City: Durban
Region: KwaZulu-Natal
Country: South Africa
Internet Service Provider: Afrihost (Pty) Ltd
Hostname: unknown
Organization: Afrihost
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attack | May 6 01:50:38 server sshd\[136559\]: Invalid user www from 169.0.166.54 May 6 01:50:38 server sshd\[136559\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=169.0.166.54 May 6 01:50:41 server sshd\[136559\]: Failed password for invalid user www from 169.0.166.54 port 47265 ssh2 ... |
2019-10-09 12:52:06 |
b
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 169.0.166.54
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 20203
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;169.0.166.54. IN A
;; AUTHORITY SECTION:
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019050900 1800 900 604800 86400
;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Thu May 09 20:59:10 +08 2019
;; MSG SIZE rcvd: 116
54.166.0.169.in-addr.arpa domain name pointer 169-0-166-54.ip.afrihost.co.za.
Server: 67.207.67.3
Address: 67.207.67.3#53
Non-authoritative answer:
54.166.0.169.in-addr.arpa name = 169-0-166-54.ip.afrihost.co.za.
Authoritative answers can be found from:
| IP | Type | Details | Datetime |
|---|---|---|---|
| 165.22.15.7 | attackbots | DigitalOcean BotNet attack - 10s of requests to non- pages - :443/app-ads.txt - typically bursts of 8 requests per second - undefined, XSS attacks UA removed |
2020-04-02 05:15:37 |
| 159.89.165.5 | attack | 2020-04-01T21:16:30.395652abusebot.cloudsearch.cf sshd[29693]: Invalid user www from 159.89.165.5 port 39900 2020-04-01T21:16:30.402883abusebot.cloudsearch.cf sshd[29693]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.165.5 2020-04-01T21:16:30.395652abusebot.cloudsearch.cf sshd[29693]: Invalid user www from 159.89.165.5 port 39900 2020-04-01T21:16:32.436532abusebot.cloudsearch.cf sshd[29693]: Failed password for invalid user www from 159.89.165.5 port 39900 ssh2 2020-04-01T21:21:25.970361abusebot.cloudsearch.cf sshd[30055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.165.5 user=root 2020-04-01T21:21:28.501048abusebot.cloudsearch.cf sshd[30055]: Failed password for root from 159.89.165.5 port 52000 ssh2 2020-04-01T21:25:59.162918abusebot.cloudsearch.cf sshd[30432]: Invalid user jiachen from 159.89.165.5 port 35852 ... |
2020-04-02 05:31:49 |
| 94.28.101.166 | attack | Apr 1 14:15:52 mockhub sshd[15088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.28.101.166 Apr 1 14:15:53 mockhub sshd[15088]: Failed password for invalid user ranger from 94.28.101.166 port 44422 ssh2 ... |
2020-04-02 05:29:43 |
| 82.200.65.218 | attack | Apr 1 15:59:22 ws22vmsma01 sshd[155393]: Failed password for root from 82.200.65.218 port 39012 ssh2 ... |
2020-04-02 05:17:51 |
| 104.248.117.234 | attackspam | 2020-04-01T19:19:08.918600abusebot-5.cloudsearch.cf sshd[18602]: Invalid user ldhong from 104.248.117.234 port 38820 2020-04-01T19:19:08.925168abusebot-5.cloudsearch.cf sshd[18602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.117.234 2020-04-01T19:19:08.918600abusebot-5.cloudsearch.cf sshd[18602]: Invalid user ldhong from 104.248.117.234 port 38820 2020-04-01T19:19:11.546943abusebot-5.cloudsearch.cf sshd[18602]: Failed password for invalid user ldhong from 104.248.117.234 port 38820 ssh2 2020-04-01T19:23:09.864019abusebot-5.cloudsearch.cf sshd[18734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.117.234 user=root 2020-04-01T19:23:11.903851abusebot-5.cloudsearch.cf sshd[18734]: Failed password for root from 104.248.117.234 port 50710 ssh2 2020-04-01T19:26:50.122460abusebot-5.cloudsearch.cf sshd[18755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= r ... |
