139.99.114.236

Basic Info

City: unknown

Region: unknown

Country: Singapore

Internet Service Provider: Paas.id

Hostname: unknown

Organization: OVH SAS

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	WordPress login Brute force / Web App Attack on client site.	2019-07-20 01:01:16
attack	139.99.114.236 - - \[23/Jun/2019:14:09:15 +0200\] "GET /wp-login.php HTTP/1.1" 200 1237 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 139.99.114.236 - - \[23/Jun/2019:14:09:16 +0200\] "POST /wp-login.php HTTP/1.1" 200 1632 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 139.99.114.236 - - \[23/Jun/2019:14:09:17 +0200\] "GET /wp-login.php HTTP/1.1" 200 1237 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 139.99.114.236 - - \[23/Jun/2019:14:09:17 +0200\] "POST /wp-login.php HTTP/1.1" 200 1607 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 139.99.114.236 - - \[23/Jun/2019:14:09:18 +0200\] "GET /wp-login.php HTTP/1.1" 200 1237 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 139.99.114.236 - - \[23/Jun/2019:14:09:18 +0200\] "POST /wp-login.php HTTP/1.1" 200 1608 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:6	2019-06-23 22:07:38

Type

Details

Datetime

attackspam

WordPress login Brute force / Web App Attack on client site.

2019-07-20 01:01:16

attack

139.99.114.236 - - \[23/Jun/2019:14:09:15 +0200\] "GET /wp-login.php HTTP/1.1" 200 1237 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.99.114.236 - - \[23/Jun/2019:14:09:16 +0200\] "POST /wp-login.php HTTP/1.1" 200 1632 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.99.114.236 - - \[23/Jun/2019:14:09:17 +0200\] "GET /wp-login.php HTTP/1.1" 200 1237 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.99.114.236 - - \[23/Jun/2019:14:09:17 +0200\] "POST /wp-login.php HTTP/1.1" 200 1607 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.99.114.236 - - \[23/Jun/2019:14:09:18 +0200\] "GET /wp-login.php HTTP/1.1" 200 1237 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
139.99.114.236 - - \[23/Jun/2019:14:09:18 +0200\] "POST /wp-login.php HTTP/1.1" 200 1608 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:6

2019-06-23 22:07:38

Comments on same subnet:

IP	Type	Details	Datetime
139.99.114.230	attack	UDP 139.99.114.230:27015 -> port 45394, len 273	2020-09-15 01:36:02
139.99.114.230	attack	SIP/5060 Probe, BF, Hack -	2020-09-14 17:20:03
139.99.114.230	attack	139.99.114.230 was recorded 15 times by 6 hosts attempting to connect to the following ports: 33185,51856,26014,50570. Incident counter (4h, 24h, all-time): 15, 85, 146	2020-05-12 02:15:51
139.99.114.230	attack	139.99.114.230 was recorded 10 times by 4 hosts attempting to connect to the following ports: 26014,33185,51856,50570. Incident counter (4h, 24h, all-time): 10, 25, 38	2020-05-10 08:22:12

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 139.99.114.236
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60798
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;139.99.114.236.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019050700 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Tue May 07 18:40:43 +08 2019
;; MSG SIZE  rcvd: 118

Host info

236.114.99.139.in-addr.arpa domain name pointer sgx8.cloudhost.id.

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

Non-authoritative answer:
236.114.99.139.in-addr.arpa	name = sgx8.cloudhost.id.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
74.82.47.53	attack	30005/tcp 3389/tcp 23/tcp... [2019-09-13/11-13]31pkt,11pt.(tcp),1pt.(udp)	2019-11-14 02:42:11
111.38.25.89	attackspambots	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-14 03:17:05
154.0.77.214	attackbots	! BASTARD ! VERPISS DICH ! underwoodp133@gmail.com 2019-11-13 14:51:26 Error 154.0.77.214 400 POST /account/password HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 20.5 K SSL/TLS-Zugriff für Apache 2019-11-13 14:51:58 Error 154.0.77.214 403 GET /newsletter/ HTTP/1.1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36 1.14 K SSL/TLS-Zugriff für Apache	2019-11-14 03:14:22
124.42.117.243	attackspam	Nov 13 11:15:15 mockhub sshd[24104]: Failed password for root from 124.42.117.243 port 11228 ssh2 ...	2019-11-14 03:19:11
59.10.5.156	attackbots	2019-11-13T18:39:02.529705abusebot-5.cloudsearch.cf sshd\[27311\]: Invalid user desmond from 59.10.5.156 port 44746	2019-11-14 03:08:48
78.37.70.230	attackbotsspam	Unauthorized connection attempt from IP address 78.37.70.230 on Port 445(SMB)	2019-11-14 02:56:16
111.43.223.79	attackbots	MultiHost/MultiPort Probe, Scan, Hack -	2019-11-14 03:10:46
190.216.245.177	attackspambots	Unauthorized connection attempt from IP address 190.216.245.177 on Port 445(SMB)	2019-11-14 03:12:27
138.197.195.52	attackbotsspam	Nov 13 19:21:34 serwer sshd\[25602\]: Invalid user user from 138.197.195.52 port 55592 Nov 13 19:21:34 serwer sshd\[25602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.195.52 Nov 13 19:21:36 serwer sshd\[25602\]: Failed password for invalid user user from 138.197.195.52 port 55592 ssh2 ...	2019-11-14 02:58:17
41.77.145.34	attackspam	Nov 13 19:37:19 minden010 sshd[1446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.77.145.34 Nov 13 19:37:22 minden010 sshd[1446]: Failed password for invalid user norsilah from 41.77.145.34 port 50062 ssh2 Nov 13 19:42:03 minden010 sshd[3240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.77.145.34 ...	2019-11-14 02:45:15
49.35.6.141	attackspam	Unauthorized connection attempt from IP address 49.35.6.141 on Port 445(SMB)	2019-11-14 03:18:07
115.79.7.213	attackbots	Attempt to attack host OS, exploiting network vulnerabilities, on 13-11-2019 15:25:20.	2019-11-14 02:58:49
52.34.253.52	attack	2019-11-13 16:06:13 H=smtp33b.mxver.com [52.34.253.52] F= rejected RCPT : relay not permitted 2019-11-13 16:28:15 H=smtp33b.mxver.com [52.34.253.52] F= rejected RCPT : relay not permitted ...	2019-11-14 02:43:58
63.88.23.167	attackspambots	63.88.23.167 was recorded 7 times by 3 hosts attempting to connect to the following ports: 80. Incident counter (4h, 24h, all-time): 7, 23, 52	2019-11-14 02:49:57
200.93.148.19	attackbotsspam	frenzy	2019-11-14 03:06:18

Recently Reported IPs

126.185.83.248	106.251.214.30	195.158.92.104	106.120.173.64
118.241.250.66	61.238.22.31	105.235.201.86	104.248.248.88
37.249.69.148	126.56.236.178	185.211.183.142	190.94.217.93
103.94.121.27	109.42.235.152	103.86.187.242	14.177.76.138
165.235.26.70	103.76.137.2	157.135.213.59	95.188.147.106