City: unknown
Region: unknown
Country: None
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 169.229.74.242
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31740
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;169.229.74.242. IN A
;; AUTHORITY SECTION:
. 440 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022062202 1800 900 604800 86400
;; Query time: 21 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Jun 23 06:03:41 CST 2022
;; MSG SIZE rcvd: 107242.74.229.169.in-addr.arpa domain name pointer fre-74-242.reshall.berkeley.edu.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
242.74.229.169.in-addr.arpa name = fre-74-242.reshall.berkeley.edu.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 5.189.160.177 | attackbotsspam | Aug 12 19:19:21 lcl-usvr-02 sshd[8403]: Invalid user celery from 5.189.160.177 port 37580 Aug 12 19:19:21 lcl-usvr-02 sshd[8403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.189.160.177 Aug 12 19:19:21 lcl-usvr-02 sshd[8403]: Invalid user celery from 5.189.160.177 port 37580 Aug 12 19:19:23 lcl-usvr-02 sshd[8403]: Failed password for invalid user celery from 5.189.160.177 port 37580 ssh2 Aug 12 19:23:26 lcl-usvr-02 sshd[9314]: Invalid user ark from 5.189.160.177 port 60524 ... |
2019-08-12 22:42:02 |
| 117.50.5.83 | attackbotsspam | Aug 12 17:25:43 vps647732 sshd[28617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.5.83 Aug 12 17:25:44 vps647732 sshd[28617]: Failed password for invalid user gen from 117.50.5.83 port 47856 ssh2 ... |
2019-08-12 23:27:48 |
| 89.248.172.85 | attackbotsspam | 08/12/2019-09:50:59.305705 89.248.172.85 Protocol: 6 ET SCAN NMAP -sS window 1024 |
2019-08-12 23:55:11 |
| 89.36.215.178 | attackbots | $f2bV_matches |
2019-08-12 23:45:24 |
| 185.248.140.224 | attack | Lines containing failures of 185.248.140.224 Aug 12 08:04:19 shared12 postfix/smtpd[27416]: connect from shadown.de[185.248.140.224] Aug x@x Aug 12 08:04:19 shared12 postfix/smtpd[27416]: disconnect from shadown.de[185.248.140.224] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 eclipset=1 quhostname=1 commands=6/8 Aug 12 08:30:42 shared12 postfix/smtpd[32431]: connect from shadown.de[185.248.140.224] Aug x@x Aug 12 08:30:42 shared12 postfix/smtpd[32431]: disconnect from shadown.de[185.248.140.224] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 eclipset=1 quhostname=1 commands=6/8 Aug 12 08:55:49 shared12 postfix/smtpd[4868]: connect from shadown.de[185.248.140.224] Aug x@x Aug 12 08:55:49 shared12 postfix/smtpd[4868]: disconnect from shadown.de[185.248.140.224] ehlo=2 starttls=1 mail=1 rcpt=0/1 data=0/1 eclipset=1 quhostname=1 commands=6/8 Aug 12 09:29:54 shared12 postfix/smtpd[4868]: connect from shadown.de[185.248.140.224] Aug x@x Aug 12 09:29:54 shared12 postfix/smtpd[4868]: ........ ------------------------------ |
2019-08-12 22:39:11 |
| 210.51.161.210 | attackbotsspam | Automatic report - Banned IP Access |
2019-08-12 23:46:42 |
| 218.161.9.63 | attack | "GET /mysql/admin/index.php?lang=en HTTP/1.1" 404 "GET /mysql/dbadmin/index.php?lang=en HTTP/1.1" 404 "GET /mysql/sqlmanager/index.php?lang=en HTTP/1.1" 404 "GET /mysql/mysqlmanager/index.php?lang=en HTTP/1.1" 404 "GET /phpmyadmin/index.php?lang=en HTTP/1.1" 404 "GET /phpMyadmin/index.php?lang=en HTTP/1.1" 404 "GET /phpMyAdmin/index.php?lang=en HTTP/1.1" 404 "GET /phpmyAdmin/index.php?lang=en HTTP/1.1" 404 "GET /phpmyadmin2/index.php?lang=en HTTP/1.1" 404 "GET /phpmyadmin3/index.php?lang=en HTTP/1.1" 404 |
2019-08-12 23:39:58 |
| 165.22.201.246 | attack | Aug 12 10:45:47 plusreed sshd[32009]: Invalid user sistemas from 165.22.201.246 ... |
2019-08-12 22:59:02 |
| 123.205.19.36 | attackbotsspam | " " |
2019-08-12 23:15:32 |
| 173.11.72.13 | attack | Aug 12 14:36:16 ip-172-31-62-245 sshd\[25035\]: Invalid user zedorf from 173.11.72.13\ Aug 12 14:36:18 ip-172-31-62-245 sshd\[25035\]: Failed password for invalid user zedorf from 173.11.72.13 port 57224 ssh2\ Aug 12 14:40:58 ip-172-31-62-245 sshd\[25135\]: Invalid user oracle from 173.11.72.13\ Aug 12 14:41:01 ip-172-31-62-245 sshd\[25135\]: Failed password for invalid user oracle from 173.11.72.13 port 51274 ssh2\ Aug 12 14:45:29 ip-172-31-62-245 sshd\[25156\]: Invalid user sarah from 173.11.72.13\ |
