195.54.160.21 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Russian Federation

Internet Service Provider: Arkada LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	ET DROP Dshield Block Listed Source group 1 - port: 8081 proto: tcp cat: Misc Attackbytes: 60	2020-09-09 21:12:11
attackbots	Multiport scan 17 ports : 80(x110) 443(x94) 2375(x101) 3000(x65) 4506(x39) 5601 6066 6379(x90) 6800(x90) 7070(x2) 7077(x56) 7777 8081(x187) 8088(x96) 8983(x94) 9000 50000	2020-09-09 07:18:02
attack	TCP (SYN) 195.54.160.21:52831 -> port 3000, len 44	2020-09-08 02:04:32
attackspambots	Hacker	2020-09-07 17:29:58
attackspam	SmallBizIT.US 4 packets to tcp(2375,3000,8081,8088)	2020-09-03 00:12:54
attackspambots	Unauthorized connection attempt detected from IP address 195.54.160.21 to port 80 [T]	2020-09-02 15:44:29
attackspambots	Scanned 3 times in the last 24 hours on port 80	2020-09-02 08:48:18
attack	TCP (SYN) 195.54.160.21:49295 -> port 443, len 44	2020-08-30 16:39:41
attackbotsspam	195.54.160.21 - - \[29/Aug/2020:15:26:15 +0200\] "GET /solr/admin/info/system\?wt=json HTTP/1.1" 403 436 "-" "Mozilla/5.0 $Windows NT 10.0\; Win64\; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/78.0.3904.108 Safari/537.36" 195.54.160.21 - - \[29/Aug/2020:15:37:39 +0200\] "GET /\?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 403 436 "-" "Mozilla/5.0 $Windows NT 10.0\; Win64\; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/78.0.3904.108 Safari/537.36" 195.54.160.21 - - \[29/Aug/2020:15:49:53 +0200\] "GET /\?a=fetch\&content=\die$@md5\(HelloThinkCMF$\)\ HTTP/1.1" 403 436 "-" "Mozilla/5.0 $Windows NT 10.0\; Win64\; x64$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/78.0.3904.108 Safari/537.36" ...	2020-08-29 22:10:24
attack	firewall-block, port(s): 80/tcp, 6800/tcp, 8983/tcp	2020-08-29 17:40:35
attackbotsspam	Hacking	2020-08-27 09:02:20
attack	Fail2Ban Ban Triggered	2020-08-27 00:34:18
attack	firewall-block, port(s): 8983/tcp	2020-08-26 06:11:07
attackspam	Unauthorized connection attempt detected from IP address 195.54.160.21 to port 80 [T]	2020-08-21 20:52:45
attackspam	Brute force attack stopped by firewall	2020-08-20 07:00:08
attackspam	firewall-block, port(s): 8081/tcp	2020-08-19 03:07:14
attackspam	Mailserver and mailaccount attacks	2020-08-16 17:14:57
attackbots	Persistent port scanning [19 denied]	2020-08-14 13:59:18
attackbotsspam	ET DROP Dshield Block Listed Source group 1 - port: 443 proto: tcp cat: Misc Attackbytes: 60	2020-08-14 04:33:50
attackspam	TCP (SYN) 195.54.160.21:42126 -> port 8983, len 44	2020-08-13 17:19:26
attackspambots	firewall-block, port(s): 5601/tcp	2020-08-13 03:36:32
attackspambots	Port scan: Attack repeated for 24 hours	2020-08-12 15:34:40
attackbots	Unauthorized connection attempt detected from IP address 195.54.160.21 to port 8983 [T]	2020-08-11 07:06:24
attack	[08/Aug/2020:09:55:24 -0400] "GET /solr/admin/info/system?wt=json HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" [08/Aug/2020:10:42:49 -0400] "GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"	2020-08-09 19:21:59
attackbots	Sent packet to closed port: 7070	2020-08-09 05:42:26
attackbots	[Sat Aug 08 19:40:24.464334 2020] [:error] [pid 26172:tid 139707887642368] [client 195.54.160.21:37702] [client 195.54.160.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197:80"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "Xy6dOGEPOJbUapzPtoHivgAAAcM"] ...	2020-08-08 21:36:09
attack	IP: 195.54.160.21 Ports affected HTTP protocol over TLS/SSL (443) Abuse Confidence rating 100% Found in DNSBL('s) ASN Details AS49505 OOO Network of data-centers Selectel Russia (RU) CIDR 195.54.160.0/23 Log Date: 7/08/2020 7:58:45 AM UTC	2020-08-07 16:30:31
attackbots	Brute force attack stopped by firewall	2020-08-05 06:47:41
attackbots	404 NOT FOUND	2020-08-04 00:29:55
attackbots	TCP (SYN) 195.54.160.21:41402 -> port 80, len 44	2020-07-31 00:53:47

