14.135.120.4 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: ChinaNet Ningxia Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Aug 3 14:28:35 debian-2gb-nbg1-2 kernel: \[18716185.879263\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=14.135.120.4 DST=195.201.40.59 LEN=52 TOS=0x00 PREC=0x00 TTL=236 ID=17100 PROTO=TCP SPT=56064 DPT=9595 WINDOW=1024 RES=0x00 SYN URGP=0	2020-08-03 20:37:05
attack	MultiHost/MultiPort Probe, Scan, Hack -	2020-02-03 18:20:42
attackbots	01/19/2020-08:39:55.107580 14.135.120.4 Protocol: 6 ET SCAN NMAP -sS window 1024	2020-01-20 03:45:26
attackspam	Oct 27 06:08:37 mc1 kernel: \[3439252.113431\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=14.135.120.4 DST=159.69.205.51 LEN=52 TOS=0x00 PREC=0x00 TTL=236 ID=33938 PROTO=TCP SPT=54052 DPT=9869 WINDOW=1024 RES=0x00 SYN URGP=0 Oct 27 06:09:14 mc1 kernel: \[3439288.199609\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=14.135.120.4 DST=159.69.205.51 LEN=52 TOS=0x00 PREC=0x00 TTL=235 ID=21466 PROTO=TCP SPT=59212 DPT=9943 WINDOW=1024 RES=0x00 SYN URGP=0 Oct 27 06:10:21 mc1 kernel: \[3439356.036983\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=14.135.120.4 DST=159.69.205.51 LEN=52 TOS=0x00 PREC=0x00 TTL=238 ID=61304 PROTO=TCP SPT=60597 DPT=9944 WINDOW=1024 RES=0x00 SYN URGP=0 ...	2019-10-27 13:12:07
attackspambots	Automatic report - Port Scan	2019-10-17 20:52:47

Comments on same subnet:

IP	Type	Details	Datetime
14.135.120.19	attackbots	[Fri Apr 24 23:22:17 2020] - DDoS Attack From IP: 14.135.120.19 Port: 61310	2020-04-25 17:20:13
14.135.120.5	attackspam	Automatic report - Port Scan Attack	2020-04-02 06:43:33
14.135.120.3	attack	Jan 16 15:03:36 h2177944 kernel: \[2381818.916329\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=14.135.120.3 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=241 ID=15761 PROTO=TCP SPT=52968 DPT=8086 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 16 15:03:36 h2177944 kernel: \[2381818.916346\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=14.135.120.3 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=241 ID=15761 PROTO=TCP SPT=52968 DPT=8086 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 16 15:04:42 h2177944 kernel: \[2381884.952236\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=14.135.120.3 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=241 ID=32679 PROTO=TCP SPT=49266 DPT=8087 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 16 15:04:42 h2177944 kernel: \[2381884.952248\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=14.135.120.3 DST=85.214.117.9 LEN=52 TOS=0x00 PREC=0x00 TTL=241 ID=32679 PROTO=TCP SPT=49266 DPT=8087 WINDOW=1024 RES=0x00 SYN URGP=0 Jan 16 15:05:34 h2177944 kernel: \[2381936.382048\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=14.135.120.3 DST=85.214.117.9 LEN=	2020-01-16 22:47:42
14.135.120.111	attackbots	Unauthorized connection attempt detected from IP address 14.135.120.111 to port 3389 [T]	2020-01-09 02:50:29
14.135.120.12	attackbotsspam	UTC: 2019-10-21 pkts: 3(2, 1) ports(tcp): 102, 502 port (udp): 161	2019-10-22 15:58:42
14.135.120.21	attack	Jul 23 02:25:07 mercury kernel: [UFW ALLOW] IN=eth0 OUT= MAC=f2:3c:91:bc:4d:f8:84:78:ac:5a:1a:41:08:00 SRC=14.135.120.21 DST=109.74.200.221 LEN=76 TOS=0x00 PREC=0x00 TTL=243 ID=57695 PROTO=UDP SPT=61815 DPT=123 LEN=56 ...	2019-09-11 06:03:39
14.135.120.64	attack	6000/tcp 6000/tcp [2019-08-23]2pkt	2019-08-24 07:47:01
14.135.120.20	attackbotsspam	Unauthorized connection attempt from IP address 14.135.120.20 on Port 3389(RDP)	2019-07-19 12:49:45

