14.166.2.204 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Viet Nam

Internet Service Provider: Vietnam Posts and Telecommunications Group

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	Unauthorised access (Nov 20) SRC=14.166.2.204 LEN=52 TTL=111 ID=5733 DF TCP DPT=445 WINDOW=8192 SYN	2019-11-20 23:08:50

Comments on same subnet:

IP	Type	Details	Datetime
14.166.244.232	attack	Aug 26 05:53:30 ns381471 sshd[16648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.166.244.232 Aug 26 05:53:32 ns381471 sshd[16648]: Failed password for invalid user 888888 from 14.166.244.232 port 56057 ssh2	2020-08-26 15:22:01
14.166.217.159	attackspambots	Unauthorised access (Jul 26) SRC=14.166.217.159 LEN=52 TTL=48 ID=22709 DF TCP DPT=445 WINDOW=8192 SYN	2020-07-26 21:05:43
14.166.226.173	attackbotsspam	Unauthorized connection attempt from IP address 14.166.226.173 on Port 445(SMB)	2020-07-15 14:36:29
14.166.226.173	attack	1594415663 - 07/10/2020 23:14:23 Host: 14.166.226.173/14.166.226.173 Port: 445 TCP Blocked	2020-07-11 07:22:19
14.166.218.206	attack	Honeypot attack, port: 445, PTR: static.vnpt.vn.	2020-07-09 14:28:04
14.166.200.30	attackbotsspam	2020-06-22 06:49:58.872312-0500 localhost smtpd[19438]: NOQUEUE: reject: RCPT from unknown[14.166.200.30]: 554 5.7.1 Service unavailable; Client host [14.166.200.30] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/14.166.200.30; from= to= proto=ESMTP helo=	2020-06-23 01:31:06
14.166.231.63	attack	Port scan on 1 port(s): 445	2020-06-22 19:40:16
14.166.236.88	attackspambots	Unauthorized connection attempt from IP address 14.166.236.88 on Port 445(SMB)	2020-06-19 05:37:07
14.166.214.163	attackspambots	Invalid user admin from 14.166.214.163 port 52103	2020-06-18 06:37:35
14.166.243.217	attack	Unauthorized connection attempt from IP address 14.166.243.217 on Port 445(SMB)	2020-05-24 00:02:15
14.166.228.217	attackbots	Unauthorized connection attempt from IP address 14.166.228.217 on Port 445(SMB)	2020-05-09 19:34:12
14.166.228.181	attackspam	Honeypot attack, port: 445, PTR: static.vnpt.vn.	2020-05-07 12:12:17
14.166.20.42	attackbots	Honeypot attack, port: 445, PTR: static.vnpt.vn.	2020-04-29 04:08:22
14.166.228.36	attack	Unauthorized access or intrusion attempt detected from Thor banned IP	2020-04-16 21:13:17
14.166.230.125	attackbotsspam	Unauthorized connection attempt from IP address 14.166.230.125 on Port 445(SMB)	2020-04-02 00:44:02

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 14.166.2.204
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57311
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;14.166.2.204.			IN	A

;; AUTHORITY SECTION:
.			558	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019112000 1800 900 604800 86400

;; Query time: 942 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Nov 20 23:08:42 CST 2019
;; MSG SIZE  rcvd: 116

