City: unknown
Region: unknown
Country: United Kingdom
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See https://docs.db.ripe.net/terms-conditions.html
% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.
% Information related to '195.96.139.0 - 195.96.139.255'
% Abuse contact for '195.96.139.0 - 195.96.139.255' is 'network-abuse@driftnet.io'
inetnum: 195.96.139.0 - 195.96.139.255
netname: UK-DRIFTNET-20260127
remarks: +-----------------------------------------------------------
remarks: | This IP range is not attacking your network.
remarks: | Visit https://internet-measurement.com for more details.
remarks: | View data collected at https://driftnet.io.
remarks: +-----------------------------------------------------------
country: GB
org: ORG-DL595-RIPE
admin-c: DH9005-RIPE
tech-c: DH9005-RIPE
status: ALLOCATED PA
mnt-by: lir-uk-driftnet-1-MNT
mnt-by: RIPE-NCC-HM-MNT
created: 2026-01-27T15:37:46Z
last-modified: 2026-05-12T14:16:48Z
source: RIPE
organisation: ORG-DL595-RIPE
org-name: Driftnet Ltd
remarks: +-----------------------------------------------------------
remarks: | We are not attacking your network.
remarks: | Visit https://internet-measurement.com for more details.
remarks: | View data collected at https://driftnet.io.
remarks: +-----------------------------------------------------------
country: GB
reg-nr: 15588031
org-type: LIR
address: 1140 Avenue of the Americas, 19th Floor
address: 10036
address: New York
address: UNITED STATES
phone: +442037450350
admin-c: DH9005-RIPE
tech-c: DH9005-RIPE
abuse-c: AR77106-RIPE
mnt-ref: lir-uk-driftnet-1-MNT
mnt-by: RIPE-NCC-HM-MNT
mnt-by: lir-uk-driftnet-1-MNT
created: 2024-10-30T18:00:20Z
last-modified: 2026-06-02T10:02:58Z
source: RIPE # Filtered
role: Driftnet Hostmaster
remarks: +-----------------------------------------------------------
remarks: | We are not attacking your network.
remarks: | Visit https://internet-measurement.com for more details.
remarks: | View data collected at https://driftnet.io.
remarks: +-----------------------------------------------------------
address: 1140 Avenue of the Americas, 19th Floor
address: New York, NY 10036
address: UNITED STATES
phone: +442037450350
abuse-mailbox: network-abuse@driftnet.io
nic-hdl: DH9005-RIPE
mnt-by: lir-uk-driftnet-1-MNT
created: 2024-10-30T18:00:18Z
last-modified: 2026-06-02T10:04:23Z
source: RIPE # Filtered
% Information related to '195.96.139.0/24AS211298'
route: 195.96.139.0/24
origin: AS211298
created: 2026-05-12T14:06:44Z
last-modified: 2026-05-12T14:06:44Z
source: RIPE
mnt-by: lir-uk-driftnet-1-MNT
% This query was served by the RIPE Database Query Service version 1.124.1 (DEXTER); <<>> DiG 9.10.3-P4-Ubuntu <<>> 195.96.139.55
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13911
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;195.96.139.55. IN A
;; AUTHORITY SECTION:
. 30 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2026102003 1800 900 604800 86400
;; Query time: 30 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Oct 21 10:00:58 CST 2026
;; MSG SIZE rcvd: 10655.139.96.195.in-addr.arpa domain name pointer r5-55-37.monitoring.internet-measurement.com.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
55.139.96.195.in-addr.arpa name = r5-55-37.monitoring.internet-measurement.com.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 117.246.129.193 | attackspambots | LGS,WP GET /wp-login.php |
2019-08-16 10:01:13 |
| 103.240.91.193 | attack | proto=tcp . spt=45998 . dpt=25 . (listed on Blocklist de Aug 15) (43) |
2019-08-16 10:14:17 |
| 51.158.190.103 | attackbotsspam | 445/tcp [2019-08-15]1pkt |
2019-08-16 09:59:52 |
| 138.68.17.96 | attack | Aug 15 10:47:23 kapalua sshd\[27499\]: Invalid user anastacia from 138.68.17.96 Aug 15 10:47:23 kapalua sshd\[27499\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.17.96 Aug 15 10:47:25 kapalua sshd\[27499\]: Failed password for invalid user anastacia from 138.68.17.96 port 46078 ssh2 Aug 15 10:52:00 kapalua sshd\[27985\]: Invalid user zimbra from 138.68.17.96 Aug 15 10:52:00 kapalua sshd\[27985\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.17.96 |
2019-08-16 10:02:49 |
