Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: Tehran

Region: Ostan-e Tehran

Country: Iran

Internet Service Provider: Ravand Tazeh Co .Pjs.

Hostname: unknown

Organization: Ravand Tazeh Co,.PJS.

Usage Type: Commercial

Comments:
Type Details Datetime
attack
Jul  8 20:46:17 pi sshd[9685]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149 
Jul  8 20:46:18 pi sshd[9685]: Failed password for invalid user web from 164.138.23.149 port 55405 ssh2
2020-07-24 05:58:19
attackspam
Jul  6 15:37:25 lnxded63 sshd[6634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149
2020-07-06 21:47:57
attackbots
Jun 24 09:02:35 onepixel sshd[2004036]: Failed password for invalid user nuevo from 164.138.23.149 port 59358 ssh2
Jun 24 09:05:58 onepixel sshd[2006191]: Invalid user oracle from 164.138.23.149 port 56071
Jun 24 09:05:58 onepixel sshd[2006191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149 
Jun 24 09:05:58 onepixel sshd[2006191]: Invalid user oracle from 164.138.23.149 port 56071
Jun 24 09:06:00 onepixel sshd[2006191]: Failed password for invalid user oracle from 164.138.23.149 port 56071 ssh2
2020-06-24 18:38:22
attackbots
Jun 16 00:12:30 cosmoit sshd[7176]: Failed password for root from 164.138.23.149 port 50506 ssh2
2020-06-16 08:43:56
attack
Jun 12 19:15:51 itv-usvr-01 sshd[30003]: Invalid user admin from 164.138.23.149
2020-06-12 20:24:35
attackbotsspam
2020-06-08T08:12:04.526569linuxbox-skyline sshd[223452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
2020-06-08T08:12:06.154202linuxbox-skyline sshd[223452]: Failed password for root from 164.138.23.149 port 41854 ssh2
...
2020-06-09 00:15:24
attackbots
Brute force attempt
2020-06-05 04:27:59
attackbotsspam
(sshd) Failed SSH login from 164.138.23.149 (IR/Iran/-): 5 in the last 3600 secs
2020-06-03 16:49:16
attackbotsspam
Jun  2 03:51:21 *** sshd[29290]: User root from 164.138.23.149 not allowed because not listed in AllowUsers
2020-06-02 15:22:02
attackbotsspam
May 31 23:42:41 abendstille sshd\[12409\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
May 31 23:42:43 abendstille sshd\[12409\]: Failed password for root from 164.138.23.149 port 51538 ssh2
May 31 23:45:30 abendstille sshd\[15281\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
May 31 23:45:32 abendstille sshd\[15281\]: Failed password for root from 164.138.23.149 port 44071 ssh2
May 31 23:48:14 abendstille sshd\[18098\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149  user=root
...
2020-06-01 05:56:27
attackbotsspam
May 28 07:17:10 vmd17057 sshd[28648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149 
May 28 07:17:13 vmd17057 sshd[28648]: Failed password for invalid user svn from 164.138.23.149 port 43569 ssh2
...
2020-05-28 17:29:20
attackspam
Failed password for root from 164.138.23.149 port 41959 ssh2
Invalid user samba from 164.138.23.149 port 51025
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149
Invalid user samba from 164.138.23.149 port 51025
Failed password for invalid user samba from 164.138.23.149 port 51025 ssh2
2020-05-28 07:42:29
attack
2020-05-24 20:33:39 server sshd[13040]: Failed password for invalid user admin from 164.138.23.149 port 56737 ssh2
2020-05-26 02:38:35
attackbots
SSH login attempts.
2020-05-24 19:06:33
attackbotsspam
Invalid user kgp from 164.138.23.149 port 56826
2020-05-23 14:57:53
attackspam
May  8 06:14:09 inter-technics sshd[6870]: Invalid user nils from 164.138.23.149 port 37391
May  8 06:14:09 inter-technics sshd[6870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.138.23.149
May  8 06:14:09 inter-technics sshd[6870]: Invalid user nils from 164.138.23.149 port 37391
May  8 06:14:11 inter-technics sshd[6870]: Failed password for invalid user nils from 164.138.23.149 port 37391 ssh2
May  8 06:17:40 inter-technics sshd[7199]: Invalid user wcj from 164.138.23.149 port 37269
...
2020-05-08 19:58:10
Comments on same subnet:
IP Type Details Datetime
164.138.236.227 attack
Sending SPAM email
2020-04-05 10:33:04
164.138.236.227 attack
spam
2020-01-22 16:22:40
164.138.236.227 attackspambots
2020-01-17 07:02:51 H=(164.138.236.227.asas.net) [164.138.236.227]:55366 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/query/ip/164.138.236.227)
2020-01-17 07:02:51 H=(164.138.236.227.asas.net) [164.138.236.227]:55366 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.3, 127.0.0.4) (https://www.spamhaus.org/sbl/query/SBLCSS)
2020-01-17 07:02:52 H=(164.138.236.227.asas.net) [164.138.236.227]:55366 I=[192.147.25.65]:25 F= rejected RCPT : RBL: found in thrukfz5b56tq6xao6odgdyjrq.zen.dq.spamhaus.net (127.0.0.4, 127.0.0.3) (https://www.spamhaus.org/sbl/query/SBLCSS)
...
2020-01-17 22:58:05
164.138.236.227 attackbotsspam
postfix (unknown user, SPF fail or relay access denied)
2019-10-19 13:07:39
Whois info:
b
Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 164.138.23.149
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 49904
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;164.138.23.149.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019042500 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Thu Apr 25 21:51:24 +08 2019
;; MSG SIZE  rcvd: 118