Host info

204.2.166.14.in-addr.arpa domain name pointer static.vnpt.vn.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
204.2.166.14.in-addr.arpa	name = static.vnpt.vn.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
139.59.12.109	attackspambots	139.59.12.109 - - [25/Oct/2019:01:06:00 +0200] "GET /wp-login.php HTTP/1.1" 200 1129 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 139.59.12.109 - - [25/Oct/2019:01:06:01 +0200] "GET /wp-login.php HTTP/1.1" 200 1129 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 139.59.12.109 - - [25/Oct/2019:01:06:01 +0200] "GET /wp-login.php HTTP/1.1" 200 1129 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 139.59.12.109 - - [25/Oct/2019:01:06:03 +0200] "POST /wp-login.php HTTP/1.1" 200 1524 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 139.59.12.109 - - [25/Oct/2019:01:06:03 +0200] "POST /wp-login.php HTTP/1.1" 200 1526 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 139.59.12.109 - - [25/Oct/2019:01:06:03 +0200] "POST /wp-login.php HTTP/1.1" 200 1530 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-10-25 07:53:37
58.19.210.10	attackbots	Invalid user fauzi from 58.19.210.10 port 58850	2019-10-25 07:58:28
67.205.154.87	attackbots	10/24/2019-16:12:17.741882 67.205.154.87 Protocol: 17 ET SCAN Sipvicious User-Agent Detected (friendly-scanner)	2019-10-25 07:38:25
190.252.253.108	attackbots	Oct 25 00:33:25 markkoudstaal sshd[27477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.252.253.108 Oct 25 00:33:28 markkoudstaal sshd[27477]: Failed password for invalid user sales1 from 190.252.253.108 port 48092 ssh2 Oct 25 00:41:19 markkoudstaal sshd[28284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.252.253.108	2019-10-25 08:00:15
163.172.207.104	attack	\[2019-10-24 19:50:10\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-24T19:50:10.868-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="011972592277524",SessionID="0x7fdf2c745a48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/59011",ACLName="no_extension_match" \[2019-10-24 19:52:52\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-24T19:52:52.438-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="9011972592277524",SessionID="0x7fdf2c06f878",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/61366",ACLName="no_extension_match" \[2019-10-24 19:55:44\] SECURITY\[2634\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-10-24T19:55:44.956-0400",Severity="Error",Service="SIP",EventVersion="1",AccountID="0011972592277524",SessionID="0x7fdf2c003608",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/52437",ACLName	2019-10-25 07:58:44
47.104.143.247	attackbotsspam	MultiHost/MultiPort Probe, Scan, Hack -	2019-10-25 07:49:29
121.160.198.198	attack	Automatic report - Banned IP Access	2019-10-25 08:05:06
178.128.121.188	attack	Oct 25 01:51:28 mail sshd\[19860\]: Invalid user remix from 178.128.121.188 Oct 25 01:51:28 mail sshd\[19860\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.121.188 Oct 25 01:51:29 mail sshd\[19860\]: Failed password for invalid user remix from 178.128.121.188 port 58622 ssh2 ...	2019-10-25 08:00:55
138.97.65.4	attack	Oct 24 22:11:38 MK-Soft-VM4 sshd[15981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.97.65.4 Oct 24 22:11:40 MK-Soft-VM4 sshd[15981]: Failed password for invalid user telefonica from 138.97.65.4 port 36210 ssh2 ...	2019-10-25 08:06:46
103.14.100.184	attackspam	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/103.14.100.184/ HK - 1H : (30) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : HK NAME ASN : ASN38197 IP : 103.14.100.184 CIDR : 103.14.100.0/23 PREFIX COUNT : 260 UNIQUE IP COUNT : 71936 ATTACKS DETECTED ASN38197 : 1H - 1 3H - 2 6H - 2 12H - 2 24H - 4 DateTime : 2019-10-24 22:11:50 INFO : HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN - data recovery	2019-10-25 08:00:32
118.193.31.20	attack	Oct 24 13:46:35 hanapaa sshd\[6651\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.31.20 user=root Oct 24 13:46:37 hanapaa sshd\[6651\]: Failed password for root from 118.193.31.20 port 38164 ssh2 Oct 24 13:52:02 hanapaa sshd\[7081\]: Invalid user lovegaku from 118.193.31.20 Oct 24 13:52:02 hanapaa sshd\[7081\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.31.20 Oct 24 13:52:04 hanapaa sshd\[7081\]: Failed password for invalid user lovegaku from 118.193.31.20 port 48872 ssh2	2019-10-25 08:05:37
49.234.217.210	attackbots	Oct 24 22:45:23 vtv3 sshd\[29850\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.217.210 user=root Oct 24 22:45:25 vtv3 sshd\[29850\]: Failed password for root from 49.234.217.210 port 58284 ssh2 Oct 24 22:49:46 vtv3 sshd\[31649\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.217.210 user=root Oct 24 22:49:48 vtv3 sshd\[31649\]: Failed password for root from 49.234.217.210 port 42078 ssh2 Oct 24 22:54:17 vtv3 sshd\[1588\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.217.210 user=root Oct 24 23:07:45 vtv3 sshd\[8759\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.234.217.210 user=root Oct 24 23:07:47 vtv3 sshd\[8759\]: Failed password for root from 49.234.217.210 port 33868 ssh2 Oct 24 23:12:18 vtv3 sshd\[11202\]: Invalid user vpnguardbot from 49.234.217.210 port 45948 Oct 24 23:12:18 vtv3 sshd\[11202	2019-10-25 07:36:32
47.94.239.48	attack	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/47.94.239.48/ CN - 1H : (861) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : CN NAME ASN : ASN37963 IP : 47.94.239.48 CIDR : 47.94.0.0/15 PREFIX COUNT : 303 UNIQUE IP COUNT : 6062848 ATTACKS DETECTED ASN37963 : 1H - 15 3H - 24 6H - 29 12H - 31 24H - 39 DateTime : 2019-10-24 22:12:04 INFO : HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN - data recovery	2019-10-25 07:51:37
59.56.111.220	attackbotsspam	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/59.56.111.220/ CN - 1H : (861) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : CN NAME ASN : ASN133774 IP : 59.56.111.220 CIDR : 59.56.111.0/24 PREFIX COUNT : 230 UNIQUE IP COUNT : 154368 ATTACKS DETECTED ASN133774 : 1H - 2 3H - 3 6H - 3 12H - 4 24H - 5 DateTime : 2019-10-24 22:12:06 INFO : HACK ! - Looking for resource vulnerabilities Scan Detected and Blocked by ADMIN - data recovery	2019-10-25 07:47:26
35.240.248.225	attack	php WP PHPmyadamin ABUSE blocked for 12h	2019-10-25 07:54:56

Recently Reported IPs

2.88.188.132	187.19.240.127	186.0.109.126	180.191.85.180
178.79.48.39	124.13.76.226	45.224.151.74	190.198.27.35
170.24.168.16	187.170.153.201	183.14.90.83	179.36.41.239
196.43.171.28	187.125.101.61	245.34.203.114	93.171.33.32
191.119.53.214	182.138.215.213	115.20.234.187	179.95.92.31