189.125.93.48 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Brazil

Internet Service Provider: AV Presidente Kenedy

Hostname: unknown

Organization: unknown

Usage Type: Government

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Banned for a week because repeated abuses, for example SSH, but not only	2020-10-08 02:31:59
attackspambots	189.125.93.48 (BR/Brazil/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 7 02:24:38 server5 sshd[17215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 user=root Oct 7 02:24:40 server5 sshd[17215]: Failed password for root from 189.125.93.48 port 50606 ssh2 Oct 7 02:24:28 server5 sshd[16963]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.0.92 user=root Oct 7 02:24:30 server5 sshd[16963]: Failed password for root from 64.227.0.92 port 35944 ssh2 Oct 7 02:24:19 server5 sshd[16854]: Failed password for root from 220.132.75.140 port 52846 ssh2 Oct 7 02:25:30 server5 sshd[17373]: Failed password for root from 45.55.182.232 port 53090 ssh2 IP Addresses Blocked:	2020-10-07 18:44:30
attackspam	Invalid user vikas from 189.125.93.48 port 55068	2020-09-27 07:15:44
attackspambots	Connection to SSH Honeypot - Detected by HoneypotDB	2020-09-26 23:44:31
attackspam	Invalid user user from 189.125.93.48 port 53258	2020-09-26 15:35:31
attackbots	Triggered by Fail2Ban at Ares web server	2020-08-31 22:32:01
attack	Aug 9 23:24:10 rocket sshd[18660]: Failed password for root from 189.125.93.48 port 33030 ssh2 Aug 9 23:28:41 rocket sshd[19319]: Failed password for root from 189.125.93.48 port 42834 ssh2 ...	2020-08-10 06:49:04
attackbots	Aug 9 04:42:44 sigma sshd\[4748\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 user=rootAug 9 04:53:46 sigma sshd\[5720\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 user=root ...	2020-08-09 14:11:46
attackbotsspam	Invalid user caspar from 189.125.93.48 port 54068	2020-07-28 18:03:43
attack	Brute-force attempt banned	2020-07-27 22:37:05
attackbots	Jul 23 22:51:51 vps639187 sshd\[9580\]: Invalid user tu from 189.125.93.48 port 33050 Jul 23 22:51:51 vps639187 sshd\[9580\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Jul 23 22:51:53 vps639187 sshd\[9580\]: Failed password for invalid user tu from 189.125.93.48 port 33050 ssh2 ...	2020-07-24 05:04:39
attack	SSH Brute Force	2020-07-05 02:30:45
attack	SSH invalid-user multiple login try	2020-07-02 03:01:06
attackbots	Jun 19 06:18:03 vps46666688 sshd[26898]: Failed password for root from 189.125.93.48 port 44384 ssh2 Jun 19 06:20:01 vps46666688 sshd[26903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Jun 19 06:20:01 vps46666688 sshd[26903]: Failed password for invalid user glavbuh from 189.125.93.48 port 51820 ssh2 ...	2020-06-19 17:36:12
attackspambots	Jun 13 10:18:25 ArkNodeAT sshd\[25556\]: Invalid user ui from 189.125.93.48 Jun 13 10:18:25 ArkNodeAT sshd\[25556\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Jun 13 10:18:27 ArkNodeAT sshd\[25556\]: Failed password for invalid user ui from 189.125.93.48 port 36134 ssh2	2020-06-13 19:52:08
attack	Jun 11 07:30:10 buvik sshd[13678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Jun 11 07:30:13 buvik sshd[13678]: Failed password for invalid user csgoserver from 189.125.93.48 port 40725 ssh2 Jun 11 07:33:17 buvik sshd[14042]: Invalid user nexus from 189.125.93.48 ...	2020-06-11 13:41:40
attackspambots	SSH Brute-Forcing (server1)	2020-06-09 08:02:25
attackspambots	Invalid user kdh from 189.125.93.48 port 34036	2020-05-22 04:24:15
attackspambots	May 19 20:32:32 localhost sshd\[24834\]: Invalid user eoj from 189.125.93.48 May 19 20:32:32 localhost sshd\[24834\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 May 19 20:32:33 localhost sshd\[24834\]: Failed password for invalid user eoj from 189.125.93.48 port 43964 ssh2 May 19 20:36:47 localhost sshd\[25032\]: Invalid user idt from 189.125.93.48 May 19 20:36:47 localhost sshd\[25032\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 ...	2020-05-20 04:45:59
attack	Wordpress malicious attack:[sshd]	2020-04-25 15:08:17
attackbots	(sshd) Failed SSH login from 189.125.93.48 (BR/Brazil/-): 5 in the last 3600 secs	2020-04-12 22:12:55
attackbotsspam	Apr 9 09:01:25 mail sshd\[46382\]: Invalid user black from 189.125.93.48 Apr 9 09:01:25 mail sshd\[46382\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 ...	2020-04-10 00:37:56
attackspam	Invalid user zkl from 189.125.93.48 port 45128	2020-04-05 06:11:50
attackbotsspam	Apr 3 00:15:21 eventyay sshd[16031]: Failed password for root from 189.125.93.48 port 37396 ssh2 Apr 3 00:17:48 eventyay sshd[16116]: Failed password for root from 189.125.93.48 port 45067 ssh2 ...	2020-04-03 08:57:21
attackbotsspam	Apr 1 06:57:00 ArkNodeAT sshd\[8913\]: Invalid user lxj from 189.125.93.48 Apr 1 06:57:00 ArkNodeAT sshd\[8913\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Apr 1 06:57:02 ArkNodeAT sshd\[8913\]: Failed password for invalid user lxj from 189.125.93.48 port 48546 ssh2	2020-04-01 15:46:02
attackspam	Mar 22 05:24:18 h2779839 sshd[6690]: Invalid user tao from 189.125.93.48 port 35272 Mar 22 05:24:18 h2779839 sshd[6690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Mar 22 05:24:18 h2779839 sshd[6690]: Invalid user tao from 189.125.93.48 port 35272 Mar 22 05:24:20 h2779839 sshd[6690]: Failed password for invalid user tao from 189.125.93.48 port 35272 ssh2 Mar 22 05:28:11 h2779839 sshd[6853]: Invalid user ann from 189.125.93.48 port 40334 Mar 22 05:28:11 h2779839 sshd[6853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Mar 22 05:28:11 h2779839 sshd[6853]: Invalid user ann from 189.125.93.48 port 40334 Mar 22 05:28:13 h2779839 sshd[6853]: Failed password for invalid user ann from 189.125.93.48 port 40334 ssh2 Mar 22 05:32:01 h2779839 sshd[6971]: Invalid user work from 189.125.93.48 port 45356 ...	2020-03-22 16:15:46
attack	Mar 9 07:13:48 hosting sshd[13885]: Invalid user lilei from 189.125.93.48 port 44270 ...	2020-03-09 12:14:44
attack	Mar 4 22:53:39 pornomens sshd\[16179\]: Invalid user administrator from 189.125.93.48 port 51522 Mar 4 22:53:40 pornomens sshd\[16179\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Mar 4 22:53:41 pornomens sshd\[16179\]: Failed password for invalid user administrator from 189.125.93.48 port 51522 ssh2 ...	2020-03-05 06:39:07
attackspam	Mar 4 16:28:51 pornomens sshd\[15000\]: Invalid user deploy from 189.125.93.48 port 39512 Mar 4 16:28:51 pornomens sshd\[15000\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Mar 4 16:28:53 pornomens sshd\[15000\]: Failed password for invalid user deploy from 189.125.93.48 port 39512 ssh2 ...	2020-03-05 01:12:45
attackbots	Mar 4 16:35:27 areeb-Workstation sshd[23276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.48 Mar 4 16:35:29 areeb-Workstation sshd[23276]: Failed password for invalid user alan from 189.125.93.48 port 52950 ssh2 ...	2020-03-04 19:07:30

