189.50.105.104

Basic Info

City: Botucatu

Region: Sao Paulo

Country: Brazil

Internet Service Provider: Silva & Silveira S/C Ltda - ME

Hostname: unknown

Organization: Silva e Silveira Provedor de Internet SC Ltda

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbotsspam	Honeypot attack, port: 23, PTR: 189-50-105-104-wlan.lpnet.com.br.	2019-09-05 14:45:07
attack	Apr 16 05:31:42 ubuntu sshd[5814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.50.105.104 Apr 16 05:31:44 ubuntu sshd[5814]: Failed password for invalid user tuxedo from 189.50.105.104 port 53965 ssh2 Apr 16 05:34:39 ubuntu sshd[5868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.50.105.104 Apr 16 05:34:41 ubuntu sshd[5868]: Failed password for invalid user odoo from 189.50.105.104 port 38788 ssh2	2019-08-01 08:40:01

Type

Details

Datetime

attackbotsspam

Honeypot attack, port: 23, PTR: 189-50-105-104-wlan.lpnet.com.br.

2019-09-05 14:45:07

attack

Apr 16 05:31:42 ubuntu sshd[5814]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.50.105.104
Apr 16 05:31:44 ubuntu sshd[5814]: Failed password for invalid user tuxedo from 189.50.105.104 port 53965 ssh2
Apr 16 05:34:39 ubuntu sshd[5868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.50.105.104
Apr 16 05:34:41 ubuntu sshd[5868]: Failed password for invalid user odoo from 189.50.105.104 port 38788 ssh2

2019-08-01 08:40:01

Comments on same subnet:

IP	Type	Details	Datetime
189.50.105.128	attack	23/tcp [2020-06-30]1pkt	2020-07-01 18:49:19
189.50.105.218	attackbotsspam	UTC: 2019-11-26 port: 23/tcp	2019-11-28 04:56:49
189.50.105.214	attackspambots	Aug 19 18:44:15 eddieflores sshd\[833\]: Invalid user demo from 189.50.105.214 Aug 19 18:44:15 eddieflores sshd\[833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-50-105-214-wlan.lpnet.com.br Aug 19 18:44:17 eddieflores sshd\[833\]: Failed password for invalid user demo from 189.50.105.214 port 60732 ssh2 Aug 19 18:49:25 eddieflores sshd\[1242\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-50-105-214-wlan.lpnet.com.br user=root Aug 19 18:49:28 eddieflores sshd\[1242\]: Failed password for root from 189.50.105.214 port 51306 ssh2	2019-08-20 21:26:25

Type

Details

Datetime

189.50.105.128

attack

23/tcp
[2020-06-30]1pkt

2020-07-01 18:49:19

189.50.105.218

attackbotsspam

UTC: 2019-11-26 port: 23/tcp

2019-11-28 04:56:49

189.50.105.214

attackspambots

Aug 19 18:44:15 eddieflores sshd\[833\]: Invalid user demo from 189.50.105.214
Aug 19 18:44:15 eddieflores sshd\[833\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-50-105-214-wlan.lpnet.com.br
Aug 19 18:44:17 eddieflores sshd\[833\]: Failed password for invalid user demo from 189.50.105.214 port 60732 ssh2
Aug 19 18:49:25 eddieflores sshd\[1242\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189-50-105-214-wlan.lpnet.com.br  user=root
Aug 19 18:49:28 eddieflores sshd\[1242\]: Failed password for root from 189.50.105.214 port 51306 ssh2

2019-08-20 21:26:25

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 189.50.105.104
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45354
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;189.50.105.104.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019041400 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Sun Apr 14 23:43:08 +08 2019
;; MSG SIZE  rcvd: 118

Host info

104.105.50.189.in-addr.arpa domain name pointer 189-50-105-104-wlan.lpnet.com.br.