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 14.135.120.4
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 49747
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;14.135.120.4.			IN	A

;; AUTHORITY SECTION:
.			517	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019101700 1800 900 604800 86400

;; Query time: 177 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Oct 17 20:52:43 CST 2019
;; MSG SIZE  rcvd: 116

Host info

Host 4.120.135.14.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 4.120.135.14.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
103.62.239.77	attack	Aug 28 15:25:48 php1 sshd\[1205\]: Invalid user paintball1 from 103.62.239.77 Aug 28 15:25:48 php1 sshd\[1205\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.62.239.77 Aug 28 15:25:50 php1 sshd\[1205\]: Failed password for invalid user paintball1 from 103.62.239.77 port 57732 ssh2 Aug 28 15:30:42 php1 sshd\[1652\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.62.239.77 user=root Aug 28 15:30:44 php1 sshd\[1652\]: Failed password for root from 103.62.239.77 port 46198 ssh2	2019-08-29 09:33:13
153.36.236.35	attackbotsspam	Aug 29 01:15:26 hcbbdb sshd\[9694\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.36.236.35 user=root Aug 29 01:15:28 hcbbdb sshd\[9694\]: Failed password for root from 153.36.236.35 port 43034 ssh2 Aug 29 01:15:37 hcbbdb sshd\[9722\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.36.236.35 user=root Aug 29 01:15:39 hcbbdb sshd\[9722\]: Failed password for root from 153.36.236.35 port 38935 ssh2 Aug 29 01:15:41 hcbbdb sshd\[9722\]: Failed password for root from 153.36.236.35 port 38935 ssh2	2019-08-29 09:16:29
171.235.34.17	attackspam	@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-08-28 22:39:36,749 INFO [amun_request_handler] PortScan Detected on Port: 445 (171.235.34.17)	2019-08-29 09:14:06
104.248.193.85	attackbotsspam	Aug 28 20:45:34 bilbo sshd[20499]: Invalid user admin from 104.248.193.85 Aug 28 20:45:36 bilbo sshd[20503]: Invalid user admin from 104.248.193.85 Aug 28 20:45:37 bilbo sshd[20505]: Invalid user user from 104.248.193.85 Aug 28 20:45:38 bilbo sshd[20507]: Invalid user user from 104.248.193.85 ...	2019-08-29 09:02:48
159.65.77.254	attackbots	Aug 28 14:55:42 tdfoods sshd\[27478\]: Invalid user smceachern from 159.65.77.254 Aug 28 14:55:42 tdfoods sshd\[27478\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.77.254 Aug 28 14:55:44 tdfoods sshd\[27478\]: Failed password for invalid user smceachern from 159.65.77.254 port 55022 ssh2 Aug 28 14:59:55 tdfoods sshd\[27855\]: Invalid user lx from 159.65.77.254 Aug 28 14:59:55 tdfoods sshd\[27855\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.77.254	2019-08-29 09:12:44
54.39.98.253	attack	Invalid user tryton from 54.39.98.253 port 51142 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.98.253 Failed password for invalid user tryton from 54.39.98.253 port 51142 ssh2 Invalid user anonymous from 54.39.98.253 port 39366 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.98.253	2019-08-29 09:21:00
92.44.93.215	attackbots	Put the fire out-brazil and France - or we will -careless addition to lets mess it up again -like-facebook -did we forget history macdonalds BBC London mostly Scots tv media -shona macdonald is a risk to all uk shona IRA KID -CHECK SOCIAL MEDIA NETHERLAND INVERGARRY	2019-08-29 08:54:47
222.186.15.101	attackbots	2019-08-29T00:49:15.459953abusebot-6.cloudsearch.cf sshd\[3985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.15.101 user=root	2019-08-29 08:49:27
218.92.0.198	attackbotsspam	Aug 29 03:01:00 eventyay sshd[18358]: Failed password for root from 218.92.0.198 port 56834 ssh2 Aug 29 03:01:38 eventyay sshd[18360]: Failed password for root from 218.92.0.198 port 51783 ssh2 ...	2019-08-29 09:03:58
