City: unknown
Region: unknown
Country: United States of America (the)
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 21.27.239.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 42704
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;21.27.239.1. IN A
;; AUTHORITY SECTION:
. 30 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025012802 1800 900 604800 86400
;; Query time: 9 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Jan 29 07:12:17 CST 2025
;; MSG SIZE rcvd: 104Host 1.239.27.21.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 1.239.27.21.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 121.30.208.197 | attack | DATE:2020-06-08 19:11:56, IP:121.30.208.197, PORT:ssh SSH brute force auth (docker-dc) |
2020-06-09 01:39:43 |
| 148.70.125.207 | attackspambots | Jun 8 17:19:21 datentool sshd[18188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.125.207 user=r.r Jun 8 17:19:23 datentool sshd[18188]: Failed password for r.r from 148.70.125.207 port 38922 ssh2 Jun 8 17:24:43 datentool sshd[18251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.125.207 user=r.r Jun 8 17:24:45 datentool sshd[18251]: Failed password for r.r from 148.70.125.207 port 55026 ssh2 Jun 8 17:27:04 datentool sshd[18265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.125.207 user=r.r Jun 8 17:27:07 datentool sshd[18265]: Failed password for r.r from 148.70.125.207 port 49190 ssh2 Jun 8 17:29:26 datentool sshd[18280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.125.207 user=r.r Jun 8 17:29:27 datentool sshd[18280]: Failed password for r.r from 148.70.125......... ------------------------------- |
2020-06-09 01:38:03 |
| 45.153.201.33 | attack | Lines containing failures of 45.153.201.33 Jun 8 00:28:50 linuxrulz sshd[7849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.153.201.33 user=r.r Jun 8 00:28:52 linuxrulz sshd[7849]: Failed password for r.r from 45.153.201.33 port 50956 ssh2 Jun 8 00:28:53 linuxrulz sshd[7849]: Received disconnect from 45.153.201.33 port 50956:11: Bye Bye [preauth] Jun 8 00:28:53 linuxrulz sshd[7849]: Disconnected from authenticating user r.r 45.153.201.33 port 50956 [preauth] Jun 8 00:45:37 linuxrulz sshd[10323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.153.201.33 user=r.r Jun 8 00:45:39 linuxrulz sshd[10323]: Failed password for r.r from 45.153.201.33 port 36298 ssh2 Jun 8 00:45:41 linuxrulz sshd[10323]: Received disconnect from 45.153.201.33 port 36298:11: Bye Bye [preauth] Jun 8 00:45:41 linuxrulz sshd[10323]: Disconnected from authenticating user r.r 45.153.201.33 port 36298 [pre........ ------------------------------ |
2020-06-09 01:43:30 |
| 62.148.142.202 | attackspam | $f2bV_matches |
2020-06-09 01:36:17 |
| 45.124.94.37 | attackbots | Jun 8 10:43:25 xxxx sshguard[23161]: Blocking "45.124.94.37/32" for 30720 secs (5 attacks in 225 secs, after 9 abuses over 32700 secs.) Jun 8 12:01:28 xxxx sshd[62700]: Connection closed by 45.124.94.37 port 43976 [preauth] Jun 8 12:02:23 xxxx sshd[62706]: Connection closed by 45.124.94.37 port 41832 [preauth] |
2020-06-09 02:10:15 |
| 139.162.202.229 | attackspambots | port scan and connect, tcp 9200 (elasticsearch) |
2020-06-09 01:59:34 |
| 66.249.65.210 | attackbots | [Mon Jun 08 19:03:40.563547 2020] [:error] [pid 25994:tid 140451873027840] [client 66.249.65.210:58817] [client 66.249.65.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "((?:[~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>][^~!@#\\\\$%\\\\^&\\\\*\\\\(\\\\)\\\\-\\\\+=\\\\{\\\\}\\\\[\\\\]\\\\|:;\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98`<>]*?){6})" at ARGS:id. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "1526"] [id "942431"] [msg "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)"] [data "Matched Data: :kalender-tanam-katam-terpadu-kecamatan- found within ARGS:id: 1416:kalender-tanam-katam-terpadu-kecamatan-ngrambe-kabupaten-ngawi-tahun-2016-2017"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_
... |
2020-06-09 01:36:59 |
| 62.122.156.79 | attack | $f2bV_matches |
2020-06-09 02:11:17 |
| 122.116.148.146 | attackspambots | Honeypot attack, port: 81, PTR: 122-116-148-146.HINET-IP.hinet.net. |
2020-06-09 01:46:11 |
| 107.170.195.87 | attack | Repeating Hacking Attempt |
2020-06-09 01:58:29 |
| 185.156.73.60 | attackbots |
|
2020-06-09 01:45:39 |
| 64.150.164.233 | attackspam | Jun 8 06:03:13 Host-KLAX-C sshd[20843]: User root from 64.150.164.233 not allowed because not listed in AllowUsers ... |
2020-06-09 02:04:32 |
| 138.68.21.125 | attackbotsspam | DATE:2020-06-08 19:15:52, IP:138.68.21.125, PORT:ssh SSH brute force auth (docker-dc) |
2020-06-09 02:08:41 |
| 45.64.126.103 | attack | Jun 8 19:38:24 plex sshd[27055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.64.126.103 user=root Jun 8 19:38:25 plex sshd[27055]: Failed password for root from 45.64.126.103 port 34774 ssh2 |
2020-06-09 01:56:50 |
| 192.144.161.16 | attack | Jun 8 05:54:34 server1 sshd\[3048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.161.16 user=root Jun 8 05:54:36 server1 sshd\[3048\]: Failed password for root from 192.144.161.16 port 33966 ssh2 Jun 8 05:58:50 server1 sshd\[4628\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.161.16 user=root Jun 8 05:58:53 server1 sshd\[4628\]: Failed password for root from 192.144.161.16 port 52944 ssh2 Jun 8 06:03:06 server1 sshd\[5737\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.144.161.16 user=root ... |
2020-06-09 02:08:27 |