Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: Tencent Cloud Computing (Beijing) Co. Ltd

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:
Type Details Datetime
attackspam
Automatic report - Banned IP Access
2020-10-12 21:23:15
attack
Oct 12 04:47:44 *** sshd[4974]: User root from 148.70.149.39 not allowed because not listed in AllowUsers
2020-10-12 12:53:33
attackbots
SSH Bruteforce Attempt on Honeypot
2020-10-05 07:52:36
attackbotsspam
vps:sshd-InvalidUser
2020-10-05 00:12:23
attackbotsspam
Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-28T21:05:13Z and 2020-09-28T21:22:52Z
2020-09-29 06:55:27
attackbots
(sshd) Failed SSH login from 148.70.149.39 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 28 14:01:30 server2 sshd[13641]: Invalid user trade from 148.70.149.39 port 34092
Sep 28 14:01:33 server2 sshd[13641]: Failed password for invalid user trade from 148.70.149.39 port 34092 ssh2
Sep 28 14:14:11 server2 sshd[16006]: Invalid user lj from 148.70.149.39 port 54884
Sep 28 14:14:13 server2 sshd[16006]: Failed password for invalid user lj from 148.70.149.39 port 54884 ssh2
Sep 28 14:22:37 server2 sshd[17482]: Invalid user sistema from 148.70.149.39 port 33408
2020-09-28 23:23:37
attack
Sep 21 12:42:43 ourumov-web sshd\[15034\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
Sep 21 12:42:45 ourumov-web sshd\[15034\]: Failed password for root from 148.70.149.39 port 51236 ssh2
Sep 21 12:48:22 ourumov-web sshd\[15390\]: Invalid user jenkins from 148.70.149.39 port 45552
...
2020-09-21 21:08:48
attack
fail2ban detected brute force on sshd
2020-09-21 12:55:48
attackspam
Bruteforce detected by fail2ban
2020-09-21 04:47:23
attack
148.70.149.39 (CN/China/-), 9 distributed sshd attacks on account [admin] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 20 13:03:10 server4 sshd[16368]: Invalid user admin from 71.11.134.32
Sep 20 12:53:10 server4 sshd[10082]: Invalid user admin from 24.237.89.47
Sep 20 12:53:17 server4 sshd[10390]: Invalid user admin from 148.70.149.39
Sep 20 12:53:19 server4 sshd[10390]: Failed password for invalid user admin from 148.70.149.39 port 59694 ssh2
Sep 20 12:57:11 server4 sshd[12743]: Failed password for invalid user admin from 96.42.78.206 port 35605 ssh2
Sep 20 12:57:12 server4 sshd[12773]: Invalid user admin from 96.42.78.206
Sep 20 12:57:07 server4 sshd[12739]: Invalid user admin from 96.42.78.206
Sep 20 12:57:08 server4 sshd[12739]: Failed password for invalid user admin from 96.42.78.206 port 35526 ssh2
Sep 20 12:57:09 server4 sshd[12743]: Invalid user admin from 96.42.78.206

IP Addresses Blocked:

71.11.134.32 (US/United States/-)
24.237.89.47 (US/United States/-)
2020-09-21 01:26:05
attackspambots
2020-09-20T10:10:30.071493ollin.zadara.org sshd[788155]: Invalid user postgresql from 148.70.149.39 port 46284
2020-09-20T10:10:31.682239ollin.zadara.org sshd[788155]: Failed password for invalid user postgresql from 148.70.149.39 port 46284 ssh2
...
2020-09-20 17:25:03
attackbots
Time:     Mon Sep  7 18:38:15 2020 +0200
IP:       148.70.149.39 (CN/China/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Sep  7 18:33:10 mail-03 sshd[30399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
Sep  7 18:33:12 mail-03 sshd[30399]: Failed password for root from 148.70.149.39 port 34256 ssh2
Sep  7 18:36:18 mail-03 sshd[30568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
Sep  7 18:36:20 mail-03 sshd[30568]: Failed password for root from 148.70.149.39 port 58714 ssh2
Sep  7 18:38:11 mail-03 sshd[30677]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
2020-09-08 02:30:22
attackbots
Sep  7 16:28:31 webhost01 sshd[663]: Failed password for root from 148.70.149.39 port 41884 ssh2
...
2020-09-07 17:56:12
attackspambots
Invalid user drake from 148.70.149.39 port 33452
2020-08-30 18:01:25
attack
Invalid user media from 148.70.149.39 port 38948
2020-08-29 06:01:40
attackspambots
Aug 21 09:42:59 meumeu sshd[17159]: Invalid user suisse from 148.70.149.39 port 33344
Aug 21 09:42:59 meumeu sshd[17159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39 
Aug 21 09:42:59 meumeu sshd[17159]: Invalid user suisse from 148.70.149.39 port 33344
Aug 21 09:43:01 meumeu sshd[17159]: Failed password for invalid user suisse from 148.70.149.39 port 33344 ssh2
Aug 21 09:46:33 meumeu sshd[17252]: Invalid user amavis from 148.70.149.39 port 59120
Aug 21 09:46:33 meumeu sshd[17252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39 
Aug 21 09:46:33 meumeu sshd[17252]: Invalid user amavis from 148.70.149.39 port 59120
Aug 21 09:46:35 meumeu sshd[17252]: Failed password for invalid user amavis from 148.70.149.39 port 59120 ssh2
Aug 21 09:49:54 meumeu sshd[17320]: Invalid user dxz from 148.70.149.39 port 56670
...
2020-08-21 16:01:29
attackbotsspam
'Fail2Ban'
2020-08-12 02:58:40
attackbotsspam
Aug  8 05:53:30 v22019038103785759 sshd\[16048\]: Invalid user \>\;\<\; from 148.70.149.39 port 55524
Aug  8 05:53:30 v22019038103785759 sshd\[16048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
Aug  8 05:53:32 v22019038103785759 sshd\[16048\]: Failed password for invalid user \>\;\<\; from 148.70.149.39 port 55524 ssh2
Aug  8 05:59:20 v22019038103785759 sshd\[16232\]: Invalid user admin2123 from 148.70.149.39 port 43456
Aug  8 05:59:20 v22019038103785759 sshd\[16232\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
...
2020-08-08 12:06:42
attackspam
Aug  7 19:31:33 icinga sshd[38005]: Failed password for root from 148.70.149.39 port 44468 ssh2
Aug  7 19:49:34 icinga sshd[763]: Failed password for root from 148.70.149.39 port 44776 ssh2
...
2020-08-08 03:34:30
attack
2020-08-04T20:54:50.929103mail.standpoint.com.ua sshd[17369]: Failed password for root from 148.70.149.39 port 42570 ssh2
2020-08-04T20:57:01.171019mail.standpoint.com.ua sshd[17666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
2020-08-04T20:57:03.302833mail.standpoint.com.ua sshd[17666]: Failed password for root from 148.70.149.39 port 60008 ssh2
2020-08-04T20:59:15.190957mail.standpoint.com.ua sshd[17985]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
2020-08-04T20:59:17.718935mail.standpoint.com.ua sshd[17985]: Failed password for root from 148.70.149.39 port 49222 ssh2
...
2020-08-05 02:27:38
attackbots
Jul 29 08:06:33 george sshd[27918]: Failed password for invalid user XiaB from 148.70.149.39 port 51538 ssh2
Jul 29 08:10:24 george sshd[28393]: Invalid user libimei from 148.70.149.39 port 53756
