City: unknown
Region: unknown
Country: Russia
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
| IP | Type | Details | Datetime |
|---|---|---|---|
| 141.8.142.8 | attack | (mod_security) mod_security (id:210740) triggered by 141.8.142.8 (RU/Russia/141-8-142-8.spider.yandex.com): 5 in the last 3600 secs |
2020-09-01 16:26:50 |
| 141.8.142.157 | attackbotsspam | [Sun Mar 22 20:00:03.538358 2020] [:error] [pid 21603:tid 139727231514368] [client 141.8.142.157:57267] [client 141.8.142.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XndhUxnFXGtPZGixMNxsoAAAAh0"] ... |
2020-03-23 01:02:32 |
| 141.8.142.60 | attack | [Sat Mar 21 01:25:43.610942 2020] [:error] [pid 3790:tid 140719589320448] [client 141.8.142.60:65179] [client 141.8.142.60] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XnUKpwSfYaBx8kyzBrm2LwAAALQ"] ... |
2020-03-21 03:23:43 |
| 141.8.142.23 | attackspam | [Fri Mar 20 23:27:32.054333 2020] [:error] [pid 2164:tid 140147611977472] [client 141.8.142.23:54455] [client 141.8.142.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XnTu9C4o2dgKA24HFuSq9wAAAFo"] ... |
2020-03-21 02:18:48 |
| 141.8.142.180 | attack | [Thu Mar 19 01:09:39.567987 2020] [:error] [pid 21327:tid 139998034278144] [client 141.8.142.180:58741] [client 141.8.142.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XnJj46fks8iqMveAsGOWFwAAAAI"] ... |
2020-03-19 03:06:41 |
| 141.8.142.172 | attackspambots | [Wed Mar 18 11:55:50.619904 2020] [:error] [pid 7238:tid 139937919776512] [client 141.8.142.172:54795] [client 141.8.142.172] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XnGp1mRgp26zVn0yQ0hUowAAAOA"] ... |
2020-03-18 14:58:10 |
| 141.8.142.1 | attack | [Wed Mar 18 11:40:02.820155 2020] [:error] [pid 7238:tid 139937936561920] [client 141.8.142.1:63313] [client 141.8.142.1] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XnGmImRgp26zVn0yQ0hLKQAAAN4"] ... |
2020-03-18 13:55:32 |
| 141.8.142.23 | attackspambots | [Fri Mar 13 14:57:50.528730 2020] [:error] [pid 5879:tid 140671184795392] [client 141.8.142.23:53161] [client 141.8.142.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "Xms8-rQ-QnNgbfQs7748mwAAAHI"] ... |
2020-03-13 18:57:32 |
| 141.8.142.7 | attack | RU - 1H : (182) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : RU NAME ASN : ASN13238 IP : 141.8.142.7 CIDR : 141.8.128.0/20 PREFIX COUNT : 118 UNIQUE IP COUNT : 206080 WYKRYTE ATAKI Z ASN13238 : 1H - 3 3H - 3 6H - 3 12H - 5 24H - 12 INFO : Looking for resource vulnerabilities 403 Detected and Blocked by ADMIN - data recovery https://help-dysk.pl |
2019-09-12 13:53:55 |
| 141.8.142.155 | attackbotsspam | Jul 10 19:01:54 TCP Attack: SRC=141.8.142.155 DST=[Masked] LEN=258 TOS=0x08 PREC=0x20 TTL=44 DF PROTO=TCP SPT=49399 DPT=80 WINDOW=111 RES=0x00 ACK PSH URGP=0 |
2019-07-11 09:46:30 |
| 141.8.142.176 | bots | 看样子是yandex搜索引擎的可用性爬虫 141.8.142.176 - - [17/May/2019:17:29:40 +0800] "GET /check-ip/2804:14d:5a83:449f:5ab:f26:15e4:e7ce HTTP/1.1" 200 7939 "-" "Mozilla/5.0 (compatible; YandexAccessibilityBot/3.0; +http://yandex.com/bots)" |
2019-05-17 17:33:15 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 141.8.142.163
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10220
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;141.8.142.163. IN A
;; AUTHORITY SECTION:
