197.248.2.55 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Kenya

Internet Service Provider: Safaricom

Hostname: unknown

Organization: Safaricom

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
197.248.206.126	attackbots	IP 197.248.206.126 attacked honeypot on port: 23 at 9/30/2020 1:33:38 PM	2020-10-02 02:59:19
197.248.206.126	attackspam	IP 197.248.206.126 attacked honeypot on port: 23 at 9/30/2020 1:33:38 PM	2020-10-01 19:11:12
197.248.2.229	attack	Lines containing failures of 197.248.2.229 Aug 10 09:22:20 siirappi sshd[12817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.248.2.229 user=r.r Aug 10 09:22:23 siirappi sshd[12817]: Failed password for r.r from 197.248.2.229 port 41106 ssh2 Aug 10 09:22:23 siirappi sshd[12817]: Received disconnect from 197.248.2.229 port 41106:11: Bye Bye [preauth] Aug 10 09:22:23 siirappi sshd[12817]: Disconnected from authenticating user r.r 197.248.2.229 port 41106 [preauth] Aug 10 09:33:03 siirappi sshd[13147]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.248.2.229 user=r.r Aug 10 09:33:05 siirappi sshd[13147]: Failed password for r.r from 197.248.2.229 port 59872 ssh2 Aug 10 09:33:06 siirappi sshd[13147]: Received disconnect from 197.248.2.229 port 59872:11: Bye Bye [preauth] Aug 10 09:33:06 siirappi sshd[13147]: Disconnected from authenticating user r.r 197.248.2.229 port 59872 [preauth........ ------------------------------	2020-08-10 16:03:03
197.248.225.110	attack	(imapd) Failed IMAP login from 197.248.225.110 (KE/Kenya/197-248-225-110.safaricombusiness.co.ke): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jul 7 01:31:37 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=197.248.225.110, lip=5.63.12.44, TLS: Connection closed, session=	2020-07-07 06:44:27
197.248.20.119	attackspambots	Dovecot Invalid User Login Attempt.	2020-06-26 20:51:11
197.248.21.41	attack	Unauthorized connection attempt from IP address 197.248.21.41 on Port 465(SMTPS)	2020-06-15 02:16:33
197.248.20.205	attackspambots	2020-06-10 18:20:56 Reject access to port(s):465 2 times a day	2020-06-11 14:21:42
197.248.21.41	attackbots	Unauthorized connection attempt from IP address 197.248.21.41 on port 993	2020-06-10 02:11:28
197.248.24.167	attack	(imapd) Failed IMAP login from 197.248.24.167 (KE/Kenya/197-248-24-167.safaricombusiness.co.ke): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jun 1 00:54:24 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 11 secs): user=, method=PLAIN, rip=197.248.24.167, lip=5.63.12.44, TLS, session=	2020-06-01 06:48:14