2019-08-12 23:41:59 |
| 129.45.22.89 | attack | Aug 12 14:20:26 mxgate1 postfix/postscreen[26944]: CONNECT from [129.45.22.89]:63652 to [176.31.12.44]:25 Aug 12 14:20:26 mxgate1 postfix/dnsblog[27112]: addr 129.45.22.89 listed by domain zen.spamhaus.org as 127.0.0.4 Aug 12 14:20:26 mxgate1 postfix/dnsblog[27112]: addr 129.45.22.89 listed by domain zen.spamhaus.org as 127.0.0.11 Aug 12 14:20:26 mxgate1 postfix/dnsblog[27113]: addr 129.45.22.89 listed by domain cbl.abuseat.org as 127.0.0.2 Aug 12 14:20:26 mxgate1 postfix/dnsblog[27116]: addr 129.45.22.89 listed by domain b.barracudacentral.org as 127.0.0.2 Aug 12 14:20:32 mxgate1 postfix/postscreen[26944]: DNSBL rank 4 for [129.45.22.89]:63652 Aug x@x Aug 12 14:20:32 mxgate1 postfix/postscreen[26944]: HANGUP after 0.27 from [129.45.22.89]:63652 in tests after SMTP handshake Aug 12 14:20:32 mxgate1 postfix/postscreen[26944]: DISCONNECT [129.45.22.89]:63652 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=129.45.22.89 |
2019-08-12 23:27:05 |
| 49.88.112.54 | attackbotsspam | Aug 12 15:53:04 piServer sshd\[11781\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.54 user=root Aug 12 15:53:06 piServer sshd\[11781\]: Failed password for root from 49.88.112.54 port 61615 ssh2 Aug 12 15:53:09 piServer sshd\[11781\]: Failed password for root from 49.88.112.54 port 61615 ssh2 Aug 12 15:53:12 piServer sshd\[11781\]: Failed password for root from 49.88.112.54 port 61615 ssh2 Aug 12 15:53:15 piServer sshd\[11781\]: Failed password for root from 49.88.112.54 port 61615 ssh2 ... |
2019-08-12 22:49:52 |
| 172.217.15.110 | attack | # NetRange: 172.217.0.0 172.217.255.255 CIDR: 172.217.0.0/16 NetName: GOOGLE Referer: http://pixelrz.com/lists/keywords/t....ears-jeffrey-reimer-porn/ Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: staticxx.facebook.com DNT: 1 Connection: Keep-Alive" (Indicator: "facebook.com") "HTTP/1.1 200 OK Base64 encoder/decoder Interesting http://www.dhsem.state.co.us/ Found malicious artifacts related to "172.217.15.110": ... File SHA256: bfdf9962a94e07d72a1aee1e14e5872218f680d681ea32346250fe86fddd33aa (AV positives: 59/74 scanned on 08/12/2019 05:51:24) A Network Trojan was Detected Ongoing harassment Malicious website #infected Female #sexualcontactvictim Targeted Retaliation Framing Fraud Spying Ransomware Pixelrz.com NAMECHEAP INC Creation date 2 years ago |
2019-08-12 23:05:08 |
| 89.248.168.107 | attackbotsspam | Aug 12 16:42:30 h2177944 kernel: \[3944713.840610\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=89.248.168.107 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=61234 PROTO=TCP SPT=53590 DPT=5380 WINDOW=1024 RES=0x00 SYN URGP=0 Aug 12 16:47:29 h2177944 kernel: \[3945013.024619\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=89.248.168.107 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=43769 PROTO=TCP SPT=53636 DPT=5762 WINDOW=1024 RES=0x00 SYN URGP=0 Aug 12 16:52:23 h2177944 kernel: \[3945306.971301\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=89.248.168.107 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=24593 PROTO=TCP SPT=53622 DPT=5671 WINDOW=1024 RES=0x00 SYN URGP=0 Aug 12 16:53:40 h2177944 kernel: \[3945383.372488\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=89.248.168.107 DST=85.214.117.9 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=20 PROTO=TCP SPT=53590 DPT=5343 WINDOW=1024 RES=0x00 SYN URGP=0 Aug 12 16:54:34 h2177944 kernel: \[3945438.293112\] \[UFW BLOCK\] IN=venet0 OUT= MAC= SRC=89.248.168.107 DST=85.214.117 |
2019-08-12 23:01:05 |
| 90.45.254.108 | attackbotsspam | Aug 12 15:15:05 MK-Soft-VM3 sshd\[30183\]: Invalid user max from 90.45.254.108 port 41480 Aug 12 15:15:05 MK-Soft-VM3 sshd\[30183\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.45.254.108 Aug 12 15:15:07 MK-Soft-VM3 sshd\[30183\]: Failed password for invalid user max from 90.45.254.108 port 41480 ssh2 ... |
2019-08-12 23:32:31 |