City: unknown
Region: unknown
Country: United States of America (the)
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 172.46.97.30
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58668
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;172.46.97.30. IN A
;; AUTHORITY SECTION:
. 30 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025022000 1800 900 604800 86400
;; Query time: 424 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Feb 21 00:01:22 CST 2025
;; MSG SIZE rcvd: 105Host 30.97.46.172.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 30.97.46.172.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 206.253.224.75 | attackbots | srvr2: (mod_security) mod_security (id:920350) triggered by 206.253.224.75 (DE/-/-): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/28 11:08:29 [error] 377966#0: *172733 [client 206.253.224.75] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/robots.txt"] [unique_id "159860570966.376346"] [ref "o0,14v160,14"], client: 206.253.224.75, [redacted] request: "GET /robots.txt HTTP/1.1" [redacted] |
2020-08-28 17:40:04 |
| 200.194.15.145 | attackspambots | port scan and connect, tcp 23 (telnet) |
2020-08-28 17:35:18 |
| 51.15.229.198 | attackbotsspam | Invalid user xp from 51.15.229.198 port 59012 |
2020-08-28 18:02:51 |
| 145.239.82.11 | attackbotsspam | Invalid user sshuser from 145.239.82.11 port 41056 |
2020-08-28 18:05:01 |
| 197.235.10.121 | attack | Invalid user administrator from 197.235.10.121 port 53002 |
2020-08-28 17:29:34 |
| 45.160.121.60 | attackspam | Port probing on unauthorized port 23 |
2020-08-28 18:04:41 |
| 212.237.0.10 | attackspam | Invalid user rob from 212.237.0.10 port 49554 |
2020-08-28 17:45:35 |
| 188.80.49.202 | attack | Aug 28 05:54:13 rocket sshd[30848]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.80.49.202 Aug 28 05:54:13 rocket sshd[30850]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.80.49.202 Aug 28 05:54:15 rocket sshd[30848]: Failed password for invalid user pi from 188.80.49.202 port 50063 ssh2 Aug 28 05:54:15 rocket sshd[30850]: Failed password for invalid user pi from 188.80.49.202 port 58917 ssh2 ... |
2020-08-28 17:49:33 |
| 72.210.252.134 | attackbots | Dovecot Invalid User Login Attempt. |
2020-08-28 17:38:12 |
| 222.186.175.217 | attack | Aug 28 12:31:19 ift sshd\[25423\]: Failed password for root from 222.186.175.217 port 33518 ssh2Aug 28 12:31:29 ift sshd\[25423\]: Failed password for root from 222.186.175.217 port 33518 ssh2Aug 28 12:31:33 ift sshd\[25423\]: Failed password for root from 222.186.175.217 port 33518 ssh2Aug 28 12:31:39 ift sshd\[25453\]: Failed password for root from 222.186.175.217 port 32398 ssh2Aug 28 12:32:01 ift sshd\[25462\]: Failed password for root from 222.186.175.217 port 60020 ssh2 ... |
2020-08-28 17:39:35 |
| 111.230.200.244 | attack | Port scanning [2 denied] |
2020-08-28 17:51:53 |
| 122.51.72.249 | attackbots | Aug 28 10:42:04 srv-ubuntu-dev3 sshd[16585]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.72.249 user=root Aug 28 10:42:06 srv-ubuntu-dev3 sshd[16585]: Failed password for root from 122.51.72.249 port 52896 ssh2 Aug 28 10:45:24 srv-ubuntu-dev3 sshd[17001]: Invalid user contabil from 122.51.72.249 Aug 28 10:45:24 srv-ubuntu-dev3 sshd[17001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.72.249 Aug 28 10:45:24 srv-ubuntu-dev3 sshd[17001]: Invalid user contabil from 122.51.72.249 Aug 28 10:45:26 srv-ubuntu-dev3 sshd[17001]: Failed password for invalid user contabil from 122.51.72.249 port 58954 ssh2 Aug 28 10:48:39 srv-ubuntu-dev3 sshd[17379]: Invalid user samba from 122.51.72.249 Aug 28 10:48:39 srv-ubuntu-dev3 sshd[17379]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.72.249 Aug 28 10:48:39 srv-ubuntu-dev3 sshd[17379]: Invalid user samba fr ... |
2020-08-28 17:58:53 |
| 89.248.160.150 | attackspambots | 89.248.160.150 was recorded 7 times by 4 hosts attempting to connect to the following ports: 41095,41093. Incident counter (4h, 24h, all-time): 7, 34, 16283 |
2020-08-28 17:32:41 |
| 107.189.10.119 | attackbotsspam | $f2bV_matches |
2020-08-28 17:26:24 |
| 139.199.1.166 | attack | Aug 28 10:48:09 webhost01 sshd[26689]: Failed password for root from 139.199.1.166 port 56142 ssh2 Aug 28 10:49:50 webhost01 sshd[26731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.1.166 ... |
2020-08-28 17:27:56 |