197.248.24.15	attackspam	2020-05-2609:29:171jdU1U-0007rg-Ac\<=info@whatsup2013.chH=$localhost$[197.248.24.15]:58965P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2240id=D7D264373CE8C784585D14AC68744320@whatsup2013.chT="Ihopelateronweshallquiteoftenthinkabouteachother"forquinton.donald2002@yahoo.com2020-05-2609:27:041jdTzC-0007gP-UW\<=info@whatsup2013.chH=$localhost$[14.162.132.72]:42277P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2190id=9396207378AC83C01C1950E82C8131BC@whatsup2013.chT="Iamactuallyinterestedinamalewithaniceheart"forandy.cory82@gmail.com2020-05-2609:27:401jdTzw-0007jo-4Z\<=info@whatsup2013.chH=95-54-90-129.dynamic.novgorod.dslavangard.ru$localhost$[95.54.90.129]:33090P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=2164id=898C3A6962B699DA06034AF236F31060@whatsup2013.chT="Iwouldlovetoobtainaguyforaseriousconnection"forlala123@yahoo.com2020-05-2609:29:041jdU1H-0007qI-1n\<=info@wh	2020-05-26 21:28:56
197.248.225.110	attack	2020-05-0511:15:571jVtgC-0003Re-8j\<=info@whatsup2013.chH=$localhost$[221.229.121.226]:44918P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3090id=2541683b301bcec2e5a01645b1767c7043f5086e@whatsup2013.chT="Youaresocharming"forhzhyness1@gmail.comnivaxxx26@gmail.com2020-05-0511:17:041jVthG-0003Wu-7M\<=info@whatsup2013.chH=$localhost$[212.113.234.114]:39343P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3160id=0286306368436961fdf84ee205f1dbc7af6c54@whatsup2013.chT="Youignitemyheart."forrondelogeorge9@gmail.comscottyboy118@gmail.com2020-05-0511:16:301jVtgj-0003V3-FB\<=info@whatsup2013.chH=$localhost$[113.172.53.153]:52483P=esmtpsaX=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256CV=noA=dovecot_login:info@whatsup2013.chS=3071id=288533606b406a62fefb4de106f2d8c48f7633@whatsup2013.chT="Youareaslovelyasasunlight"formarcko0122@gmail.comusmcl1218@gmail.com2020-05-0511:16:051jVtgK-0003Se-MM\<=info@whatsup2013.chH=$localhost$[197.248.	2020-05-05 22:02:38
197.248.234.202	attack	(imapd) Failed IMAP login from 197.248.234.202 (KE/Kenya/197-248-234-202.safaricombusiness.co.ke): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: May 2 18:36:03 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 8 secs): user=, method=PLAIN, rip=197.248.234.202, lip=5.63.12.44, TLS: Connection closed, session=<9qHly6qk2NXF+OrK>	2020-05-02 22:50:54
197.248.21.41	attackbotsspam	failed_logins	2020-04-27 08:20:08
197.248.223.142	attack	Repeated RDP login failures. Last user: User	2020-04-02 12:23:32
197.248.2.229	attackbotsspam	Dec 31 00:28:28 woltan sshd[4153]: Failed password for root from 197.248.2.229 port 37452 ssh2	2020-03-10 08:50:12

