142.11.238.245

Basic Info

City: Seattle

Region: Washington

Country: United States

Internet Service Provider: Hostwinds LLC.

Hostname: unknown

Organization: Hostwinds LLC.

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	MultiHost/MultiPort Probe, Scan, Hack -	2019-07-11 00:24:34

Comments on same subnet:

IP	Type	Details	Datetime
142.11.238.168	attack	Sep 12 17:41:38 [snip] postfix/smtpd[28492]: warning: hwsrv-774736.hostwindsdns.com[142.11.238.168]: SASL login authentication failed: UGFzc3dvcmQ6 Sep 12 17:52:15 [snip] postfix/smtpd[30402]: warning: hwsrv-774736.hostwindsdns.com[142.11.238.168]: SASL login authentication failed: UGFzc3dvcmQ6 Sep 12 18:02:50 [snip] postfix/smtpd[32352]: warning: hwsrv-774736.hostwindsdns.com[142.11.238.168]: SASL login authentication failed: UGFzc3dvcmQ6 Sep 12 18:13:31 [snip] postfix/smtpd[1946]: warning: hwsrv-774736.hostwindsdns.com[142.11.238.168]: SASL login authentication failed: UGFzc3dvcmQ6 Sep 12 18:24:12 [snip] postfix/smtpd[3942]: warning: hwsrv-774736.hostwindsdns.com[142.11.238.168]: SASL login authentication failed: UGFzc3dvcmQ6[...]	2020-09-13 01:35:58
142.11.238.168	attack	Lines containing failures of 142.11.238.168 Sep 8 22:13:04 box postfix/smtpd[27420]: connect from hwsrv-774736.hostwindsdns.com[142.11.238.168] Sep 8 22:13:06 box postfix/smtpd[27420]: lost connection after CONNECT from hwsrv-774736.hostwindsdns.com[142.11.238.168] Sep 8 22:13:06 box postfix/smtpd[27420]: disconnect from hwsrv-774736.hostwindsdns.com[142.11.238.168] commands=0/0 Sep 8 22:13:08 box postfix/smtpd[27420]: connect from hwsrv-774736.hostwindsdns.com[142.11.238.168] Sep 8 22:13:08 box postfix/smtpd[27420]: NOQUEUE: reject: RCPT from hwsrv-774736.hostwindsdns.com[142.11.238.168]: 450 4.1.8 : Sender address rejected: Domain not found; from=x@x helo= Sep 8 22:13:09 box postfix/smtpd[27420]: lost connection after RCPT from hwsrv-774736.hostwindsdns.com[142.11.238.168] Sep 8 22:13:09 box postfix/smtpd[27420]: disconnect from hwsrv-774736.hostwindsdns.com[142.11.238.168] ehlo=1 mail=1 rcpt=0/1 commands=2/3 Sep 8 22:13:09 box postfix/smtpd........ ------------------------------	2020-09-12 17:35:17
142.11.238.244	attackbotsspam	firewall-block, port(s): 443/tcp	2019-11-21 21:56:53
142.11.238.247	attackspam	" "	2019-08-08 06:12:22
142.11.238.247	attack	" "	2019-07-18 03:21:41

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 142.11.238.245
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58134
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;142.11.238.245.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071000 1800 900 604800 86400

;; Query time: 4 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Thu Jul 11 00:24:25 CST 2019
;; MSG SIZE  rcvd: 118

Host info

245.238.11.142.in-addr.arpa domain name pointer hwsrv-541705.hostwindsdns.com.