Comments on same subnet:

IP	Type	Details	Datetime
195.54.160.180	attackspambots	Invalid user 9122 from 195.54.160.180 port 53705	2020-10-14 07:03:26
195.54.160.180	attackspam	Oct 13 09:25:01 santamaria sshd\[2434\]: Invalid user test from 195.54.160.180 Oct 13 09:25:01 santamaria sshd\[2434\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 13 09:25:02 santamaria sshd\[2434\]: Failed password for invalid user test from 195.54.160.180 port 58091 ssh2 ...	2020-10-13 15:27:41
195.54.160.180	attackspambots	Oct 12 20:05:00 er4gw sshd[19698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180	2020-10-13 08:03:50
195.54.160.180	attackspambots	Oct 11 23:32:20 vmd26974 sshd[30264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 11 23:32:23 vmd26974 sshd[30264]: Failed password for invalid user system from 195.54.160.180 port 14159 ssh2 ...	2020-10-12 05:35:19
195.54.160.180	attack	Oct 11 15:41:50 santamaria sshd\[26585\]: Invalid user system from 195.54.160.180 Oct 11 15:41:50 santamaria sshd\[26585\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 11 15:41:52 santamaria sshd\[26585\]: Failed password for invalid user system from 195.54.160.180 port 32650 ssh2 ...	2020-10-11 21:42:00
195.54.160.180	attackbotsspam	Oct 11 06:35:54 ajax sshd[22680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 11 06:35:56 ajax sshd[22680]: Failed password for invalid user system from 195.54.160.180 port 14992 ssh2	2020-10-11 13:39:13
195.54.160.180	attackspam	Oct 11 01:01:19 jane sshd[1580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 11 01:01:21 jane sshd[1580]: Failed password for invalid user system from 195.54.160.180 port 22480 ssh2 ...	2020-10-11 07:02:46
195.54.160.180	attackspambots	Oct 10 15:31:39 vps639187 sshd\[5463\]: Invalid user video from 195.54.160.180 port 52740 Oct 10 15:31:39 vps639187 sshd\[5463\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.180 Oct 10 15:31:41 vps639187 sshd\[5463\]: Failed password for invalid user video from 195.54.160.180 port 52740 ssh2 ...	2020-10-10 21:45:57
195.54.160.180	attackbots	2020-10-09 13:00:16.840788-0500 localhost sshd[8287]: Failed password for invalid user video from 195.54.160.180 port 14076 ssh2	2020-10-10 02:12:15
195.54.160.180	attackspambots	2020-10-08 UTC: (14x) - admin(8x),record(6x)	2020-10-09 17:56:43
195.54.160.183	attack	Invalid user ftp from 195.54.160.183 port 22214	2020-10-07 04:56:15
195.54.160.188	attackbotsspam	Repeated RDP login failures. Last user: admin	2020-10-07 04:50:44
195.54.160.180	attack	SSH login attempts.	2020-10-07 04:39:54
195.54.160.183	attackspam	Invalid user ftp from 195.54.160.183 port 22214	2020-10-06 21:02:54
195.54.160.188	attackspam	Repeated RDP login failures. Last user: administrator	2020-10-06 20:56:34

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 195.54.160.21
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 61059
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;195.54.160.21.			IN	A

;; AUTHORITY SECTION:
.			466	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020071201 1800 900 604800 86400

;; Query time: 43 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Jul 13 04:20:55 CST 2020
;; MSG SIZE  rcvd: 117