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 197.248.2.55
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 38386
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;197.248.2.55.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019042800 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Sun Apr 28 20:09:45 +08 2019
;; MSG SIZE  rcvd: 116

Host info

55.2.248.197.in-addr.arpa domain name pointer 197-248-2-55.safaricombusiness.co.ke.

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

Non-authoritative answer:
55.2.248.197.in-addr.arpa	name = 197-248-2-55.safaricombusiness.co.ke.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
161.0.153.71	attack	(imapd) Failed IMAP login from 161.0.153.71 (TT/Trinidad and Tobago/-): 1 in the last 3600 secs	2020-03-10 00:13:09
45.95.32.245	attackspambots	Mar 9 13:17:43 mail.srvfarm.net postfix/smtpd[4050491]: NOQUEUE: reject: RCPT from unknown[45.95.32.245]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= Mar 9 13:17:43 mail.srvfarm.net postfix/smtpd[4047796]: NOQUEUE: reject: RCPT from unknown[45.95.32.245]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= Mar 9 13:17:43 mail.srvfarm.net postfix/smtpd[4050490]: NOQUEUE: reject: RCPT from unknown[45.95.32.245]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= Mar 9 13:17:43 mail.srvfarm.net postfix/smtpd[4030704]: NOQUEUE: reject: RCPT from unknown[45.95.32.245]: 450 4.1.8	2020-03-10 00:22:34
111.231.93.242	attackbotsspam	Mar 9 19:10:58 server sshd\[13488\]: Invalid user linux from 111.231.93.242 Mar 9 19:10:58 server sshd\[13488\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.93.242 Mar 9 19:11:00 server sshd\[13488\]: Failed password for invalid user linux from 111.231.93.242 port 52838 ssh2 Mar 9 19:16:51 server sshd\[14787\]: Invalid user linux from 111.231.93.242 Mar 9 19:16:51 server sshd\[14787\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.93.242 ...	2020-03-10 00:37:16
92.126.222.172	attack	(imapd) Failed IMAP login from 92.126.222.172 (RU/Russia/host-92-126-222-172.pppoe.omsknet.ru): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Mar 9 15:58:15 ir1 dovecot[4133960]: imap-login: Disconnected (auth failed, 1 attempts in 13 secs): user=, method=PLAIN, rip=92.126.222.172, lip=5.63.12.44, TLS: Connection closed, session=	2020-03-10 00:13:25
180.248.121.171	attackbotsspam	Email rejected due to spam filtering	2020-03-10 00:41:23
220.247.235.48	attackbots	Mar 9 15:00:48 server sshd\[16962\]: Invalid user sh from 220.247.235.48 Mar 9 15:00:48 server sshd\[16962\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.247.235.48 Mar 9 15:00:50 server sshd\[16962\]: Failed password for invalid user sh from 220.247.235.48 port 57742 ssh2 Mar 9 15:28:55 server sshd\[23005\]: Invalid user sh from 220.247.235.48 Mar 9 15:28:55 server sshd\[23005\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.247.235.48 ...	2020-03-09 23:54:14
222.186.180.6	attackspambots	2020-03-09T16:31:32.437334shield sshd\[24434\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.6 user=root 2020-03-09T16:31:34.260858shield sshd\[24434\]: Failed password for root from 222.186.180.6 port 33328 ssh2 2020-03-09T16:31:37.418406shield sshd\[24434\]: Failed password for root from 222.186.180.6 port 33328 ssh2 2020-03-09T16:31:40.324486shield sshd\[24434\]: Failed password for root from 222.186.180.6 port 33328 ssh2 2020-03-09T16:31:43.312206shield sshd\[24434\]: Failed password for root from 222.186.180.6 port 33328 ssh2	2020-03-10 00:34:46
45.95.33.86	attack	Mar 9 13:20:33 mail.srvfarm.net postfix/smtpd[4050491]: NOQUEUE: reject: RCPT from unknown[45.95.33.86]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= Mar 9 13:20:34 mail.srvfarm.net postfix/smtpd[4030704]: NOQUEUE: reject: RCPT from unknown[45.95.33.86]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= Mar 9 13:20:56 mail.srvfarm.net postfix/smtpd[4050488]: NOQUEUE: reject: RCPT from unknown[45.95.33.86]: 450 4.1.8 : Sender address rejected: Domain not found; from= to= proto=ESMTP helo= Mar 9 13:20:58 mail.srvfarm.net postfix/smtpd[4047793]: NOQUEUE: reject: RCPT from u	2020-03-10 00:22:15
110.44.124.183	attackbotsspam	Mar 9 sshd[12770]: Invalid user admin from 110.44.124.183 port 2822	2020-03-10 00:27:35
103.206.162.54	attackbots	port scan and connect, tcp 23 (telnet)	2020-03-10 00:08:33
112.111.248.36	attackspam	DLink DSL Remote OS Command Injection Vulnerability	2020-03-10 00:31:22
222.186.30.76	attack	Mar 9 20:54:58 gw1 sshd[23522]: Failed password for root from 222.186.30.76 port 49855 ssh2 Mar 9 20:55:00 gw1 sshd[23522]: Failed password for root from 222.186.30.76 port 49855 ssh2 ...	2020-03-10 00:00:08
181.123.10.221	attackbotsspam	$f2bV_matches	2020-03-10 00:30:24
169.1.29.38	attackspam	DATE:2020-03-09 13:28:11, IP:169.1.29.38, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)	2020-03-10 00:30:58
14.138.181.42	attack	" "	2020-03-10 00:35:32

Recently Reported IPs

160.57.218.209	190.69.135.182	197.245.32.117	140.6.13.20
170.84.48.230	57.35.221.84	151.209.207.76	46.1.211.139
114.120.237.235	103.109.57.204	150.174.79.239	78.65.43.164
197.242.145.186	90.213.131.206	177.52.249.225	36.27.67.156
59.158.95.16	121.182.112.212	126.123.208.1	153.147.38.185