City: unknown
Region: unknown
Country: Indonesia
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
| IP | Type | Details | Datetime |
|---|---|---|---|
| 202.137.18.40 | attackspambots | [Mon Apr 06 10:56:08.801201 2020] [:error] [pid 22064:tid 140022813370112] [client 202.137.18.40:34454] [client 202.137.18.40] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "147"] [id "913101"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.22.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS"] [tag "OWASP_CRS/AUTOMATION/SCRIPTING"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/admin/config.php"] [unique_id "XoqoWP198pQqCvxLDH3hWQAAAv0"] ... |
2020-04-06 12:33:00 |
| 202.137.18.2 | attack | Unauthorized connection attempt detected from IP address 202.137.18.2 to port 445 |
2019-12-22 20:13:33 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 202.137.18.117
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18824
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;202.137.18.117. IN A
;; AUTHORITY SECTION:
. 30 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025020901 1800 900 604800 86400
;; Query time: 13 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Feb 10 09:22:05 CST 2025
;; MSG SIZE rcvd: 107117.18.137.202.in-addr.arpa domain name pointer ln-static-202-137-18-117.link.net.id.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
117.18.137.202.in-addr.arpa name = ln-static-202-137-18-117.link.net.id.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 24.72.182.56 | attack | Invalid user oracle from 24.72.182.56 port 52574 |
2020-02-20 17:20:53 |
| 119.70.98.138 | attackspambots | Port probing on unauthorized port 8000 |
2020-02-20 16:59:45 |
| 87.19.50.77 | attackbotsspam | Unauthorised access (Feb 20) SRC=87.19.50.77 LEN=44 TTL=52 ID=34198 TCP DPT=23 WINDOW=57035 SYN |
2020-02-20 16:53:21 |
| 125.161.107.150 | attackbotsspam | Honeypot attack, port: 445, PTR: 150.subnet125-161-107.speedy.telkom.net.id. |
2020-02-20 17:14:21 |
| 163.172.204.185 | attackspam | Invalid user student from 163.172.204.185 port 58696 |
2020-02-20 17:24:20 |
| 101.78.229.4 | attack | SSH Brute Force |
2020-02-20 17:33:19 |
| 45.117.32.2 | attackbots | Honeypot attack, port: 445, PTR: PTR record not found |
2020-02-20 17:00:25 |
| 5.141.23.46 | attackbotsspam | 1582174364 - 02/20/2020 05:52:44 Host: 5.141.23.46/5.141.23.46 Port: 445 TCP Blocked |
2020-02-20 17:19:17 |
| 58.215.61.68 | attack | Honeypot attack, port: 445, PTR: PTR record not found |
2020-02-20 17:17:21 |
| 115.20.253.113 | attack | Honeypot attack, port: 81, PTR: PTR record not found |
2020-02-20 16:54:05 |
| 85.195.52.41 | attackbots | Feb 20 03:51:27 server sshd\[11166\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.195.52.41 Feb 20 03:51:28 server sshd\[11166\]: Failed password for invalid user pi from 85.195.52.41 port 37744 ssh2 Feb 20 03:51:39 server sshd\[11164\]: Failed password for invalid user pi from 85.195.52.41 port 37740 ssh2 Feb 20 11:02:24 server sshd\[21399\]: Invalid user pi from 85.195.52.41 Feb 20 11:02:24 server sshd\[21399\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=user41.85-195-52.netatonce.net ... |
2020-02-20 17:30:50 |
| 52.83.45.206 | attackspam | Invalid user dba from 52.83.45.206 port 58544 |
2020-02-20 17:12:03 |
| 183.82.54.178 | attackbotsspam | Honeypot attack, port: 445, PTR: broadband.actcorp.in. |
2020-02-20 17:29:27 |
| 106.53.19.38 | attackspam | Feb 20 05:53:13 haigwepa sshd[29318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.53.19.38 Feb 20 05:53:15 haigwepa sshd[29318]: Failed password for invalid user guest from 106.53.19.38 port 33140 ssh2 ... |
2020-02-20 16:54:28 |
| 86.44.233.83 | attackbots | firewall-block, port(s): 81/tcp |
2020-02-20 17:02:41 |