185.59.138.217	attackspam	Aug 28 14:52:38 lcprod sshd\[10227\]: Invalid user du from 185.59.138.217 Aug 28 14:52:38 lcprod sshd\[10227\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.59.138.217 Aug 28 14:52:40 lcprod sshd\[10227\]: Failed password for invalid user du from 185.59.138.217 port 52028 ssh2 Aug 28 14:56:47 lcprod sshd\[10665\]: Invalid user mahesh from 185.59.138.217 Aug 28 14:56:47 lcprod sshd\[10665\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.59.138.217	2019-08-29 09:19:29
68.183.183.157	attack	Aug 28 08:47:59 shadeyouvpn sshd[20127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.183.157 user=admin Aug 28 08:48:01 shadeyouvpn sshd[20127]: Failed password for admin from 68.183.183.157 port 35810 ssh2 Aug 28 08:48:01 shadeyouvpn sshd[20127]: Received disconnect from 68.183.183.157: 11: Bye Bye [preauth] Aug 28 08:55:40 shadeyouvpn sshd[27455]: Invalid user user from 68.183.183.157 Aug 28 08:55:40 shadeyouvpn sshd[27455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.183.157 Aug 28 08:55:42 shadeyouvpn sshd[27455]: Failed password for invalid user user from 68.183.183.157 port 49640 ssh2 Aug 28 08:55:43 shadeyouvpn sshd[27455]: Received disconnect from 68.183.183.157: 11: Bye Bye [preauth] Aug 28 09:00:27 shadeyouvpn sshd[31182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.183.157 user=r.r Aug 28 09:00:29 shadeyou........ -------------------------------	2019-08-29 09:01:17
40.118.214.15	attack	Aug 29 00:55:46 MK-Soft-VM5 sshd\[24606\]: Invalid user ailton from 40.118.214.15 port 42502 Aug 29 00:55:46 MK-Soft-VM5 sshd\[24606\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.118.214.15 Aug 29 00:55:48 MK-Soft-VM5 sshd\[24606\]: Failed password for invalid user ailton from 40.118.214.15 port 42502 ssh2 ...	2019-08-29 09:11:41
77.247.110.216	attackspam	\[2019-08-28 21:17:31\] NOTICE\[1829\] chan_sip.c: Registration from '661 \' failed for '77.247.110.216:53523' - Wrong password \[2019-08-28 21:17:31\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-28T21:17:31.193-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="661",SessionID="0x7f7b3014d668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.110.216/53523",Challenge="34d94f7b",ReceivedChallenge="34d94f7b",ReceivedHash="2c128814909bedbeee123a8a5f725afc" \[2019-08-28 21:17:33\] NOTICE\[1829\] chan_sip.c: Registration from '489 \' failed for '77.247.110.216:50673' - Wrong password \[2019-08-28 21:17:33\] SECURITY\[1837\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-08-28T21:17:33.648-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="489",SessionID="0x7f7b3087b658",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77	2019-08-29 09:20:03
115.75.241.54	attack	@LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-08-28 22:44:02,222 INFO [amun_request_handler] PortScan Detected on Port: 445 (115.75.241.54)	2019-08-29 08:58:19
220.176.204.91	attackbots	Aug 28 15:01:48 friendsofhawaii sshd\[32753\]: Invalid user tar from 220.176.204.91 Aug 28 15:01:48 friendsofhawaii sshd\[32753\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.176.204.91 Aug 28 15:01:49 friendsofhawaii sshd\[32753\]: Failed password for invalid user tar from 220.176.204.91 port 9348 ssh2 Aug 28 15:05:17 friendsofhawaii sshd\[636\]: Invalid user limpa from 220.176.204.91 Aug 28 15:05:17 friendsofhawaii sshd\[636\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.176.204.91	2019-08-29 09:14:22

Recently Reported IPs

49.51.155.24	37.74.81.210	66.196.219.2	150.163.75.11
187.176.190.61	139.9.168.133	119.251.245.127	147.92.54.101
200.58.160.1	89.122.105.49	207.148.65.16	7.252.175.248
203.36.137.123	149.97.247.201	149.202.144.181	53.50.192.109
105.62.87.42	166.20.13.81	33.3.185.190	78.221.62.1