2020-04-02 05:14:55 |
| 41.139.133.163 | attackbotsspam | Unauthorized connection attempt from IP address 41.139.133.163 on Port 445(SMB) |
2020-04-02 05:33:42 |
| 14.186.187.165 | attack | 20/4/1@08:26:53: FAIL: Alarm-Network address from=14.186.187.165 ... |
2020-04-02 05:06:18 |
| 43.240.103.186 | attackbotsspam | Unauthorized connection attempt from IP address 43.240.103.186 on Port 445(SMB) |
2020-04-02 05:46:17 |
| 104.236.142.89 | attackspam | Apr 1 23:12:48 ns382633 sshd\[23622\]: Invalid user qa from 104.236.142.89 port 58926 Apr 1 23:12:48 ns382633 sshd\[23622\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89 Apr 1 23:12:49 ns382633 sshd\[23622\]: Failed password for invalid user qa from 104.236.142.89 port 58926 ssh2 Apr 1 23:15:55 ns382633 sshd\[24427\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.142.89 user=root Apr 1 23:15:58 ns382633 sshd\[24427\]: Failed password for root from 104.236.142.89 port 47536 ssh2 |
2020-04-02 05:22:44 |
| 37.49.226.117 | attack | SIPVicious Scanner Detection |
2020-04-02 05:47:13 |
| 1.209.72.151 | attack | trying to access non-authorized port |
2020-04-02 05:28:12 |
| 167.114.113.141 | attackspam | 2020-04-01T20:18:14.020223ionos.janbro.de sshd[31907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.113.141 user=root 2020-04-01T20:18:16.643226ionos.janbro.de sshd[31907]: Failed password for root from 167.114.113.141 port 51004 ssh2 2020-04-01T20:22:25.704342ionos.janbro.de sshd[31916]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.113.141 user=root 2020-04-01T20:22:28.264411ionos.janbro.de sshd[31916]: Failed password for root from 167.114.113.141 port 34230 ssh2 2020-04-01T20:26:45.328207ionos.janbro.de sshd[31940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.114.113.141 user=root 2020-04-01T20:26:47.272823ionos.janbro.de sshd[31940]: Failed password for root from 167.114.113.141 port 45684 ssh2 2020-04-01T20:30:59.030555ionos.janbro.de sshd[31953]: Invalid user guoxiaochun from 167.114.113.141 port 57132 2020-04-01T20:30:59.479881i ... |
2020-04-02 05:09:02 |
| 218.92.0.178 | attackspam | Apr 1 23:23:24 vps sshd[21815]: Failed password for root from 218.92.0.178 port 53435 ssh2 Apr 1 23:23:28 vps sshd[21815]: Failed password for root from 218.92.0.178 port 53435 ssh2 Apr 1 23:23:31 vps sshd[21815]: Failed password for root from 218.92.0.178 port 53435 ssh2 Apr 1 23:23:34 vps sshd[21815]: Failed password for root from 218.92.0.178 port 53435 ssh2 ... |
2020-04-02 05:28:51 |
| 159.89.183.168 | attack | WordPress wp-login brute force :: 159.89.183.168 0.092 BYPASS [01/Apr/2020:21:16:00 0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" |
2020-04-02 05:21:22 |
| 106.12.158.252 | attackspam | Apr 1 22:00:46 ovpn sshd\[28881\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.158.252 user=root Apr 1 22:00:47 ovpn sshd\[28881\]: Failed password for root from 106.12.158.252 port 35196 ssh2 Apr 1 22:25:04 ovpn sshd\[1966\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.158.252 user=root Apr 1 22:25:06 ovpn sshd\[1966\]: Failed password for root from 106.12.158.252 port 33892 ssh2 Apr 1 22:28:59 ovpn sshd\[2842\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.158.252 user=root |
2020-04-02 05:11:11 |