City: unknown
Region: unknown
Country: South Africa
Internet Service Provider: Internet Solutions
Hostname: unknown
Organization: unknown
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attackspam | Unauthorized connection attempt detected from IP address 196.34.242.58 to port 1433 [J] |
2020-01-29 09:13:00 |
| attack | firewall-block, port(s): 445/tcp |
2019-09-16 16:02:23 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 196.34.242.58
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 17879
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;196.34.242.58. IN A
;; AUTHORITY SECTION:
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019091600 1800 900 604800 86400
;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Mon Sep 16 16:02:17 CST 2019
;; MSG SIZE rcvd: 11758.242.34.196.in-addr.arpa domain name pointer dsl.rqtech.co.za.
58.242.34.196.in-addr.arpa domain name pointer dsl.qst.co.za.
Server: 67.207.67.2
Address: 67.207.67.2#53
Non-authoritative answer:
58.242.34.196.in-addr.arpa name = dsl.qst.co.za.
58.242.34.196.in-addr.arpa name = dsl.rqtech.co.za.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 218.75.148.181 | attack | [munged]::443 218.75.148.181 - - [03/Oct/2019:06:20:29 +0200] "POST /[munged]: HTTP/1.1" 200 8165 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" [munged]::443 218.75.148.181 - - [03/Oct/2019:06:20:30 +0200] "POST /[munged]: HTTP/1.1" 200 4388 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" [munged]::443 218.75.148.181 - - [03/Oct/2019:06:20:32 +0200] "POST /[munged]: HTTP/1.1" 200 4388 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" [munged]::443 218.75.148.181 - - [03/Oct/2019:06:20:33 +0200] "POST /[munged]: HTTP/1.1" 200 4388 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" [munged]::443 218.75.148.181 - - [03/Oct/2019:06:20:34 +0200] "POST /[munged]: HTTP/1.1" 200 4388 "http://[munged]:/[munged]:" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" [munged]::443 218.75.148.181 - - [03/Oct/2019:06: |
2019-10-03 17:22:36 |
| 164.132.42.32 | attackspambots | Oct 3 04:56:29 ip-172-31-1-72 sshd\[24192\]: Invalid user fileserver from 164.132.42.32 Oct 3 04:56:29 ip-172-31-1-72 sshd\[24192\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.42.32 Oct 3 04:56:31 ip-172-31-1-72 sshd\[24192\]: Failed password for invalid user fileserver from 164.132.42.32 port 41848 ssh2 Oct 3 05:00:10 ip-172-31-1-72 sshd\[24238\]: Invalid user supermbox from 164.132.42.32 Oct 3 05:00:10 ip-172-31-1-72 sshd\[24238\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.132.42.32 |
2019-10-03 17:40:04 |
| 164.132.51.91 | attackbots | 2019-10-03T07:30:02.221525abusebot.cloudsearch.cf sshd\[7677\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.ip-164-132-51.eu user=root |
2019-10-03 17:19:22 |
| 138.68.146.186 | attack | SSH authentication failure x 6 reported by Fail2Ban ... |
2019-10-03 17:18:21 |
| 138.68.140.76 | attack | 2019-08-18 20:18:37,508 fail2ban.actions [878]: NOTICE [sshd] Ban 138.68.140.76 2019-08-18 23:26:22,206 fail2ban.actions [878]: NOTICE [sshd] Ban 138.68.140.76 2019-08-19 02:30:50,934 fail2ban.actions [878]: NOTICE [sshd] Ban 138.68.140.76 ... |
2019-10-03 17:24:28 |
