City: San Francisco
Region: California
Country: United States
Internet Service Provider: DigitalOcean LLC
Hostname: unknown
Organization: DigitalOcean, LLC
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attack | 12221/tcp 42626/tcp 1400/tcp... [2019-06-13/08-12]50pkt,44pt.(tcp),3pt.(udp) |
2019-08-13 00:19:56 |
| attackbots | 404 NOT FOUND |
2019-08-04 11:28:51 |
| attackspambots | 21/tcp 8123/tcp 34275/tcp... [2019-04-30/06-28]49pkt,39pt.(tcp),5pt.(udp) |
2019-06-30 12:01:03 |
| IP | Type | Details | Datetime |
|---|---|---|---|
| 162.243.145.195 | attack | 162.243.145.195 - - [01/Oct/2020:17:05:46 +0100] "POST /wp-login.php HTTP/1.1" 200 2596 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:17:05:48 +0100] "POST /wp-login.php HTTP/1.1" 200 2580 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:17:05:49 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ... |
2020-10-02 00:44:39 |
| 162.243.145.195 | attackbots | 162.243.145.195 - - [01/Oct/2020:09:22:59 +0100] "POST /wp-login.php HTTP/1.1" 200 2862 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:09:23:00 +0100] "POST /wp-login.php HTTP/1.1" 200 2831 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [01/Oct/2020:09:23:02 +0100] "POST /wp-login.php HTTP/1.1" 200 2866 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ... |
2020-10-01 16:50:20 |
| 162.243.145.195 | attack | 162.243.145.195 - - [21/Sep/2020:16:10:29 +0200] "GET /wp-login.php HTTP/1.1" 200 8558 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [21/Sep/2020:16:10:31 +0200] "POST /wp-login.php HTTP/1.1" 200 8809 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - [21/Sep/2020:16:10:32 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" |
2020-09-22 00:20:13 |
| 162.243.145.195 | attack | Automatic report generated by Wazuh |
2020-09-21 16:01:43 |
| 162.243.145.195 | attackspam | CMS (WordPress or Joomla) login attempt. |
2020-09-21 07:55:55 |
| 162.243.145.195 | attackspam | Sep 20 16:08:16 10.23.102.230 wordpress(www.ruhnke.cloud)[41055]: Blocked authentication attempt for admin from 162.243.145.195 ... |
2020-09-20 22:49:49 |
| 162.243.145.195 | attackbotsspam | 162.243.145.195 - - \[20/Sep/2020:08:30:11 +0200\] "POST /wp-login.php HTTP/1.0" 200 9641 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[20/Sep/2020:08:30:13 +0200\] "POST /wp-login.php HTTP/1.0" 200 9639 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[20/Sep/2020:08:30:15 +0200\] "POST /wp-login.php HTTP/1.0" 200 9487 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" |
2020-09-20 14:40:56 |
| 162.243.145.195 | attack | 162.243.145.195 - - \[19/Sep/2020:22:59:17 +0200\] "POST /wp-login.php HTTP/1.0" 200 8786 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[19/Sep/2020:22:59:20 +0200\] "POST /wp-login.php HTTP/1.0" 200 8612 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 162.243.145.195 - - \[19/Sep/2020:22:59:22 +0200\] "POST /wp-login.php HTTP/1.0" 200 8607 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" |
2020-09-20 06:39:46 |
| 162.243.145.36 | attack | [Fri Jun 12 05:30:57 2020] - DDoS Attack From IP: 162.243.145.36 Port: 35586 |
2020-07-16 21:19:34 |
| 162.243.145.80 | attackbotsspam | [Mon Jun 15 02:54:26 2020] - DDoS Attack From IP: 162.243.145.80 Port: 35122 |
2020-07-16 20:47:35 |
| 162.243.145.9 | attack | [Fri Jun 19 22:32:56 2020] - DDoS Attack From IP: 162.243.145.9 Port: 55083 |
2020-07-16 20:02:50 |
| 162.243.145.78 | attackbots | [Sun Jun 21 02:59:49 2020] - DDoS Attack From IP: 162.243.145.78 Port: 38625 |
2020-07-16 19:59:34 |
| 162.243.145.36 | attackbots | [Fri Jun 12 05:30:59 2020] - DDoS Attack From IP: 162.243.145.36 Port: 35586 |
2020-07-13 03:28:40 |
| 162.243.145.80 | attack | [Mon Jun 15 02:54:28 2020] - DDoS Attack From IP: 162.243.145.80 Port: 35122 |
2020-07-13 03:13:20 |
| 162.243.145.9 | attackbots | [Fri Jun 19 22:32:58 2020] - DDoS Attack From IP: 162.243.145.9 Port: 55083 |
2020-07-13 02:44:34 |
b
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 162.243.145.44
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45914
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;162.243.145.44. IN A
;; AUTHORITY SECTION:
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019040100 1800 900 604800 86400
;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Tue Apr 02 00:18:35 +08 2019
;; MSG SIZE rcvd: 118
44.145.243.162.in-addr.arpa domain name pointer zg-0326a-70.stretchoid.com.
