City: unknown
Region: unknown
Country: Czech Republic
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
| IP | Type | Details | Datetime |
|---|---|---|---|
| 195.133.20.193 | attack | Router logs showing dos and port scanning [DoS attack: TCP Port Scan] from source: 195.133.20.193:65533 Sunday, September 18,2022 16:33:43 Im seeing a ton of initial hits by russian based ip.. followed up after infection by what seems to be chinese methods of digging in below the os and also building a complex networking system to remove chokepoints and provide redundancy.. its happening at scale im not a direct target just a vector potentially to get into very large corporate headquarters in the area.. have found this... well remote access trojan.. in 3 businesses all major transaction business and 2 with a ton of proprietary information and designs. This is alarming and no one seems to take it as serious as it is.. in my own home ive fiddle and tested what it can do and its jaw dropping.. the level of working knowledge across sooo many systems down to the chipset instruction codes and bootloader... even using a non-storage devices rom for other purposes and moving what was originally there to else where with a working path to retrieve it so they system and hardware continues to function as it should.. just with quirks all the while making a bios flash and entirely new drive and os media useless because the malware or rogue code goes into action long before the os does. |
2022-09-20 01:21:00 |
| 195.133.206.202 | attack | Mar 5 05:53:55 [munged] sshd[18528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.133.206.202 |
2020-03-05 14:05:04 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 195.133.20.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10303
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;195.133.20.42. IN A
;; AUTHORITY SECTION:
. 142 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2021110500 1800 900 604800 86400
;; Query time: 64 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Nov 05 19:10:41 CST 2021
;; MSG SIZE rcvd: 106Host 42.20.133.195.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 42.20.133.195.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 189.112.228.153 | attackbotsspam | Dec 28 00:33:08 sd-53420 sshd\[21107\]: Invalid user keiichi from 189.112.228.153 Dec 28 00:33:08 sd-53420 sshd\[21107\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.228.153 Dec 28 00:33:10 sd-53420 sshd\[21107\]: Failed password for invalid user keiichi from 189.112.228.153 port 35250 ssh2 Dec 28 00:36:34 sd-53420 sshd\[22502\]: Invalid user bing from 189.112.228.153 Dec 28 00:36:34 sd-53420 sshd\[22502\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.112.228.153 ... |
2019-12-28 09:02:46 |
| 185.156.177.117 | attack | RDP Bruteforce |
2019-12-28 13:09:23 |
| 192.144.230.188 | attackspambots | $f2bV_matches |
2019-12-28 13:10:38 |
| 14.187.37.159 | attackspam | Brute-force attempt banned |
2019-12-28 13:14:36 |
| 157.47.164.16 | attackbotsspam | 1577509138 - 12/28/2019 05:58:58 Host: 157.47.164.16/157.47.164.16 Port: 445 TCP Blocked |
2019-12-28 13:04:14 |
| 27.115.124.70 | attackbots | srv.marc-hoffrichter.de:443 27.115.124.70 - - [27/Dec/2019:23:53:37 +0100] "GET / HTTP/1.0" 403 5030 "-" "-" |
2019-12-28 09:07:14 |
| 52.117.216.53 | attackspambots | Automatic report - SSH Brute-Force Attack |
2019-12-28 09:17:20 |
| 106.13.172.11 | attackspambots | Dec 27 14:40:55 web9 sshd\[20279\]: Invalid user stud from 106.13.172.11 Dec 27 14:40:55 web9 sshd\[20279\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.172.11 Dec 27 14:40:57 web9 sshd\[20279\]: Failed password for invalid user stud from 106.13.172.11 port 53316 ssh2 Dec 27 14:43:26 web9 sshd\[20619\]: Invalid user glenn from 106.13.172.11 Dec 27 14:43:26 web9 sshd\[20619\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.172.11 |
2019-12-28 09:16:52 |
| 61.69.78.78 | attackbotsspam | Dec 28 05:55:19 legacy sshd[31087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.69.78.78 Dec 28 05:55:21 legacy sshd[31087]: Failed password for invalid user raddatz from 61.69.78.78 port 48012 ssh2 Dec 28 05:59:01 legacy sshd[31197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.69.78.78 ... |
2019-12-28 13:02:24 |
| 180.166.114.14 | attackspam | $f2bV_matches |
2019-12-28 13:13:32 |
| 103.107.100.13 | attackspam | Dec 28 05:52:22 ns382633 sshd\[29057\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.107.100.13 user=root Dec 28 05:52:24 ns382633 sshd\[29057\]: Failed password for root from 103.107.100.13 port 43026 ssh2 Dec 28 05:58:59 ns382633 sshd\[30001\]: Invalid user ermelinda from 103.107.100.13 port 58562 Dec 28 05:58:59 ns382633 sshd\[30001\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.107.100.13 Dec 28 05:59:01 ns382633 sshd\[30001\]: Failed password for invalid user ermelinda from 103.107.100.13 port 58562 ssh2 |
2019-12-28 13:00:44 |
| 81.218.133.100 | attackbotsspam | Automatic report - Port Scan Attack |
2019-12-28 08:59:19 |
| 213.85.3.250 | attackspam | Dec 28 05:34:46 gw1 sshd[13419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=213.85.3.250 Dec 28 05:34:48 gw1 sshd[13419]: Failed password for invalid user guest from 213.85.3.250 port 35774 ssh2 ... |
2019-12-28 09:08:31 |
| 178.62.37.168 | attackbotsspam | Invalid user hasen from 178.62.37.168 port 39647 |
2019-12-28 09:01:59 |
| 45.82.153.85 | attackbots | 2019-12-28 05:59:48 dovecot_login authenticator failed for \(\[45.82.153.85\]\) \[45.82.153.85\]: 535 Incorrect authentication data \(set_id=postmaster@opso.it\) 2019-12-28 05:59:56 dovecot_login authenticator failed for \(\[45.82.153.85\]\) \[45.82.153.85\]: 535 Incorrect authentication data 2019-12-28 06:00:06 dovecot_login authenticator failed for \(\[45.82.153.85\]\) \[45.82.153.85\]: 535 Incorrect authentication data 2019-12-28 06:00:11 dovecot_login authenticator failed for \(\[45.82.153.85\]\) \[45.82.153.85\]: 535 Incorrect authentication data 2019-12-28 06:00:24 dovecot_login authenticator failed for \(\[45.82.153.85\]\) \[45.82.153.85\]: 535 Incorrect authentication data |
2019-12-28 13:12:18 |