190.148.50.129

Basic Info

City: unknown

Region: unknown

Country: Guatemala

Internet Service Provider: Columbus Networks USA Inc.

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	Lines containing failures of 190.148.50.129 Feb 10 14:37:39 shared07 sshd[31289]: Invalid user admin from 190.148.50.129 port 51803 Feb 10 14:37:39 shared07 sshd[31289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.148.50.129 Feb 10 14:37:42 shared07 sshd[31289]: Failed password for invalid user admin from 190.148.50.129 port 51803 ssh2 Feb 10 14:37:42 shared07 sshd[31289]: Connection closed by invalid user admin 190.148.50.129 port 51803 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=190.148.50.129	2020-02-10 23:10:30

Type

Details

Datetime

attackbots

Lines containing failures of 190.148.50.129
Feb 10 14:37:39 shared07 sshd[31289]: Invalid user admin from 190.148.50.129 port 51803
Feb 10 14:37:39 shared07 sshd[31289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.148.50.129
Feb 10 14:37:42 shared07 sshd[31289]: Failed password for invalid user admin from 190.148.50.129 port 51803 ssh2
Feb 10 14:37:42 shared07 sshd[31289]: Connection closed by invalid user admin 190.148.50.129 port 51803 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=190.148.50.129

2020-02-10 23:10:30

Comments on same subnet:

IP	Type	Details	Datetime
190.148.50.106	attack	SSH login attempts	2020-04-22 04:29:43
190.148.50.92	attackbots	Unauthorized connection attempt from IP address 190.148.50.92 on Port 445(SMB)	2020-04-06 22:01:00
190.148.50.157	attackbots	Lines containing failures of 190.148.50.157 Feb 8 05:45:57 shared11 sshd[24694]: Invalid user user from 190.148.50.157 port 22504 Feb 8 05:45:57 shared11 sshd[24694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.148.50.157 Feb 8 05:45:59 shared11 sshd[24694]: Failed password for invalid user user from 190.148.50.157 port 22504 ssh2 Feb 8 05:45:59 shared11 sshd[24694]: Connection closed by invalid user user 190.148.50.157 port 22504 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=190.148.50.157	2020-02-08 13:07:18

Type

Details

Datetime

190.148.50.106

attack

SSH login attempts

2020-04-22 04:29:43

190.148.50.92

attackbots

Unauthorized connection attempt from IP address 190.148.50.92 on Port 445(SMB)

2020-04-06 22:01:00

190.148.50.157

attackbots

Lines containing failures of 190.148.50.157
Feb  8 05:45:57 shared11 sshd[24694]: Invalid user user from 190.148.50.157 port 22504
Feb  8 05:45:57 shared11 sshd[24694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.148.50.157
Feb  8 05:45:59 shared11 sshd[24694]: Failed password for invalid user user from 190.148.50.157 port 22504 ssh2
Feb  8 05:45:59 shared11 sshd[24694]: Connection closed by invalid user user 190.148.50.157 port 22504 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=190.148.50.157

2020-02-08 13:07:18

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 190.148.50.129
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 33704
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;190.148.50.129.			IN	A

;; AUTHORITY SECTION:
.			562	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020021000 1800 900 604800 86400

;; Query time: 508 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Feb 10 23:10:24 CST 2020
;; MSG SIZE  rcvd: 118