Server: 67.207.67.3
Address: 67.207.67.3#53
Non-authoritative answer:
44.145.243.162.in-addr.arpa name = zg-0326a-70.stretchoid.com.
Authoritative answers can be found from:
| IP | Type | Details | Datetime |
|---|---|---|---|
| 42.200.66.164 | attackspambots | Dec 2 09:49:27 vps666546 sshd\[7394\]: Invalid user hedetniemi from 42.200.66.164 port 52068 Dec 2 09:49:27 vps666546 sshd\[7394\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164 Dec 2 09:49:29 vps666546 sshd\[7394\]: Failed password for invalid user hedetniemi from 42.200.66.164 port 52068 ssh2 Dec 2 09:55:32 vps666546 sshd\[7682\]: Invalid user tmp from 42.200.66.164 port 35622 Dec 2 09:55:32 vps666546 sshd\[7682\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.200.66.164 ... |
2019-12-02 17:02:51 |
| 89.36.216.125 | attack | Dec 1 22:42:59 sachi sshd\[9876\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.36.216.125 user=root Dec 1 22:43:01 sachi sshd\[9876\]: Failed password for root from 89.36.216.125 port 44746 ssh2 Dec 1 22:50:42 sachi sshd\[10580\]: Invalid user lesli from 89.36.216.125 Dec 1 22:50:42 sachi sshd\[10580\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.36.216.125 Dec 1 22:50:44 sachi sshd\[10580\]: Failed password for invalid user lesli from 89.36.216.125 port 57694 ssh2 |
2019-12-02 16:54:40 |
| 35.238.162.217 | attack | SSH invalid-user multiple login attempts |
2019-12-02 16:31:24 |
| 92.50.249.166 | attack | Dec 1 22:35:12 tdfoods sshd\[19373\]: Invalid user moudry from 92.50.249.166 Dec 1 22:35:12 tdfoods sshd\[19373\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.166 Dec 1 22:35:14 tdfoods sshd\[19373\]: Failed password for invalid user moudry from 92.50.249.166 port 55356 ssh2 Dec 1 22:40:50 tdfoods sshd\[20078\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.166 user=root Dec 1 22:40:52 tdfoods sshd\[20078\]: Failed password for root from 92.50.249.166 port 37196 ssh2 |
2019-12-02 16:42:33 |
| 46.153.19.82 | attackbotsspam | Dec 1 22:27:30 hanapaa sshd\[11962\]: Invalid user ezella from 46.153.19.82 Dec 1 22:27:30 hanapaa sshd\[11962\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.153.19.82 Dec 1 22:27:32 hanapaa sshd\[11962\]: Failed password for invalid user ezella from 46.153.19.82 port 31019 ssh2 Dec 1 22:34:49 hanapaa sshd\[12712\]: Invalid user jira from 46.153.19.82 Dec 1 22:34:49 hanapaa sshd\[12712\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.153.19.82 |
2019-12-02 16:42:54 |
| 51.91.158.136 | attack | Dec 2 09:18:30 legacy sshd[10167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.158.136 Dec 2 09:18:31 legacy sshd[10167]: Failed password for invalid user amstest from 51.91.158.136 port 51120 ssh2 Dec 2 09:24:11 legacy sshd[10492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.158.136 ... |
2019-12-02 16:39:58 |
| 218.92.0.171 | attackbotsspam | 2019-12-02T09:55:59.631250vps751288.ovh.net sshd\[30313\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.171 user=root 2019-12-02T09:56:02.354880vps751288.ovh.net sshd\[30313\]: Failed password for root from 218.92.0.171 port 37396 ssh2 2019-12-02T09:56:05.903117vps751288.ovh.net sshd\[30313\]: Failed password for root from 218.92.0.171 port 37396 ssh2 2019-12-02T09:56:09.335321vps751288.ovh.net sshd\[30313\]: Failed password for root from 218.92.0.171 port 37396 ssh2 2019-12-02T09:56:13.180878vps751288.ovh.net sshd\[30313\]: Failed password for root from 218.92.0.171 port 37396 ssh2 |
2019-12-02 16:58:55 |
| 67.205.139.165 | attack | Dec 2 09:55:32 vmanager6029 sshd\[18198\]: Invalid user home from 67.205.139.165 port 48136 Dec 2 09:55:32 vmanager6029 sshd\[18198\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.139.165 Dec 2 09:55:35 vmanager6029 sshd\[18198\]: Failed password for invalid user home from 67.205.139.165 port 48136 ssh2 |