Jul 29 08:10:24 george sshd[28393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39 
Jul 29 08:10:26 george sshd[28393]: Failed password for invalid user libimei from 148.70.149.39 port 53756 ssh2
Jul 29 08:14:16 george sshd[28428]: Invalid user haoxian from 148.70.149.39 port 55978
...
2020-07-29 20:25:44
attackspambots
" "
2020-07-20 20:44:37
attack
Jun 28 07:31:59 DAAP sshd[25095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
Jun 28 07:32:01 DAAP sshd[25095]: Failed password for root from 148.70.149.39 port 60362 ssh2
Jun 28 07:40:41 DAAP sshd[25228]: Invalid user mongod from 148.70.149.39 port 48034
Jun 28 07:40:41 DAAP sshd[25228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
Jun 28 07:40:41 DAAP sshd[25228]: Invalid user mongod from 148.70.149.39 port 48034
Jun 28 07:40:42 DAAP sshd[25228]: Failed password for invalid user mongod from 148.70.149.39 port 48034 ssh2
...
2020-06-28 15:51:24
attack
Jun 23 23:36:25 santamaria sshd\[7144\]: Invalid user vt from 148.70.149.39
Jun 23 23:36:25 santamaria sshd\[7144\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
Jun 23 23:36:27 santamaria sshd\[7144\]: Failed password for invalid user vt from 148.70.149.39 port 35542 ssh2
...
2020-06-24 06:28:56
attack
Jun 12 05:58:45 ns381471 sshd[27908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
Jun 12 05:58:47 ns381471 sshd[27908]: Failed password for invalid user ares from 148.70.149.39 port 43380 ssh2
2020-06-12 12:30:43
attackspambots
2020-06-06T14:32:54.544219galaxy.wi.uni-potsdam.de sshd[21245]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
2020-06-06T14:32:56.575572galaxy.wi.uni-potsdam.de sshd[21245]: Failed password for root from 148.70.149.39 port 49858 ssh2
2020-06-06T14:33:43.849709galaxy.wi.uni-potsdam.de sshd[21309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
2020-06-06T14:33:45.609136galaxy.wi.uni-potsdam.de sshd[21309]: Failed password for root from 148.70.149.39 port 57028 ssh2
2020-06-06T14:34:31.434259galaxy.wi.uni-potsdam.de sshd[21414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
2020-06-06T14:34:33.450347galaxy.wi.uni-potsdam.de sshd[21414]: Failed password for root from 148.70.149.39 port 35968 ssh2
2020-06-06T14:35:19.942069galaxy.wi.uni-potsdam.de sshd[21482]: pam_unix(sshd:auth): authenticati
...
2020-06-06 20:42:00
attackbots
Invalid user nil from 148.70.149.39 port 38534
2020-05-24 03:16:03
attack
2020-05-22T22:28:02.813307shield sshd\[29671\]: Invalid user gcx from 148.70.149.39 port 56566
2020-05-22T22:28:02.817171shield sshd\[29671\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
2020-05-22T22:28:04.039638shield sshd\[29671\]: Failed password for invalid user gcx from 148.70.149.39 port 56566 ssh2
2020-05-22T22:33:26.332600shield sshd\[31093\]: Invalid user uou from 148.70.149.39 port 34624
2020-05-22T22:33:26.336455shield sshd\[31093\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39
2020-05-23 06:58:58
attackspam
$f2bV_matches
2020-05-11 19:32:43
attackspam
May  8 20:34:11 server1 sshd\[16589\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39  user=root
May  8 20:34:14 server1 sshd\[16589\]: Failed password for root from 148.70.149.39 port 43418 ssh2
May  8 20:39:23 server1 sshd\[18138\]: Invalid user lrq from 148.70.149.39
May  8 20:39:23 server1 sshd\[18138\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.149.39 
May  8 20:39:25 server1 sshd\[18138\]: Failed password for invalid user lrq from 148.70.149.39 port 46964 ssh2
...
2020-05-09 20:07:10
Comments on same subnet:
IP Type Details Datetime
148.70.149.92 attackbotsspam
IP 148.70.149.92 attacked honeypot on port: 6379 at 8/6/2020 6:24:56 AM
2020-08-06 22:59:35
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 148.70.149.39
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9434
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;148.70.149.39.			IN	A

