City: unknown
Region: unknown
Country: United States of America
Internet Service Provider: Global Frag Networks
Hostname: unknown
Organization: unknown
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attack | Email rejected due to spam filtering |
2020-04-06 18:07:08 |
| IP | Type | Details | Datetime |
|---|---|---|---|
| 157.52.145.29 | attack | E-mail Spam |
2020-04-19 22:25:53 |
| 157.52.145.82 | attackspambots | Email rejected due to spam filtering |
2020-04-18 02:49:07 |
| 157.52.145.18 | attack | Email rejected due to spam filtering |
2020-04-18 02:38:14 |
| 157.52.145.216 | attackbots | Email rejected due to spam filtering |
2020-04-06 18:06:09 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 157.52.145.14
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13306
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;157.52.145.14. IN A
;; AUTHORITY SECTION:
. 324 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2020040600 1800 900 604800 86400
;; Query time: 32 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Apr 06 18:07:00 CST 2020
;; MSG SIZE rcvd: 11714.145.52.157.in-addr.arpa domain name pointer s14.hgyjzs.com.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
14.145.52.157.in-addr.arpa name = s14.hgyjzs.com.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 34.82.56.224 | attackspambots | 25565/tcp 25565/tcp 25565/tcp [2020-08-11]3pkt |
2020-08-12 08:40:58 |
| 129.211.51.65 | attack | Aug 11 23:04:58 vps647732 sshd[28200]: Failed password for root from 129.211.51.65 port 39171 ssh2 ... |
2020-08-12 08:39:46 |
| 122.117.15.71 | attackbotsspam | 23/tcp [2020-08-11]1pkt |
2020-08-12 08:31:43 |
| 50.234.173.102 | attackbots | Aug 12 05:11:25 ajax sshd[7696]: Failed password for root from 50.234.173.102 port 57338 ssh2 |
2020-08-12 12:20:01 |
| 191.232.177.167 | attackspam | SmallBizIT.US 2 packets to tcp(23) |
2020-08-12 08:37:38 |
| 181.231.83.162 | attack | Aug 12 05:57:08 sd-69548 sshd[3387669]: Invalid user 194.35.12.178 from 181.231.83.162 port 35131 Aug 12 05:57:08 sd-69548 sshd[3387669]: Disconnected from invalid user 194.35.12.178 181.231.83.162 port 35131 [preauth] ... |
2020-08-12 12:08:02 |
| 104.248.158.98 | attackspam | Automatic report - Banned IP Access |
2020-08-12 12:09:45 |
| 87.138.254.133 | attackbotsspam | [ssh] SSH attack |
2020-08-12 08:40:42 |
| 46.151.212.45 | attackspambots | 2020-08-11 19:49:30.898957-0500 localhost sshd[34330]: Failed password for root from 46.151.212.45 port 51808 ssh2 |
2020-08-12 08:51:52 |
| 49.233.24.148 | attackbots | Aug 12 01:05:42 *hidden* sshd[4847]: Failed password for *hidden* from 49.233.24.148 port 47634 ssh2 Aug 12 01:11:30 *hidden* sshd[18685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.24.148 user=root Aug 12 01:11:32 *hidden* sshd[18685]: Failed password for *hidden* from 49.233.24.148 port 53430 ssh2 Aug 12 01:17:11 *hidden* sshd[32423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.24.148 user=root Aug 12 01:17:14 *hidden* sshd[32423]: Failed password for *hidden* from 49.233.24.148 port 59226 ssh2 |
2020-08-12 08:45:19 |
| 191.34.162.186 | attack | Aug 12 05:50:39 ns381471 sshd[6489]: Failed password for root from 191.34.162.186 port 56293 ssh2 |
2020-08-12 12:12:03 |
| 1.53.237.133 | attack | Port probing on unauthorized port 81 |
2020-08-12 08:34:35 |
| 172.105.89.161 | attackspam | srvr1: (mod_security) mod_security (id:920350) triggered by 172.105.89.161 (DE/-/implant-scanner-victims-will-be-notified.threatsinkhole.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/11 23:49:43 [error] 563155#0: *290591 [client 172.105.89.161] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/ajax"] [unique_id "159718978322.090030"] [ref "o0,13v26,13"], client: 172.105.89.161, [redacted] request: "POST /ajax HTTP/1.1" [redacted] |
2020-08-12 08:30:06 |
| 188.92.213.115 | attack | Brute force attempt |
2020-08-12 12:13:36 |
| 41.79.4.156 | attack | 1433/tcp [2020-08-11]1pkt |
2020-08-12 08:43:20 |