Comments on same subnet:

IP	Type	Details	Datetime
189.125.93.30	attack	Honeypot attack, port: 445, PTR: deleg.praiagrande.sp.gov.br.	2020-09-06 01:24:39
189.125.93.30	attackbotsspam	Honeypot attack, port: 445, PTR: deleg.praiagrande.sp.gov.br.	2020-09-05 16:55:41
189.125.93.30	attackspam	20/9/2@12:44:27: FAIL: Alarm-Network address from=189.125.93.30 20/9/2@12:44:28: FAIL: Alarm-Network address from=189.125.93.30 ...	2020-09-04 01:19:32
189.125.93.30	attackspambots	20/9/2@12:44:27: FAIL: Alarm-Network address from=189.125.93.30 20/9/2@12:44:28: FAIL: Alarm-Network address from=189.125.93.30 ...	2020-09-03 16:41:58
189.125.93.12	attack	May 21 08:01:38 vps687878 sshd\[7279\]: Failed password for invalid user msv from 189.125.93.12 port 33514 ssh2 May 21 08:02:59 vps687878 sshd\[7467\]: Invalid user spx from 189.125.93.12 port 52236 May 21 08:02:59 vps687878 sshd\[7467\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.12 May 21 08:03:01 vps687878 sshd\[7467\]: Failed password for invalid user spx from 189.125.93.12 port 52236 ssh2 May 21 08:04:17 vps687878 sshd\[7602\]: Invalid user hqo from 189.125.93.12 port 42994 May 21 08:04:17 vps687878 sshd\[7602\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.125.93.12 ...	2020-05-21 16:22:07
189.125.93.8	attack	Unauthorized connection attempt from IP address 189.125.93.8 on Port 445(SMB)	2019-11-03 21:13:10
189.125.93.8	attackspam	Unauthorized connection attempt from IP address 189.125.93.8 on Port 445(SMB)	2019-09-09 23:58:06

