193.34.145.204

Basic Info

City: unknown

Region: unknown

Country: Germany

Internet Service Provider: Contabo GmbH

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	193.34.145.204 - - [29/Aug/2020:20:31:41 +0200] "GET /wp-login.php HTTP/1.1" 200 9163 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.204 - - [29/Aug/2020:20:31:43 +0200] "POST /wp-login.php HTTP/1.1" 200 9414 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.204 - - [29/Aug/2020:20:31:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-08-30 02:34:22
attack	Automatic report - XMLRPC Attack	2020-08-08 07:20:42

Type

Details

Datetime

attack

193.34.145.204 - - [29/Aug/2020:20:31:41 +0200] "GET /wp-login.php HTTP/1.1" 200 9163 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
193.34.145.204 - - [29/Aug/2020:20:31:43 +0200] "POST /wp-login.php HTTP/1.1" 200 9414 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
193.34.145.204 - - [29/Aug/2020:20:31:44 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"

2020-08-30 02:34:22

attack

Automatic report - XMLRPC Attack

2020-08-08 07:20:42

Comments on same subnet:

IP	Type	Details	Datetime
193.34.145.205	attackbots	193.34.145.205 - - [04/Jun/2020:04:55:21 +0100] "POST /wp-login.php HTTP/1.1" 200 1861 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.205 - - [04/Jun/2020:04:55:22 +0100] "POST /wp-login.php HTTP/1.1" 200 1880 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.205 - - [04/Jun/2020:04:55:22 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-06-04 14:38:41
193.34.145.205	attackbots	WordPress login Brute force / Web App Attack on client site.	2020-05-29 12:08:04
193.34.145.205	attack	xmlrpc attack	2020-05-25 19:08:54
193.34.145.205	attackbotsspam	193.34.145.205 - - \[24/May/2020:23:34:02 +0200\] "POST /wp-login.php HTTP/1.0" 200 2797 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 193.34.145.205 - - \[24/May/2020:23:34:03 +0200\] "POST /wp-login.php HTTP/1.0" 200 2727 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 193.34.145.205 - - \[24/May/2020:23:34:04 +0200\] "POST /wp-login.php HTTP/1.0" 200 2764 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-05-25 08:04:53
193.34.145.205	attackbotsspam	xmlrpc attack	2020-05-16 04:12:40
193.34.145.203	attackspambots	Brute force VPN server	2019-12-21 07:03:33
193.34.145.18	attackbotsspam	fail2ban honeypot	2019-09-20 17:53:55
193.34.145.252	attack	port scan and connect, tcp 8080 (http-proxy)	2019-08-27 12:49:04
193.34.145.56	attack	Brute forcing Wordpress login	2019-08-13 14:08:40
193.34.145.202	attackspambots	xmlrpc attack	2019-08-12 16:15:05
193.34.145.18	attack	193.34.145.18 - - [01/Aug/2019:05:18:13 +0200] "GET /wp-login.php HTTP/1.1" 200 1301 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.18 - - [01/Aug/2019:05:18:13 +0200] "POST /wp-login.php HTTP/1.1" 200 1704 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.18 - - [01/Aug/2019:05:18:13 +0200] "GET /wp-login.php HTTP/1.1" 200 1301 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.18 - - [01/Aug/2019:05:18:13 +0200] "POST /wp-login.php HTTP/1.1" 200 1684 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.18 - - [01/Aug/2019:05:18:14 +0200] "GET /wp-login.php HTTP/1.1" 200 1301 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 193.34.145.18 - - [01/Aug/2019:05:18:14 +0200] "POST /wp-login.php HTTP/1.1" 200 1688 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-08-01 21:28:10
193.34.145.18	attackspambots	Wordpress Admin Login attack	2019-07-20 03:14:27
193.34.145.6	attackbots	2019-07-16 06:29:00 -> 2019-07-18 08:42:26 : 918 login attempts (193.34.145.6)	2019-07-19 08:02:20
193.34.145.6	attackbots	2019-07-14 06:27:54 -> 2019-07-16 23:01:46 : 1171 login attempts (193.34.145.6)	2019-07-17 07:53:37
193.34.145.56	attack	Wordpress Admin Login attack	2019-07-16 19:17:30

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 193.34.145.204
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31788
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;193.34.145.204.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019060900 1800 900 604800 86400

;; Query time: 3 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Jun 09 22:02:42 CST 2019
;; MSG SIZE  rcvd: 118

Host info

204.145.34.193.in-addr.arpa domain name pointer m3668.contabo.net.