Host info

Host 21.160.54.195.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 21.160.54.195.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
14.48.53.188	attackspam	Telnet/23 MH Probe, Scan, BF, Hack -	2020-02-28 02:16:38
125.161.80.223	attackspam	20/2/27@09:24:23: FAIL: Alarm-Network address from=125.161.80.223 20/2/27@09:24:23: FAIL: Alarm-Network address from=125.161.80.223 ...	2020-02-28 02:04:10
34.94.3.3	attack	Feb 27 00:50:16 ns sshd[27642]: Connection from 34.94.3.3 port 47288 on 134.119.36.27 port 22 Feb 27 00:50:17 ns sshd[27642]: Invalid user amhostname from 34.94.3.3 port 47288 Feb 27 00:50:17 ns sshd[27642]: Failed password for invalid user amhostname from 34.94.3.3 port 47288 ssh2 Feb 27 00:50:18 ns sshd[27642]: Received disconnect from 34.94.3.3 port 47288:11: Bye Bye [preauth] Feb 27 00:50:18 ns sshd[27642]: Disconnected from 34.94.3.3 port 47288 [preauth] Feb 27 01:18:18 ns sshd[12013]: Connection from 34.94.3.3 port 55126 on 134.119.36.27 port 22 Feb 27 01:18:19 ns sshd[12013]: Invalid user tanwei from 34.94.3.3 port 55126 Feb 27 01:18:19 ns sshd[12013]: Failed password for invalid user tanwei from 34.94.3.3 port 55126 ssh2 Feb 27 01:18:19 ns sshd[12013]: Received disconnect from 34.94.3.3 port 55126:11: Bye Bye [preauth] Feb 27 01:18:19 ns sshd[12013]: Disconnected from 34.94.3.3 port 55126 [preauth] Feb 27 01:26:49 ns sshd[26739]: Connection from 34.94.3.3 port 4........ -------------------------------	2020-02-28 02:16:20
222.186.30.209	attackbots	Feb 27 19:33:47 localhost sshd\[8782\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.209 user=root Feb 27 19:33:49 localhost sshd\[8782\]: Failed password for root from 222.186.30.209 port 18450 ssh2 Feb 27 19:33:50 localhost sshd\[8782\]: Failed password for root from 222.186.30.209 port 18450 ssh2	2020-02-28 02:36:03
5.196.141.132	attack	Brute Force SSH	2020-02-28 02:04:29
104.248.88.100	attack	GET /wp-login.php HTTP/1.1	2020-02-28 02:37:37
222.186.173.180	attack	Feb 27 13:14:11 ny01 sshd[7197]: Failed password for root from 222.186.173.180 port 46726 ssh2 Feb 27 13:14:23 ny01 sshd[7197]: error: maximum authentication attempts exceeded for root from 222.186.173.180 port 46726 ssh2 [preauth] Feb 27 13:14:29 ny01 sshd[7311]: Failed password for root from 222.186.173.180 port 53998 ssh2	2020-02-28 02:14:50
222.186.175.148	attackbots	Feb 27 19:16:23 dedicated sshd[18430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.175.148 user=root Feb 27 19:16:25 dedicated sshd[18430]: Failed password for root from 222.186.175.148 port 63500 ssh2	2020-02-28 02:20:08
139.224.148.206	attackspam	Port 22212 scan denied	2020-02-28 02:30:02
144.217.34.147	attack	Port 59701 scan denied	2020-02-28 02:12:02
139.209.200.210	attackspambots	Telnet/23 MH Probe, Scan, BF, Hack -	2020-02-28 02:35:17
61.177.172.128	attackspambots	2020-02-27T18:11:46.604944abusebot-3.cloudsearch.cf sshd[26607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.128 user=root 2020-02-27T18:11:48.679231abusebot-3.cloudsearch.cf sshd[26607]: Failed password for root from 61.177.172.128 port 3621 ssh2 2020-02-27T18:11:51.647017abusebot-3.cloudsearch.cf sshd[26607]: Failed password for root from 61.177.172.128 port 3621 ssh2 2020-02-27T18:11:46.604944abusebot-3.cloudsearch.cf sshd[26607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.177.172.128 user=root 2020-02-27T18:11:48.679231abusebot-3.cloudsearch.cf sshd[26607]: Failed password for root from 61.177.172.128 port 3621 ssh2 2020-02-27T18:11:51.647017abusebot-3.cloudsearch.cf sshd[26607]: Failed password for root from 61.177.172.128 port 3621 ssh2 2020-02-27T18:11:46.604944abusebot-3.cloudsearch.cf sshd[26607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ru ...	2020-02-28 02:36:43
54.38.36.210	attackspam	Feb 27 19:16:43 silence02 sshd[32374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.36.210 Feb 27 19:16:46 silence02 sshd[32374]: Failed password for invalid user debian-spamd from 54.38.36.210 port 60674 ssh2 Feb 27 19:23:34 silence02 sshd[32718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.36.210	2020-02-28 02:24:23
2.228.163.157	attackspam	Feb 27 17:19:09 sshd\[32536\]: Invalid user web from 2.228.163.157Feb 27 17:19:11 sshd\[32536\]: Failed password for invalid user web from 2.228.163.157 port 45560 ssh2 ...	2020-02-28 02:18:46
79.30.24.166	attackspam	Automatic report - Port Scan Attack	2020-02-28 02:34:44

Recently Reported IPs

99.76.37.121	114.33.29.180	213.6.239.82	187.148.23.94
219.139.22.255	115.193.170.21	34.95.168.220	24.216.33.90
202.5.23.212	27.211.255.12	213.45.105.233	187.189.15.30
91.240.118.64	192.16.104.3	191.32.29.218	219.147.85.250
190.144.182.85	59.126.87.92	189.63.58.158	36.57.59.5