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 189.125.93.48
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 46374
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;189.125.93.48.			IN	A

;; AUTHORITY SECTION:
.			523	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121401 1800 900 604800 86400

;; Query time: 67 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Dec 15 11:36:25 CST 2019
;; MSG SIZE  rcvd: 117

Host info

Host 48.93.125.189.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 48.93.125.189.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
179.179.38.251	attack	Listed on zen-spamhaus / proto=6 . srcport=46162 . dstport=1433 . (1123)	2020-09-17 14:06:49
156.202.217.55	attackbotsspam	Honeypot attack, port: 445, PTR: host-156.202.55.217-static.tedata.net.	2020-09-17 14:31:30
103.76.136.250	attack	Port Scan ...	2020-09-17 14:19:20
49.213.226.13	attackbots	DATE:2020-09-16 19:00:51, IP:49.213.226.13, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)	2020-09-17 14:17:21
117.0.114.253	attack	Honeypot attack, port: 445, PTR: localhost.	2020-09-17 14:44:03
187.167.192.33	attack	Automatic report - Port Scan Attack	2020-09-17 14:16:14
203.212.231.64	attack	Listed on abuseat.org plus zen-spamhaus / proto=6 . srcport=12247 . dstport=23 . (1122)	2020-09-17 14:20:56
171.25.193.25	attackbots	$lgm	2020-09-17 14:16:35
93.115.1.195	attackbots	93.115.1.195 (RO/Romania/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 17 01:42:54 server5 sshd[20738]: Failed password for root from 177.0.108.210 port 54164 ssh2 Sep 17 01:42:49 server5 sshd[20730]: Failed password for root from 93.115.1.195 port 39686 ssh2 Sep 17 01:42:52 server5 sshd[20738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.0.108.210 user=root Sep 17 01:42:47 server5 sshd[20730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.115.1.195 user=root Sep 17 01:42:08 server5 sshd[20217]: Failed password for root from 106.53.207.227 port 41130 ssh2 Sep 17 01:44:07 server5 sshd[21242]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.46.179 user=root IP Addresses Blocked: 177.0.108.210 (BR/Brazil/-)	2020-09-17 14:15:16
107.175.194.173	attackbotsspam	TCP (SYN) 107.175.194.173:59638 -> port 23, len 44	2020-09-17 14:32:13
105.112.56.71	attack	Unauthorized connection attempt from IP address 105.112.56.71 on Port 445(SMB)	2020-09-17 14:12:27
144.217.243.216	attackbots	144.217.243.216 (CA/Canada/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 17 00:04:08 server5 sshd[20292]: Failed password for root from 144.217.243.216 port 33708 ssh2 Sep 17 00:06:12 server5 sshd[21566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.75.240 user=root Sep 17 00:06:14 server5 sshd[21566]: Failed password for root from 167.99.75.240 port 56970 ssh2 Sep 17 00:06:50 server5 sshd[21997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.101.207 user=root Sep 17 00:05:35 server5 sshd[21387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.159.189.39 user=root Sep 17 00:05:36 server5 sshd[21387]: Failed password for root from 211.159.189.39 port 38032 ssh2 IP Addresses Blocked:	2020-09-17 14:43:18
212.70.149.4	attackspambots	2020-09-17 09:00:42 dovecot_login authenticator failed for $User$ \[212.70.149.4\]: 535 Incorrect authentication data $set_id=lsi@org.ua$2020-09-17 09:03:47 dovecot_login authenticator failed for $User$ \[212.70.149.4\]: 535 Incorrect authentication data $set_id=live1@org.ua$2020-09-17 09:06:54 dovecot_login authenticator failed for $User$ \[212.70.149.4\]: 535 Incorrect authentication data $set_id=listen@org.ua$ ...	2020-09-17 14:10:01
200.107.241.52	attackbotsspam	445/tcp [2020-09-16]1pkt	2020-09-17 14:36:51
51.178.86.49	attackspambots	Sep 17 00:51:21 Tower sshd[39630]: Connection from 51.178.86.49 port 42940 on 192.168.10.220 port 22 rdomain "" Sep 17 00:51:22 Tower sshd[39630]: Failed password for root from 51.178.86.49 port 42940 ssh2 Sep 17 00:51:22 Tower sshd[39630]: Received disconnect from 51.178.86.49 port 42940:11: Bye Bye [preauth] Sep 17 00:51:22 Tower sshd[39630]: Disconnected from authenticating user root 51.178.86.49 port 42940 [preauth]	2020-09-17 14:06:05

Recently Reported IPs

175.138.190.220	165.138.102.43	187.141.122.148	97.43.136.160
49.81.93.177	178.62.231.116	191.95.41.79	35.224.205.57
96.238.8.189	245.113.41.100	72.13.56.175	165.100.78.222
82.116.46.203	67.139.129.44	41.190.94.116	101.71.130.44
244.128.203.101	149.202.218.8	206.25.204.64	180.92.228.38