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
204.145.34.193.in-addr.arpa	name = m3668.contabo.net.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
106.12.3.28	attack	2020-10-02T03:40:21.300006hostname sshd[21604]: Failed password for root from 106.12.3.28 port 33198 ssh2 ...	2020-10-03 05:02:06
173.206.143.242	attack	Telnet Honeypot -> Telnet Bruteforce / Login	2020-10-03 04:42:30
212.70.149.83	attackbotsspam	abuse-sasl	2020-10-03 04:51:23
211.159.186.152	attack	$f2bV_matches	2020-10-03 04:45:30
104.219.251.35	attackbots	02.10.2020 18:49:10 - Wordpress fail Detected by ELinOX-ALM	2020-10-03 04:50:08
218.92.0.202	attackbots	Oct 2 20:35:41 marvibiene sshd[31538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.202 user=root Oct 2 20:35:43 marvibiene sshd[31538]: Failed password for root from 218.92.0.202 port 30681 ssh2 Oct 2 20:35:45 marvibiene sshd[31538]: Failed password for root from 218.92.0.202 port 30681 ssh2 Oct 2 20:35:41 marvibiene sshd[31538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.202 user=root Oct 2 20:35:43 marvibiene sshd[31538]: Failed password for root from 218.92.0.202 port 30681 ssh2 Oct 2 20:35:45 marvibiene sshd[31538]: Failed password for root from 218.92.0.202 port 30681 ssh2	2020-10-03 04:40:43
168.119.107.140	attackbots	Oct 1 23:35:01 server postfix/smtpd[30134]: NOQUEUE: reject: RCPT from static.140.107.119.168.clients.your-server.de[168.119.107.140]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo= Oct 1 23:40:13 server postfix/smtpd[30058]: NOQUEUE: reject: RCPT from static.140.107.119.168.clients.your-server.de[168.119.107.140]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo= Oct 1 23:44:05 server postfix/smtpd[30086]: NOQUEUE: reject: RCPT from static.140.107.119.168.clients.your-server.de[168.119.107.140]: 450 4.7.1 : Helo command rejected: Host not found; from= to= proto=ESMTP helo=	2020-10-03 04:45:53
67.247.232.110	attack	(sshd) Failed SSH login from 67.247.232.110 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Oct 2 14:55:07 jbs1 sshd[30799]: Invalid user admin from 67.247.232.110 Oct 2 14:55:09 jbs1 sshd[30799]: Failed password for invalid user admin from 67.247.232.110 port 34128 ssh2 Oct 2 14:55:10 jbs1 sshd[30825]: Invalid user admin from 67.247.232.110 Oct 2 14:55:12 jbs1 sshd[30825]: Failed password for invalid user admin from 67.247.232.110 port 34201 ssh2 Oct 2 14:55:12 jbs1 sshd[30850]: Invalid user admin from 67.247.232.110	2020-10-03 04:59:49
5.45.132.96	attackbots	22,88-01/01 [bc00/m121] PostRequest-Spammer scoring: Lusaka01	2020-10-03 04:58:08
165.232.44.157	attack	Oct 1 17:49:20 r.ca sshd[12455]: Failed password for invalid user user1 from 165.232.44.157 port 39614 ssh2	2020-10-03 04:44:20
115.53.7.11	attackspambots	20/10/2@15:10:24: FAIL: Alarm-Telnet address from=115.53.7.11 ...	2020-10-03 04:44:40
222.186.42.213	attackspam	Oct 2 22:52:03 host sshd[23513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.213 user=root Oct 2 22:52:05 host sshd[23513]: Failed password for root from 222.186.42.213 port 26244 ssh2 ...	2020-10-03 04:53:34
111.230.29.17	attackspambots	Time: Fri Oct 2 15:31:35 2020 +0000 IP: 111.230.29.17 (CN/China/-) Failures: 5 (sshd) Interval: 3600 seconds Blocked: Permanent Block [LF_SSHD] Log entries: Oct 2 15:22:09 14-2 sshd[18873]: Invalid user netflow from 111.230.29.17 port 39680 Oct 2 15:22:11 14-2 sshd[18873]: Failed password for invalid user netflow from 111.230.29.17 port 39680 ssh2 Oct 2 15:26:09 14-2 sshd[31297]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.230.29.17 user=root Oct 2 15:26:10 14-2 sshd[31297]: Failed password for root from 111.230.29.17 port 44884 ssh2 Oct 2 15:31:31 14-2 sshd[16210]: Invalid user reynaldo from 111.230.29.17 port 37034	2020-10-03 04:48:38
27.128.165.131	attackspambots	ssh intrusion attempt	2020-10-03 04:27:21
88.214.26.13	attackbots	21 attempts against mh-misbehave-ban on oak	2020-10-03 04:49:29

Recently Reported IPs

91.250.6.108	66.70.216.114	185.8.152.54	76.20.69.183
203.73.72.120	79.172.236.205	121.171.191.253	185.244.42.106
94.230.135.162	178.17.166.150	2404:f080:1101:320:150:95:108:33	183.62.158.97
96.32.4.181	41.90.118.138	178.208.255.38	37.235.189.242
103.133.110.70	178.62.81.249	159.65.152.94	203.48.246.66