06:17:51 h2646465 sshd[2869]: Failed password for invalid user ubuntu from 139.199.34. |
2020-04-27 12:48:11 |
| 139.199.34.54 | attack | Apr 18 13:25:30 lanister sshd[31799]: Failed password for invalid user ubuntu from 139.199.34.54 port 11170 ssh2 Apr 18 13:42:23 lanister sshd[32150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 user=postgres Apr 18 13:42:25 lanister sshd[32150]: Failed password for postgres from 139.199.34.54 port 16947 ssh2 Apr 18 13:49:02 lanister sshd[32260]: Invalid user xv from 139.199.34.54 |
2020-04-19 02:03:48 |
| 139.199.34.54 | attack | Apr 16 14:09:38 eventyay sshd[3617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 Apr 16 14:09:41 eventyay sshd[3617]: Failed password for invalid user demo from 139.199.34.54 port 39839 ssh2 Apr 16 14:12:40 eventyay sshd[3726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.34.54 ... |
2020-04-16 23:54:12 |
| 139.199.34.54 | attackspam | leo_www |
2020-04-07 13:30:08 |
| 139.199.34.54 | attackbots | Automatic report - SSH Brute-Force Attack |
2020-03-12 03:37:11 |
| 139.199.34.54 | attackbotsspam | Invalid user cpaneleximfilter from 139.199.34.54 port 11931 |
2020-03-11 17:17:46 |
| 139.199.34.54 | attackspambots | SSH bruteforce (Triggered fail2ban) |
2020-03-08 20:26:30 |
| 139.199.34.54 | attack | suspicious action Wed, 26 Feb 2020 15:32:50 -0300 |
2020-02-27 03:30:23 |
| 139.199.34.54 | attackspambots | Invalid user ivan from 139.199.34.54 port 38183 |
2020-02-18 16:33:02 |
| 139.199.34.191 | attack | [SatNov1615:51:48.0385302019][:error][pid2258:tid140571762964224][client139.199.34.191:24201][client139.199.34.191]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\\(chr\?\\\\\\\\\(\?[0-9]{1\,3}\?\\\\\\\\\)\|\?=\?f\(\?:open\|write\)\?\\\\\\\\\(\|\\\\\\\\b\(\?:passthru\|serialize\|php_uname\|phpinfo\|shell_exec\|preg_\\\\\\\\w \|mysql_query\|exec\|eval\|base64_decode\|decode_base64\|rot13\|base64_url_decode\|gz\(\?:inflate\|decode\|uncompress\)\|strrev\|zlib_\\\\\\\\w \)\\\\\\\\b\?\(\?..."atARGS:admin.[file"/usr/local/apache.ea3/conf/modsec_rules/10_asl_rules.conf"][line"767"][id"340095"][rev"53"][msg"Atomicorp.comWAFRules:AttackBlocked-PHPfunctioninArgument-thismaybeanattack."][data"die\(@md5\,ARGS:admin"][severity"CRITICAL"][hostname"81.17.25.237"][uri"/App.php"][unique_id"XdANBES@OZ7eHP60T7GfSAAAANE"][SatNov1615:52:11.3014982019][:error][pid2171:tid140571855283968][client139.199.34.191:28165][client139.199.34.191]ModSecurity:Accessdeniedwithcode403\(phase2\).Patt |
2019-11-16 23:31:16 |
| 139.199.34.191 | attackspam | ECShop Remote Code Execution Vulnerability, PTR: PTR record not found |
2019-09-08 19:53:02 |
b
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 139.199.34.112
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31303
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;139.199.34.112. IN A
;; AUTHORITY SECTION:
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019040903 1800 900 604800 86400
;; Query time: 71 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Wed Apr 10 10:28:04 +08 2019
;; MSG SIZE rcvd: 118
Host 112.34.199.139.in-addr.arpa. not found: 3(NXDOMAIN)
Server: 67.207.67.3
Address: 67.207.67.3#53
** server can't find 112.34.199.139.in-addr.arpa: NXDOMAIN
| IP | Type | Details | Datetime |
|---|---|---|---|
| 113.21.99.66 | attackspam | Autoban 113.21.99.66 ABORTED AUTH |
2020-04-24 00:44:12 |