2019-12-02 17:00:14 |
| 114.70.93.64 | attackbotsspam | 2019-12-02T08:22:53.622157abusebot-6.cloudsearch.cf sshd\[30004\]: Invalid user zola from 114.70.93.64 port 55378 |
2019-12-02 16:23:40 |
| 195.84.49.20 | attack | May 18 13:07:25 vtv3 sshd[959]: Invalid user 123 from 195.84.49.20 port 43136 May 18 13:07:25 vtv3 sshd[959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20 May 18 13:19:05 vtv3 sshd[6473]: Invalid user s0p0rte from 195.84.49.20 port 45278 May 18 13:19:05 vtv3 sshd[6473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20 May 18 13:19:07 vtv3 sshd[6473]: Failed password for invalid user s0p0rte from 195.84.49.20 port 45278 ssh2 May 18 13:22:03 vtv3 sshd[8148]: Invalid user kr82@20140326 from 195.84.49.20 port 45820 May 18 13:22:03 vtv3 sshd[8148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20 May 18 13:33:48 vtv3 sshd[13509]: Invalid user 123 from 195.84.49.20 port 47970 May 18 13:33:48 vtv3 sshd[13509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.84.49.20 May 18 13:33:51 vtv3 sshd[13509]: Failed password |
2019-12-02 16:35:58 |
| 31.59.23.135 | attackspambots | Automatic report - Port Scan Attack |
2019-12-02 16:33:24 |
| 163.172.207.104 | attackbotsspam | \[2019-12-02 03:04:44\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-02T03:04:44.871-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="22011972592277524",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/53265",ACLName="no_extension_match" \[2019-12-02 03:08:45\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-02T03:08:45.944-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="33011972592277524",SessionID="0x7f26c429d578",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/51483",ACLName="no_extension_match" \[2019-12-02 03:12:32\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-02T03:12:32.149-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="44011972592277524",SessionID="0x7f26c429d578",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/163.172.207.104/53310",ACL |
2019-12-02 16:38:35 |
| 142.93.1.100 | attackspam | Dec 2 09:07:03 vps666546 sshd\[5418\]: Invalid user krasovec from 142.93.1.100 port 50950 Dec 2 09:07:03 vps666546 sshd\[5418\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.1.100 Dec 2 09:07:05 vps666546 sshd\[5418\]: Failed password for invalid user krasovec from 142.93.1.100 port 50950 ssh2 Dec 2 09:14:23 vps666546 sshd\[5821\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.1.100 user=root Dec 2 09:14:25 vps666546 sshd\[5821\]: Failed password for root from 142.93.1.100 port 34314 ssh2 ... |
2019-12-02 16:23:12 |
| 92.249.143.33 | attack | Dec 2 09:40:45 microserver sshd[55239]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.249.143.33 user=root Dec 2 09:40:47 microserver sshd[55239]: Failed password for root from 92.249.143.33 port 48089 ssh2 Dec 2 09:46:52 microserver sshd[56114]: Invalid user buch from 92.249.143.33 port 53847 Dec 2 09:46:52 microserver sshd[56114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.249.143.33 Dec 2 09:46:54 microserver sshd[56114]: Failed password for invalid user buch from 92.249.143.33 port 53847 ssh2 Dec 2 09:58:45 microserver sshd[57871]: Invalid user guest from 92.249.143.33 port 37108 Dec 2 09:58:45 microserver sshd[57871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.249.143.33 Dec 2 09:58:46 microserver sshd[57871]: Failed password for invalid user guest from 92.249.143.33 port 37108 ssh2 Dec 2 10:04:46 microserver sshd[58745]: pam_unix(sshd:auth): authenticatio |
2019-12-02 16:43:25 |
| 118.24.89.243 | attack | Dec 2 08:33:03 MK-Soft-VM8 sshd[15463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.24.89.243 Dec 2 08:33:05 MK-Soft-VM8 sshd[15463]: Failed password for invalid user zlsj123 from 118.24.89.243 port 37218 ssh2 ... |
2019-12-02 16:26:58 |