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

Non-authoritative answer:
104.105.50.189.in-addr.arpa	name = 189-50-105-104-wlan.lpnet.com.br.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
106.54.245.12	attackbots	Jun 10 21:50:17 legacy sshd[19802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.245.12 Jun 10 21:50:19 legacy sshd[19802]: Failed password for invalid user mysql from 106.54.245.12 port 41238 ssh2 Jun 10 21:51:45 legacy sshd[19837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.54.245.12 ...	2020-06-11 05:24:46
108.183.151.208	attackbots	Jun 10 19:28:56 XXX sshd[49671]: Invalid user default from 108.183.151.208 port 35554	2020-06-11 05:11:08
106.13.234.23	attackspambots	2020-06-10T14:26:05.108904linuxbox-skyline sshd[299759]: Invalid user monitor from 106.13.234.23 port 57884 ...	2020-06-11 05:19:30
89.248.168.2	attack	Jun 10 22:48:42 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=172.104.140.148, session= Jun 10 22:49:51 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=172.104.140.148, session= Jun 10 22:50:27 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=172.104.140.148, session= Jun 10 22:51:01 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=172.104.140.148, session= Jun 10 22:52:11 server dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=89.248.168.2, lip=172.104.140.148, ses ...	2020-06-11 04:55:03
134.209.24.143	attackspam	(sshd) Failed SSH login from 134.209.24.143 (GB/United Kingdom/-): 5 in the last 3600 secs	2020-06-11 05:12:56
103.196.36.41	attack	GET / HTTP/1.1 403 0 "-" "Mozilla/5.0 zgrab/0.x"	2020-06-11 04:52:01
79.116.202.129	attackbots	Automatic report - Port Scan Attack	2020-06-11 05:07:28
120.92.166.166	attack	Jun 10 20:03:04 localhost sshd[119338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.92.166.166 user=root Jun 10 20:03:06 localhost sshd[119338]: Failed password for root from 120.92.166.166 port 4775 ssh2 Jun 10 20:06:29 localhost sshd[119748]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.92.166.166 user=root Jun 10 20:06:31 localhost sshd[119748]: Failed password for root from 120.92.166.166 port 30567 ssh2 Jun 10 20:09:40 localhost sshd[120170]: Invalid user earl from 120.92.166.166 port 56359 ...	2020-06-11 04:53:50
159.203.27.98	attackspam	Jun 10 23:03:28 OPSO sshd\[19450\]: Invalid user yao from 159.203.27.98 port 53920 Jun 10 23:03:28 OPSO sshd\[19450\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.27.98 Jun 10 23:03:31 OPSO sshd\[19450\]: Failed password for invalid user yao from 159.203.27.98 port 53920 ssh2 Jun 10 23:07:35 OPSO sshd\[20509\]: Invalid user chiudi from 159.203.27.98 port 54360 Jun 10 23:07:35 OPSO sshd\[20509\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.27.98	2020-06-11 05:10:54
131.108.140.252	attackbots	Icarus honeypot on github	2020-06-11 05:17:32
89.248.174.201	attackbotsspam	[H1.VM6] Blocked by UFW	2020-06-11 05:15:22
180.76.138.132	attackspambots	Unauthorised connection attempt detected at AUO FR1 NODE2. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)	2020-06-11 05:08:43
59.144.139.18	attack	Fail2Ban Ban Triggered	2020-06-11 05:26:23
112.85.42.181	attackbotsspam	Jun 10 23:01:43 santamaria sshd\[21600\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.181 user=root Jun 10 23:01:45 santamaria sshd\[21600\]: Failed password for root from 112.85.42.181 port 37791 ssh2 Jun 10 23:02:04 santamaria sshd\[21602\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.181 user=root ...	2020-06-11 05:05:23
49.232.145.201	attackbotsspam	SSH brute force attempt	2020-06-11 05:20:17

Recently Reported IPs

119.27.170.189	116.107.190.158	83.47.235.220	191.55.12.147
2.238.192.200	190.244.171.35	5.39.121.21	202.189.254.250
36.79.2.216	104.168.173.71	58.105.235.168	222.173.30.222
35.158.95.64	125.213.150.7	103.124.106.88	37.191.211.117
121.122.75.184	185.115.156.42	177.234.7.62	54.169.97.230