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
245.238.11.142.in-addr.arpa	name = hwsrv-541705.hostwindsdns.com.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
182.61.39.254	attackbots	Automatic Fail2ban report - Trying login SSH	2020-07-26 07:27:03
134.122.29.46	attackspam	Brute-force general attack.	2020-07-26 06:53:52
129.226.176.5	attack	Jul 25 23:00:28 vlre-nyc-1 sshd\[27783\]: Invalid user anthony from 129.226.176.5 Jul 25 23:00:28 vlre-nyc-1 sshd\[27783\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.226.176.5 Jul 25 23:00:29 vlre-nyc-1 sshd\[27783\]: Failed password for invalid user anthony from 129.226.176.5 port 45574 ssh2 Jul 25 23:09:06 vlre-nyc-1 sshd\[28015\]: Invalid user universal from 129.226.176.5 Jul 25 23:09:06 vlre-nyc-1 sshd\[28015\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.226.176.5 ...	2020-07-26 07:25:11
134.175.121.80	attackbotsspam	Jul 25 16:35:15 mail sshd\[51380\]: Invalid user user from 134.175.121.80 Jul 25 16:35:15 mail sshd\[51380\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.175.121.80 ...	2020-07-26 07:08:07
68.183.111.63	attackspambots	Port scan: Attack repeated for 24 hours	2020-07-26 07:15:04
80.82.64.98	attackbots	Jul 25 23:59:06 mail.srvfarm.net dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.64.98, lip=185.118.197.126, session= Jul 25 23:59:13 mail.srvfarm.net dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=80.82.64.98, lip=185.118.197.126, session= Jul 25 23:59:59 mail.srvfarm.net dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.64.98, lip=185.118.197.126, session= Jul 26 00:00:21 mail.srvfarm.net dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=80.82.64.98, lip=185.118.197.126, session= Jul 26 00:00:38 mail.srvfarm.net dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 6 secs): user=, method=PLAIN,	2020-07-26 06:53:28
54.37.205.241	attack	$f2bV_matches	2020-07-26 07:28:17
114.233.40.97	attackspam	[MK-VM2] Blocked by UFW	2020-07-26 07:19:24
121.175.200.88	attackspam	Exploited Host.	2020-07-26 07:05:48
176.223.37.149	attack	Automatic report - Banned IP Access	2020-07-26 07:07:51
222.128.78.127	attackspambots	Lines containing failures of 222.128.78.127 Jul 23 23:37:07 shared03 sshd[20067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.128.78.127 user=admin Jul 23 23:37:09 shared03 sshd[20067]: Failed password for admin from 222.128.78.127 port 42858 ssh2 Jul 23 23:37:10 shared03 sshd[20067]: Received disconnect from 222.128.78.127 port 42858:11: Bye Bye [preauth] Jul 23 23:37:10 shared03 sshd[20067]: Disconnected from authenticating user admin 222.128.78.127 port 42858 [preauth] Jul 23 23:41:57 shared03 sshd[21614]: Invalid user user from 222.128.78.127 port 55664 Jul 23 23:41:57 shared03 sshd[21614]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.128.78.127 Jul 23 23:41:59 shared03 sshd[21614]: Failed password for invalid user user from 222.128.78.127 port 55664 ssh2 Jul 23 23:41:59 shared03 sshd[21614]: Received disconnect from 222.128.78.127 port 55664:11: Bye Bye [preauth] Jul 23 2........ ------------------------------	2020-07-26 07:21:55
106.12.68.197	attack	2020-07-25T23:04:28.679632dmca.cloudsearch.cf sshd[4703]: Invalid user henry from 106.12.68.197 port 44700 2020-07-25T23:04:28.684858dmca.cloudsearch.cf sshd[4703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.68.197 2020-07-25T23:04:28.679632dmca.cloudsearch.cf sshd[4703]: Invalid user henry from 106.12.68.197 port 44700 2020-07-25T23:04:31.115891dmca.cloudsearch.cf sshd[4703]: Failed password for invalid user henry from 106.12.68.197 port 44700 ssh2 2020-07-25T23:09:23.252596dmca.cloudsearch.cf sshd[4754]: Invalid user chentao from 106.12.68.197 port 51968 2020-07-25T23:09:23.257587dmca.cloudsearch.cf sshd[4754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.68.197 2020-07-25T23:09:23.252596dmca.cloudsearch.cf sshd[4754]: Invalid user chentao from 106.12.68.197 port 51968 2020-07-25T23:09:25.854115dmca.cloudsearch.cf sshd[4754]: Failed password for invalid user chentao from 106.12.68.19 ...	2020-07-26 07:12:30
186.208.189.19	attackbots	1595689854 - 07/25/2020 17:10:54 Host: 186.208.189.19/186.208.189.19 Port: 445 TCP Blocked	2020-07-26 07:01:45
42.191.157.55	attack	Automatic report - Port Scan Attack	2020-07-26 07:17:58
152.32.229.54	attackspambots	Jul 26 01:01:34 ns382633 sshd\[17157\]: Invalid user test from 152.32.229.54 port 56240 Jul 26 01:01:34 ns382633 sshd\[17157\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.229.54 Jul 26 01:01:36 ns382633 sshd\[17157\]: Failed password for invalid user test from 152.32.229.54 port 56240 ssh2 Jul 26 01:09:13 ns382633 sshd\[18487\]: Invalid user docker from 152.32.229.54 port 41338 Jul 26 01:09:13 ns382633 sshd\[18487\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.229.54	2020-07-26 07:24:48

Recently Reported IPs

45.122.233.4	117.254.253.194	47.139.27.200	64.159.181.213
121.135.67.182	60.190.67.8	14.177.171.77	23.244.76.146
86.178.55.45	5.75.126.247	23.23.223.98	154.18.101.78
93.73.173.236	109.246.159.56	98.90.18.198	195.130.150.157
36.234.22.68	42.76.181.103	201.29.90.186	128.40.172.135