Host info

129.50.148.190.in-addr.arpa domain name pointer 129.50.148.190.static.intelnet.net.gt.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
129.50.148.190.in-addr.arpa	name = 129.50.148.190.static.intelnet.net.gt.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
13.82.188.159	attackspam	BadRequests	2019-06-30 05:05:10
106.51.37.110	attackbotsspam	Jun 29 22:45:28 srv03 sshd\[3150\]: Invalid user hadoop from 106.51.37.110 port 47622 Jun 29 22:45:28 srv03 sshd\[3150\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.51.37.110 Jun 29 22:45:30 srv03 sshd\[3150\]: Failed password for invalid user hadoop from 106.51.37.110 port 47622 ssh2	2019-06-30 05:10:20
189.89.218.247	attackbotsspam	SMTP-sasl brute force ...	2019-06-30 05:02:18
201.148.247.252	attack	failed_logins	2019-06-30 05:06:00
66.249.64.10	attack	WordpressAttack	2019-06-30 05:07:36
79.125.192.222	attack	Jun 30 01:41:38 tanzim-HP-Z238-Microtower-Workstation sshd\[19775\]: Invalid user oracle from 79.125.192.222 Jun 30 01:41:38 tanzim-HP-Z238-Microtower-Workstation sshd\[19775\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.125.192.222 Jun 30 01:41:40 tanzim-HP-Z238-Microtower-Workstation sshd\[19775\]: Failed password for invalid user oracle from 79.125.192.222 port 43126 ssh2 ...	2019-06-30 05:27:29
66.70.145.172	attackspam	These are people / users who try to send programs for data capture (spy), see examples below, there are no limits: From rbnf-@ceprow.com.br Fri Jun 28 02:11:50 2019 Received: from elenin-45.reverseonweb.we.bs ([66.70.145.172]:40997) (envelope-from ) Subject: =?UTF-8?B?YmFuY29kb2NvbmhlY2ltZW50b0BiYW5jb2RvY29uaGVjaW1lbnRvLmNvbS5iciwgQ29uaGXDp2EgbyBQbGFubyBTbWFydFZpdm8gQ29ycG9yYXRpdm8gIEZhbGFyIElsaW1pdGFkbyBjb20gSW50ZXJuZXQgZGUgU29icmE=?= Message-ID: <8f63cdf7bd3e6959eaa5655d1946323d@8.galema.com.br> From: "Vivo Empresas - Parceiros" 2.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% [cf: 100] ahref="https://8.galema.com.br/ame/link.php?M=12113923&N=2858&L=51&F=H">link	2019-06-30 05:32:22
45.67.14.164	attackspam	/var/log/messages:Jun 27 22:21:42 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1561674102.166:42936): pid=12154 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-server cipher=aexxxxxxx28-ctr ksize=128 mac=hmac-sha2-256 pfs=diffie-hellman-group-exchange-sha256 spid=12155 suid=74 rport=40210 laddr=104.167.106.93 lport=22 exe="/usr/sbin/sshd" hostname=? addr=45.67.14.164 terminal=? res=success' /var/log/messages:Jun 27 22:21:42 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1561674102.170:42937): pid=12154 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-client cipher=aexxxxxxx28-ctr ksize=128 mac=hmac-sha2-256 pfs=diffie-hellman-group-exchange-sha256 spid=12155 suid=74 rport=40210 laddr=104.167.106.93 lport=22 exe="/usr/sbin/sshd" hostname=? addr=45.67.14.164 terminal=? res=success' /var/log/messages:Jun 27 22:21:46 sanyalne........ -------------------------------	2019-06-30 05:29:18
203.245.9.139	attackbots	ECShop Remote Code Execution Vulnerability, PTR: PTR record not found	2019-06-30 05:15:39
186.147.34.238	attackbots	Jun 29 21:48:16 meumeu sshd[13573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.147.34.238 Jun 29 21:48:18 meumeu sshd[13573]: Failed password for invalid user postgres from 186.147.34.238 port 37569 ssh2 Jun 29 21:49:56 meumeu sshd[13852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.147.34.238 ...	2019-06-30 05:18:37
117.86.35.239	attackspam	2019-06-29T19:10:03.325077 X postfix/smtpd[19305]: warning: unknown[117.86.35.239]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 2019-06-29T20:09:28.427703 X postfix/smtpd[18860]: warning: unknown[117.86.35.239]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 2019-06-29T21:01:24.219007 X postfix/smtpd[33128]: warning: unknown[117.86.35.239]: SASL LOGIN authentication failed: UGFzc3dvcmQ6	2019-06-30 05:24:08
106.12.78.161	attackbotsspam	Jun 29 20:59:23 vps691689 sshd[10799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.78.161 Jun 29 20:59:25 vps691689 sshd[10799]: Failed password for invalid user claudiaclaudia. from 106.12.78.161 port 50416 ssh2 Jun 29 21:01:08 vps691689 sshd[10810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.78.161 ...	2019-06-30 05:25:00
106.13.144.61	attackspam	2019-06-30T02:01:19.751810enmeeting.mahidol.ac.th sshd\[28099\]: Invalid user suporte from 106.13.144.61 port 53250 2019-06-30T02:01:19.770981enmeeting.mahidol.ac.th sshd\[28099\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.144.61 2019-06-30T02:01:22.029350enmeeting.mahidol.ac.th sshd\[28099\]: Failed password for invalid user suporte from 106.13.144.61 port 53250 ssh2 ...	2019-06-30 05:24:30
200.24.216.131	attackspambots	Unauthorized connection attempt from IP address 200.24.216.131 on Port 445(SMB)	2019-06-30 04:58:55
200.170.139.169	attackbots	Jun 29 22:35:02 ns37 sshd[19620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.170.139.169 Jun 29 22:35:02 ns37 sshd[19620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.170.139.169	2019-06-30 05:16:33

Recently Reported IPs

131.167.240.120	200.149.156.146	153.177.43.144	18.71.112.176
213.166.70.48	50.53.181.112	137.103.18.186	221.231.126.46
219.143.126.167	117.194.164.162	14.245.240.103	47.254.78.226
31.0.45.124	2.45.82.140	203.220.158.124	177.58.248.0
1.164.18.43	89.221.172.130	197.56.159.56	196.20.203.106