;; AUTHORITY SECTION:
.			595	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020040801 1800 900 604800 86400

;; Query time: 43 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Apr 09 08:31:34 CST 2020
;; MSG SIZE  rcvd: 117
Host info
Host 39.149.70.148.in-addr.arpa. not found: 3(NXDOMAIN)
Nslookup info:
Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 39.149.70.148.in-addr.arpa: NXDOMAIN
Related IP info:
Related comments:
IP Type Details Datetime
61.95.233.61 attack
May 12 06:22:40 server sshd[8619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.95.233.61
May 12 06:22:42 server sshd[8619]: Failed password for invalid user brother from 61.95.233.61 port 60106 ssh2
May 12 06:26:43 server sshd[8963]: Failed password for root from 61.95.233.61 port 35204 ssh2
...
2020-05-12 12:45:36
77.65.17.2 attack
May 11 22:02:13 server1 sshd\[26219\]: Failed password for invalid user opuser from 77.65.17.2 port 46946 ssh2
May 11 22:06:09 server1 sshd\[27379\]: Invalid user informix from 77.65.17.2
May 11 22:06:09 server1 sshd\[27379\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.65.17.2 
May 11 22:06:11 server1 sshd\[27379\]: Failed password for invalid user informix from 77.65.17.2 port 55482 ssh2
May 11 22:10:02 server1 sshd\[28583\]: Invalid user lotta from 77.65.17.2
...
2020-05-12 12:58:12
106.12.176.113 attackspam
May 12 06:28:30 [host] sshd[4196]: Invalid user su
May 12 06:28:30 [host] sshd[4196]: pam_unix(sshd:a
May 12 06:28:32 [host] sshd[4196]: Failed password
2020-05-12 12:59:16
106.53.12.243 attackbots
Invalid user psg from 106.53.12.243 port 50732
2020-05-12 12:56:03
182.61.108.39 attackspam
[ssh] SSH attack
2020-05-12 12:53:49
182.61.61.44 attackbots
Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)
2020-05-12 13:13:19
81.30.204.10 attackbotsspam
Port probing on unauthorized port 81
2020-05-12 13:14:08
35.200.180.182 attack
35.200.180.182 - - \[12/May/2020:05:54:08 +0200\] "POST /wp-login.php HTTP/1.0" 200 2797 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
35.200.180.182 - - \[12/May/2020:05:54:12 +0200\] "POST /wp-login.php HTTP/1.0" 200 2727 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
35.200.180.182 - - \[12/May/2020:05:54:17 +0200\] "POST /wp-login.php HTTP/1.0" 200 2764 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"
2020-05-12 13:11:25
52.130.93.119 attackbotsspam
SSH Brute-Forcing (server2)
2020-05-12 12:41:07
182.43.134.224 attackbotsspam
May 12 05:54:50 sso sshd[727]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.43.134.224
May 12 05:54:52 sso sshd[727]: Failed password for invalid user elvira from 182.43.134.224 port 46980 ssh2
...
2020-05-12 12:41:59
103.248.33.51 attackbotsspam
May 12 06:25:04 srv01 sshd[5431]: Invalid user media from 103.248.33.51 port 44882
May 12 06:25:04 srv01 sshd[5431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.248.33.51
May 12 06:25:04 srv01 sshd[5431]: Invalid user media from 103.248.33.51 port 44882
May 12 06:25:06 srv01 sshd[5431]: Failed password for invalid user media from 103.248.33.51 port 44882 ssh2
May 12 06:29:30 srv01 sshd[20576]: Invalid user bcr from 103.248.33.51 port 54852
...
2020-05-12 12:43:29
152.136.18.142 attack
May 12 11:59:05 webhost01 sshd[6018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.18.142
May 12 11:59:07 webhost01 sshd[6018]: Failed password for invalid user admin from 152.136.18.142 port 55776 ssh2
...
2020-05-12 13:03:00
185.58.226.235 attack
May 12 04:53:02 game-panel sshd[10920]: Failed password for root from 185.58.226.235 port 53152 ssh2
May 12 04:57:13 game-panel sshd[11084]: Failed password for root from 185.58.226.235 port 34798 ssh2
May 12 05:01:19 game-panel sshd[11215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.58.226.235
2020-05-12 13:02:35
49.88.112.75 attackspambots
5x Failed Password
2020-05-12 12:49:18
128.199.224.215 attackbots
May 11 18:55:38 kapalua sshd\[11201\]: Invalid user tester from 128.199.224.215
May 11 18:55:38 kapalua sshd\[11201\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.224.215
May 11 18:55:40 kapalua sshd\[11201\]: Failed password for invalid user tester from 128.199.224.215 port 45954 ssh2
May 11 18:59:48 kapalua sshd\[11536\]: Invalid user user from 128.199.224.215
May 11 18:59:48 kapalua sshd\[11536\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.224.215
2020-05-12 13:10:48

Recently Reported IPs

227.105.200.134 125.205.150.184 230.38.31.84 104.42.47.203
40.231.224.249 47.181.86.206 113.142.101.244 69.94.135.176
207.102.205.200 77.102.23.1 168.181.128.174 134.112.192.138
204.245.110.19 196.115.210.255 196.210.40.68 212.33.100.132
182.179.172.149 191.178.165.211 80.182.122.213 46.169.240.98