Host info
Host 149.23.138.164.in-addr.arpa. not found: 3(NXDOMAIN)
Nslookup info:
Server:		67.207.67.3
Address:	67.207.67.3#53

** server can't find 149.23.138.164.in-addr.arpa: NXDOMAIN

Related IP info:
Related comments:
IP Type Details Datetime
77.247.109.61 attackspam
\[2019-12-01 07:01:04\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-01T07:01:04.686-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="8292301148343508003",SessionID="0x7f26c445f668",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.109.61/63208",ACLName="no_extension_match"
\[2019-12-01 07:01:17\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-01T07:01:17.949-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="7338001148525260102",SessionID="0x7f26c4a90648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.109.61/50732",ACLName="no_extension_match"
\[2019-12-01 07:01:43\] SECURITY\[2765\] res_security_log.c: SecurityEvent="FailedACL",EventTV="2019-12-01T07:01:43.847-0500",Severity="Error",Service="SIP",EventVersion="1",AccountID="9254701148556213001",SessionID="0x7f26c4964a88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/77.247.109.61/60607",ACL
2019-12-01 20:13:32
80.82.70.118 attackbots
12/01/2019-12:21:20.344829 80.82.70.118 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 82
2019-12-01 20:05:31
181.48.69.155 attackspam
UTC: 2019-11-30 port: 23/tcp
2019-12-01 20:08:42
80.82.77.33 attackspambots
12/01/2019-05:14:59.095145 80.82.77.33 Protocol: 6 ET DROP Dshield Block Listed Source group 1
2019-12-01 20:27:04
114.42.166.31 attackspam
Unauthorised access (Dec  1) SRC=114.42.166.31 LEN=52 TTL=107 ID=30387 DF TCP DPT=445 WINDOW=8192 SYN
2019-12-01 20:17:01
122.52.111.105 attackspambots
UTC: 2019-11-30 port: 23/tcp
2019-12-01 20:10:30
202.173.126.71 attack
Tried sshing with brute force.
2019-12-01 20:17:45
95.173.236.233 attackbotsspam
Automatic report - Banned IP Access
2019-12-01 19:53:22
218.92.0.208 attackspam
2019-12-01T11:45:42.404999abusebot-7.cloudsearch.cf sshd\[15327\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root
2019-12-01 20:08:59
83.23.189.102 attack
UTC: 2019-11-30 port: 23/tcp
2019-12-01 20:22:13
182.61.40.227 attackbotsspam
Dec  1 09:57:30 yesfletchmain sshd\[24781\]: Invalid user invitado from 182.61.40.227 port 43782
Dec  1 09:57:30 yesfletchmain sshd\[24781\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.40.227
Dec  1 09:57:32 yesfletchmain sshd\[24781\]: Failed password for invalid user invitado from 182.61.40.227 port 43782 ssh2
Dec  1 10:01:00 yesfletchmain sshd\[24850\]: User root from 182.61.40.227 not allowed because not listed in AllowUsers
Dec  1 10:01:00 yesfletchmain sshd\[24850\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.40.227  user=root
...
2019-12-01 20:30:36
31.200.12.3 attack
Lines containing failures of 31.200.12.3
Dec  1 11:55:20 majoron sshd[13723]: Invalid user admin from 31.200.12.3 port 33942
Dec  1 11:55:20 majoron sshd[13723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.200.12.3 
Dec  1 11:55:22 majoron sshd[13723]: Failed password for invalid user admin from 31.200.12.3 port 33942 ssh2


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=31.200.12.3
2019-12-01 20:02:15
115.159.86.75 attackbots
Dec  1 10:36:05 host sshd[4111]: Invalid user bissig from 115.159.86.75 port 46859
...
2019-12-01 20:14:25
113.199.254.164 attack
Dec  1 06:23:24 marvibiene sshd[22615]: Invalid user media from 113.199.254.164 port 14326
Dec  1 06:23:25 marvibiene sshd[22615]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.199.254.164
Dec  1 06:23:24 marvibiene sshd[22615]: Invalid user media from 113.199.254.164 port 14326
Dec  1 06:23:27 marvibiene sshd[22615]: Failed password for invalid user media from 113.199.254.164 port 14326 ssh2
...
2019-12-01 20:11:27
112.85.42.176 attackbots
DATE:2019-12-01 13:28:08,IP:112.85.42.176,MATCHES:10,PORT:ssh
2019-12-01 20:30:04

Recently Reported IPs

84.2.228.152 32.47.242.140 89.162.143.170 212.26.247.7
13.225.168.90 1.46.237.12 183.35.60.162 217.189.190.172
162.244.83.249 46.42.145.184 177.204.87.87 23.88.224.179
160.212.232.250 31.150.172.238 14.248.111.99 118.220.158.234
95.173.163.140 66.10.198.193 145.58.9.97 57.144.241.250