. 419 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022020300 1800 900 604800 86400
;; Query time: 20 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Feb 03 19:55:59 CST 2022
;; MSG SIZE rcvd: 106163.142.8.141.in-addr.arpa domain name pointer 141-8-142-163.spider.yandex.com.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
163.142.8.141.in-addr.arpa name = 141-8-142-163.spider.yandex.com.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 116.196.116.9 | attack | Invalid user torrent from 116.196.116.9 port 55050 |
2019-08-04 17:43:30 |
| 143.0.58.173 | attackspam | Aug 4 04:51:16 xeon sshd[3673]: Failed password for invalid user ndoe from 143.0.58.173 port 20094 ssh2 |
2019-08-04 17:11:46 |
| 94.139.224.216 | attackspam | 0,45-06/06 [bc06/m26] concatform PostRequest-Spammer scoring: zurich |
2019-08-04 17:06:59 |
| 202.45.147.118 | attack | Invalid user laura from 202.45.147.118 port 47082 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.118 Failed password for invalid user laura from 202.45.147.118 port 47082 ssh2 Invalid user valhalla from 202.45.147.118 port 44459 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.45.147.118 |
2019-08-04 17:20:22 |
| 192.160.102.166 | attack | SSH Brute-Forcing (ownc) |
2019-08-04 17:54:34 |
| 54.37.68.66 | attackbotsspam | k+ssh-bruteforce |
2019-08-04 17:17:35 |
| 188.166.239.106 | attack | Invalid user test01 from 188.166.239.106 port 38942 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.239.106 Failed password for invalid user test01 from 188.166.239.106 port 38942 ssh2 Invalid user quser from 188.166.239.106 port 36148 pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.166.239.106 |
2019-08-04 17:55:59 |
| 87.98.138.89 | attackbots | xmlrpc attack |
2019-08-04 18:06:12 |
| 128.199.61.227 | attack | Jan 25 09:10:57 motanud sshd\[16660\]: Invalid user samba from 128.199.61.227 port 35262 Jan 25 09:10:57 motanud sshd\[16660\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.61.227 Jan 25 09:10:58 motanud sshd\[16660\]: Failed password for invalid user samba from 128.199.61.227 port 35262 ssh2 |
2019-08-04 17:06:20 |
| 190.151.130.13 | attack | Automatic report - Port Scan Attack |
2019-08-04 17:34:58 |
| 195.154.55.174 | attack | Aug 4 08:17:26 *** sshd[24616]: Invalid user famille from 195.154.55.174 |
2019-08-04 17:16:06 |
| 18.85.192.253 | attack | Aug 4 10:41:41 srv03 sshd\[1221\]: Invalid user administrator from 18.85.192.253 port 41702 Aug 4 10:41:41 srv03 sshd\[1221\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.85.192.253 Aug 4 10:41:42 srv03 sshd\[1221\]: Failed password for invalid user administrator from 18.85.192.253 port 41702 ssh2 |
2019-08-04 17:18:07 |
| 179.184.217.83 | attackbotsspam | Mar 8 02:56:57 motanud sshd\[19265\]: Invalid user jk from 179.184.217.83 port 41310 Mar 8 02:56:57 motanud sshd\[19265\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.184.217.83 Mar 8 02:57:00 motanud sshd\[19265\]: Failed password for invalid user jk from 179.184.217.83 port 41310 ssh2 |
2019-08-04 17:20:41 |
| 87.236.210.10 | attack | xmlrpc attack |
2019-08-04 17:33:21 |
| 128.199.52.45 | attack | Aug 4 10:01:13 debian sshd\[31444\]: Invalid user skafreak from 128.199.52.45 port 49548 Aug 4 10:01:13 debian sshd\[31444\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.52.45 ... |
2019-08-04 17:10:42 |