| 91.121.183.15 | attackbots | 91.121.183.15 - - [23/Apr/2020:18:32:52 +0200] "POST /wp-login.php HTTP/1.1" 200 5338 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" 91.121.183.15 - - [23/Apr/2020:18:32:52 +0200] "POST /wp-login.php HTTP/1.1" 200 5338 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" 91.121.183.15 - - [23/Apr/2020:18:32:52 +0200] "POST /wp-login.php HTTP/1.1" 200 5338 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" 91.121.183.15 - - [23/Apr/2020:18:32:52 +0200] "POST /wp-login.php HTTP/1.1" 200 5338 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" 91.121.183.15 - - [23/Apr/2020:18:32:52 +0200] "POST /wp-login.php HTTP/1.1" 200 5338 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safar ... |
2020-04-24 00:41:36 |
| 39.62.171.55 | attackspambots | Attempted connection to port 445. |
2020-04-24 01:11:31 |
| 218.1.38.226 | attack | Unauthorized connection attempt from IP address 218.1.38.226 on Port 445(SMB) |
2020-04-24 01:12:22 |
| 51.161.23.176 | attack | Attempted connection to port 80. |
2020-04-24 01:10:48 |
| 46.101.232.76 | attackspambots | 2020-04-23T12:21:36.7914361495-001 sshd[50754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.232.76 2020-04-23T12:21:36.7847301495-001 sshd[50754]: Invalid user mu from 46.101.232.76 port 42812 2020-04-23T12:21:39.1467111495-001 sshd[50754]: Failed password for invalid user mu from 46.101.232.76 port 42812 ssh2 2020-04-23T12:25:40.2280711495-001 sshd[50921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.232.76 user=root 2020-04-23T12:25:41.4132251495-001 sshd[50921]: Failed password for root from 46.101.232.76 port 46103 ssh2 2020-04-23T12:29:22.4462191495-001 sshd[51057]: Invalid user mj from 46.101.232.76 port 49394 ... |
2020-04-24 01:08:14 |
| 175.202.205.180 | attack | Telnet/23 MH Probe, Scan, BF, Hack - |
2020-04-24 00:40:42 |
| 200.54.242.46 | attack | (sshd) Failed SSH login from 200.54.242.46 (CL/Chile/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 23 18:31:44 s1 sshd[31497]: Invalid user admin from 200.54.242.46 port 35712 Apr 23 18:31:45 s1 sshd[31497]: Failed password for invalid user admin from 200.54.242.46 port 35712 ssh2 Apr 23 18:41:43 s1 sshd[32657]: Invalid user admin from 200.54.242.46 port 45966 Apr 23 18:41:45 s1 sshd[32657]: Failed password for invalid user admin from 200.54.242.46 port 45966 ssh2 Apr 23 18:46:45 s1 sshd[831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.54.242.46 user=root |
2020-04-24 00:40:13 |
| 218.248.32.25 | attackspam | Honeypot attack, port: 445, PTR: static.ill.218.248.32.25/24.bsnl.in. |
2020-04-24 00:39:44 |
| 190.74.230.249 | attack | Unauthorized connection attempt from IP address 190.74.230.249 on Port 445(SMB) |
2020-04-24 00:48:14 |
| 185.50.149.3 | attack | Apr 23 18:55:24 mail.srvfarm.net postfix/smtpd[4027908]: warning: unknown[185.50.149.3]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Apr 23 18:55:24 mail.srvfarm.net postfix/smtpd[4027908]: lost connection after AUTH from unknown[185.50.149.3] Apr 23 18:55:25 mail.srvfarm.net postfix/smtps/smtpd[4030963]: warning: unknown[185.50.149.3]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Apr 23 18:55:26 mail.srvfarm.net postfix/smtpd[4028859]: warning: unknown[185.50.149.3]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Apr 23 18:55:26 mail.srvfarm.net postfix/smtps/smtpd[4030963]: lost connection after AUTH from unknown[185.50.149.3] |
2020-04-24 01:09:04 |
| 171.103.172.174 | attackspam | 2020-04-21 x@x ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=171.103.172.174 |
2020-04-24 00:59:52 |
| 153.246.16.154 | attackbotsspam | SSH auth scanning - multiple failed logins |
2020-04-24 01:04:10 |
| 52.231.154.51 | attack | Repeated RDP login failures. Last user: administrator |
2020-04-24 00:51:05 |
| 37.228.137.244 | attackspam | Attempted connection to port 24296. |
2020-04-24 01:13:57 |