| 139.59.41.6 | attack | Aug 16 01:36:20 minden010 sshd[2343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.41.6 Aug 16 01:36:22 minden010 sshd[2343]: Failed password for invalid user w from 139.59.41.6 port 36100 ssh2 Aug 16 01:41:31 minden010 sshd[4265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.41.6 ... |
2019-08-16 10:21:09 |
| 103.104.12.168 | attackspam | Lines containing failures of 103.104.12.168 auth.log:Aug 15 22:02:02 omfg sshd[26360]: Connection from 103.104.12.168 port 49222 on 78.46.60.40 port 22 auth.log:Aug 15 22:02:03 omfg sshd[26360]: Did not receive identification string from 103.104.12.168 auth.log:Aug 15 22:02:04 omfg sshd[26464]: Connection from 103.104.12.168 port 49236 on 78.46.60.42 port 22 auth.log:Aug 15 22:02:04 omfg sshd[26464]: Did not receive identification string from 103.104.12.168 auth.log:Aug 15 22:02:22 omfg sshd[26759]: Connection from 103.104.12.168 port 54283 on 78.46.60.40 port 22 auth.log:Aug 15 22:02:25 omfg sshd[26760]: Connection from 103.104.12.168 port 49769 on 78.46.60.42 port 22 auth.log:Aug 15 22:03:35 omfg sshd[26759]: Invalid user admin1 from 103.104.12.168 auth.log:Aug 15 22:03:36 omfg sshd[26760]: Invalid user admin1 from 103.104.12.168 auth.log:Aug 15 22:03:37 omfg sshd[26759]: Connection closed by 103.104.12.168 port 54283 [preauth] ........ ----------------------------------------------- https://www.blocklist |
2019-08-16 09:34:46 |
| 202.84.45.250 | attackspam | fail2ban |
2019-08-16 09:58:56 |
| 60.173.9.72 | attack | Aug 9 11:51:33 mailman postfix/smtpd[4268]: warning: unknown[60.173.9.72]: SASL LOGIN authentication failed: authentication failure |
2019-08-16 10:19:22 |
| 104.131.37.34 | attackbotsspam | Aug 16 07:26:04 vibhu-HP-Z238-Microtower-Workstation sshd\[9591\]: Invalid user kd from 104.131.37.34 Aug 16 07:26:04 vibhu-HP-Z238-Microtower-Workstation sshd\[9591\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.37.34 Aug 16 07:26:05 vibhu-HP-Z238-Microtower-Workstation sshd\[9591\]: Failed password for invalid user kd from 104.131.37.34 port 55926 ssh2 Aug 16 07:31:58 vibhu-HP-Z238-Microtower-Workstation sshd\[9858\]: Invalid user admin from 104.131.37.34 Aug 16 07:31:58 vibhu-HP-Z238-Microtower-Workstation sshd\[9858\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.37.34 ... |
2019-08-16 10:17:21 |
| 181.166.93.50 | attackspambots | DATE:2019-08-15 22:09:39, IP:181.166.93.50, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc-bis) |
2019-08-16 09:55:25 |
| 134.73.129.2 | attackbotsspam | Aug 16 00:26:46 MK-Soft-VM7 sshd\[5700\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.73.129.2 user=root Aug 16 00:26:48 MK-Soft-VM7 sshd\[5700\]: Failed password for root from 134.73.129.2 port 45102 ssh2 Aug 16 00:31:16 MK-Soft-VM7 sshd\[5746\]: Invalid user client from 134.73.129.2 port 43024 ... |
2019-08-16 09:43:59 |
| 218.92.0.204 | attackbotsspam | Aug 16 03:26:06 mail sshd\[3049\]: Failed password for root from 218.92.0.204 port 23918 ssh2 Aug 16 03:29:28 mail sshd\[3321\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.204 user=root Aug 16 03:29:30 mail sshd\[3321\]: Failed password for root from 218.92.0.204 port 12140 ssh2 Aug 16 03:29:33 mail sshd\[3321\]: Failed password for root from 218.92.0.204 port 12140 ssh2 Aug 16 03:29:35 mail sshd\[3321\]: Failed password for root from 218.92.0.204 port 12140 ssh2 |
2019-08-16 09:51:40 |
| 82.147.120.32 | attackspam | Mail sent to address obtained from MySpace hack |
2019-08-16 09:32:17 |
| 103.94.5.42 | attack | Aug 15 15:45:04 web9 sshd\[3399\]: Invalid user teamspeak from 103.94.5.42 Aug 15 15:45:04 web9 sshd\[3399\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.5.42 Aug 15 15:45:07 web9 sshd\[3399\]: Failed password for invalid user teamspeak from 103.94.5.42 port 42852 ssh2 Aug 15 15:51:41 web9 sshd\[4888\]: Invalid user serv_fun from 103.94.5.42 Aug 15 15:51:41 web9 sshd\[4888\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.94.5.42 |
2019-08-16 09:57:55 |
| 108.62.202.220 | attack | Splunk® : port scan detected: Aug 15 21:39:44 testbed kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:c0:42:d0:39:2c:30:08:00 SRC=108.62.202.220 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=56002 DPT=13300 WINDOW=65535 RES=0x00 SYN URGP=0 |
2019-08-16 09:49:21 |