| 222.186.175.151 | attackbotsspam | Oct 3 11:39:06 root sshd[16447]: Failed password for root from 222.186.175.151 port 57654 ssh2 Oct 3 11:39:12 root sshd[16447]: Failed password for root from 222.186.175.151 port 57654 ssh2 Oct 3 11:39:18 root sshd[16447]: Failed password for root from 222.186.175.151 port 57654 ssh2 Oct 3 11:39:25 root sshd[16447]: Failed password for root from 222.186.175.151 port 57654 ssh2 ... |
2019-10-03 17:44:55 |
| 58.17.243.151 | attackspambots | 2019-10-03T07:20:31.169527hub.schaetter.us sshd\[8059\]: Invalid user magic from 58.17.243.151 port 5499 2019-10-03T07:20:31.178767hub.schaetter.us sshd\[8059\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.17.243.151 2019-10-03T07:20:33.303478hub.schaetter.us sshd\[8059\]: Failed password for invalid user magic from 58.17.243.151 port 5499 ssh2 2019-10-03T07:26:10.522938hub.schaetter.us sshd\[8102\]: Invalid user admin from 58.17.243.151 port 15267 2019-10-03T07:26:10.529420hub.schaetter.us sshd\[8102\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.17.243.151 ... |
2019-10-03 17:43:15 |
| 46.73.187.225 | attack | Brute force RDP, port 3389 |
2019-10-03 17:55:40 |
| 222.186.52.78 | attack | 2019-10-03 07:26:23,644 fail2ban.actions \[946\]: NOTICE \[sshd\] Ban 222.186.52.78 2019-10-03 07:57:04,085 fail2ban.actions \[946\]: NOTICE \[sshd\] Ban 222.186.52.78 2019-10-03 08:27:13,959 fail2ban.actions \[946\]: NOTICE \[sshd\] Ban 222.186.52.78 2019-10-03 08:57:26,771 fail2ban.actions \[946\]: NOTICE \[sshd\] Ban 222.186.52.78 2019-10-03 09:28:03,569 fail2ban.actions \[946\]: NOTICE \[sshd\] Ban 222.186.52.78 ... |
2019-10-03 17:41:20 |
| 171.7.247.235 | attackbotsspam | WordPress wp-login brute force :: 171.7.247.235 0.124 BYPASS [03/Oct/2019:13:54:31 1000] [censored_1] "POST /wp-login.php HTTP/1.1" 200 3972 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" |
2019-10-03 17:24:01 |
| 167.99.7.178 | attackspam | Sep 23 15:52:16 vtv3 sshd\[6242\]: Invalid user oracle from 167.99.7.178 port 57041 Sep 23 15:52:16 vtv3 sshd\[6242\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.7.178 Sep 23 15:52:18 vtv3 sshd\[6242\]: Failed password for invalid user oracle from 167.99.7.178 port 57041 ssh2 Sep 23 15:56:07 vtv3 sshd\[8403\]: Invalid user admin from 167.99.7.178 port 50550 Sep 23 15:56:07 vtv3 sshd\[8403\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.7.178 Sep 23 16:06:33 vtv3 sshd\[13539\]: Invalid user kaden from 167.99.7.178 port 54564 Sep 23 16:06:33 vtv3 sshd\[13539\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.7.178 Sep 23 16:06:35 vtv3 sshd\[13539\]: Failed password for invalid user kaden from 167.99.7.178 port 54564 ssh2 Sep 23 16:10:06 vtv3 sshd\[15175\]: Invalid user service from 167.99.7.178 port 46492 Sep 23 16:10:06 vtv3 sshd\[15175\]: pam_unix\(sshd: |
2019-10-03 17:30:32 |
| 139.59.190.69 | attackspam | 2019-10-03T09:31:10.667801abusebot-3.cloudsearch.cf sshd\[11380\]: Invalid user deploy from 139.59.190.69 port 38165 |
2019-10-03 17:43:35 |
| 157.245.198.59 | attackbotsspam | Port scan on 5 port(s): 7242 7248 7280 7289 7299 |
2019-10-03 17:32:27 |
| 138.197.213.233 | attack | Invalid user alex from 138.197.213.233 port 60876 |
2019-10-03 17:37:41 |
| 107.170.199.180 | attackspam | Oct 3 09:41:55 game-panel sshd[19163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.199.180 Oct 3 09:41:57 game-panel sshd[19163]: Failed password for invalid user kerry from 107.170.199.180 port 50490 ssh2 Oct 3 09:46:08 game-panel sshd[19332]: Failed password for root from 107.170.199.180 port 41963 ssh2 |
2019-10-03 17:48:53 |