City: Villa Ballester
Region: Buenos Aires Province
Country: Argentina
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
| IP | Type | Details | Datetime |
|---|---|---|---|
| 181.46.164.9 | attackbots | (cxs) cxs mod_security triggered by 181.46.164.9 (AR/Argentina/cpe-181-46-164-9.telecentro-reversos.com.ar): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_CXS; Logs: [Thu Sep 10 18:55:20.401814 2020] [:error] [pid 3943566:tid 47466712020736] [client 181.46.164.9:17461] [client 181.46.164.9] ModSecurity: Access denied with code 403 (phase 2). File "/tmp/20200910-185518-X1padp1cg7rkBOBCfBdcDgAAAA0-file-JRUfUL" rejected by the approver script "/etc/cxs/cxscgi.sh": 0 [file "/etc/apache2/conf.d/modsec_vendor_configs/configserver/00_configserver.conf"] [line "7"] [id "1010101"] [msg "ConfigServer Exploit Scanner (cxs) triggered"] [severity "CRITICAL"] [hostname "gastro-ptuj.si"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "X1padp1cg7rkBOBCfBdcDgAAAA0"], referer: http://gastro-ptuj.si/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php |
2020-09-11 23:34:52 |
| 181.46.164.9 | attackspambots | (cxs) cxs mod_security triggered by 181.46.164.9 (AR/Argentina/cpe-181-46-164-9.telecentro-reversos.com.ar): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_CXS; Logs: [Thu Sep 10 18:55:20.401814 2020] [:error] [pid 3943566:tid 47466712020736] [client 181.46.164.9:17461] [client 181.46.164.9] ModSecurity: Access denied with code 403 (phase 2). File "/tmp/20200910-185518-X1padp1cg7rkBOBCfBdcDgAAAA0-file-JRUfUL" rejected by the approver script "/etc/cxs/cxscgi.sh": 0 [file "/etc/apache2/conf.d/modsec_vendor_configs/configserver/00_configserver.conf"] [line "7"] [id "1010101"] [msg "ConfigServer Exploit Scanner (cxs) triggered"] [severity "CRITICAL"] [hostname "gastro-ptuj.si"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "X1padp1cg7rkBOBCfBdcDgAAAA0"], referer: http://gastro-ptuj.si/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php |
2020-09-11 15:37:05 |
| 181.46.164.9 | attack | (cxs) cxs mod_security triggered by 181.46.164.9 (AR/Argentina/cpe-181-46-164-9.telecentro-reversos.com.ar): 1 in the last 3600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_CXS; Logs: [Thu Sep 10 18:55:20.401814 2020] [:error] [pid 3943566:tid 47466712020736] [client 181.46.164.9:17461] [client 181.46.164.9] ModSecurity: Access denied with code 403 (phase 2). File "/tmp/20200910-185518-X1padp1cg7rkBOBCfBdcDgAAAA0-file-JRUfUL" rejected by the approver script "/etc/cxs/cxscgi.sh": 0 [file "/etc/apache2/conf.d/modsec_vendor_configs/configserver/00_configserver.conf"] [line "7"] [id "1010101"] [msg "ConfigServer Exploit Scanner (cxs) triggered"] [severity "CRITICAL"] [hostname "gastro-ptuj.si"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "X1padp1cg7rkBOBCfBdcDgAAAA0"], referer: http://gastro-ptuj.si/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php |
2020-09-11 07:48:40 |
| 181.46.164.106 | attackspam | php WP PHPmyadamin ABUSE blocked for 12h |
2020-08-17 15:22:17 |
| 181.46.164.4 | attack | 2019-11-08T23:35:40.284638 X postfix/smtpd[49872]: NOQUEUE: reject: RCPT from unknown[181.46.164.4]: 554 5.7.1 Service unavailable; Client host [181.46.164.4] blocked using zen.spamhaus.org; https://www.spamhaus.org/query/ip/181.46.164.4; from= |
2019-11-09 07:26:35 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 181.46.164.19
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58362
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;181.46.164.19. IN A
;; AUTHORITY SECTION:
. 532 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2023080902 1800 900 604800 86400
;; Query time: 66 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Aug 10 09:23:04 CST 2023
;; MSG SIZE rcvd: 10619.164.46.181.in-addr.arpa domain name pointer cpe-181-46-164-19.telecentro-reversos.com.ar.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
19.164.46.181.in-addr.arpa name = cpe-181-46-164-19.telecentro-reversos.com.ar.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 14.243.151.202 | attackbots | Unauthorized connection attempt from IP address 14.243.151.202 on Port 445(SMB) |
2019-07-22 19:13:32 |
| 185.135.225.53 | attack | Honeypot attack, port: 23, PTR: 53.225.135.185.easy-com.pl. |
2019-07-22 19:30:00 |
| 81.18.156.138 | attackbotsspam | Unauthorized connection attempt from IP address 81.18.156.138 on Port 445(SMB) |
2019-07-22 20:05:38 |
| 39.64.142.113 | attackspambots | firewall-block, port(s): 23/tcp |
2019-07-22 19:30:53 |
| 190.5.111.115 | attack | Unauthorised access (Jul 22) SRC=190.5.111.115 LEN=40 TTL=234 ID=50826 TCP DPT=445 WINDOW=1024 SYN |
2019-07-22 20:03:00 |
| 182.253.186.139 | attackspambots | Unauthorized connection attempt from IP address 182.253.186.139 on Port 445(SMB) |
2019-07-22 19:58:23 |
| 79.174.24.202 | attackspambots | Honeypot attack, port: 23, PTR: PTR record not found |
2019-07-22 19:44:18 |
| 172.81.204.249 | attackbots | Jul 22 14:19:03 server sshd\[4898\]: Invalid user account from 172.81.204.249 port 60306 Jul 22 14:19:03 server sshd\[4898\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.204.249 Jul 22 14:19:05 server sshd\[4898\]: Failed password for invalid user account from 172.81.204.249 port 60306 ssh2 Jul 22 14:23:09 server sshd\[27094\]: Invalid user admin2 from 172.81.204.249 port 40626 Jul 22 14:23:09 server sshd\[27094\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.204.249 |
2019-07-22 19:31:38 |
| 36.65.16.28 | attack | Unauthorized connection attempt from IP address 36.65.16.28 on Port 445(SMB) |
2019-07-22 19:48:05 |
| 222.120.192.102 | attackspambots | Jul 22 11:10:39 [munged] sshd[20332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.120.192.102 |
2019-07-22 19:57:18 |
| 171.223.165.122 | attack | Honeypot attack, port: 445, PTR: PTR record not found |
2019-07-22 19:14:43 |
| 113.161.220.150 | attackspam | Unauthorized connection attempt from IP address 113.161.220.150 on Port 445(SMB) |
2019-07-22 19:22:56 |
| 43.242.241.218 | attackbots | @LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-22 10:22:26,561 INFO [amun_request_handler] PortScan Detected on Port: 445 (43.242.241.218) |
2019-07-22 19:27:22 |
| 123.24.79.152 | attack | Unauthorized connection attempt from IP address 123.24.79.152 on Port 445(SMB) |
2019-07-22 20:03:22 |
| 131.72.34.25 | attackbotsspam | Automatic report - Port Scan Attack |
2019-07-22 19:15:55 |