City: unknown
Region: unknown
Country: United States of America (the)
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 21.85.32.39
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 26883
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;21.85.32.39. IN A
;; AUTHORITY SECTION:
. 30 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025021400 1800 900 604800 86400
;; Query time: 12 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Feb 14 22:32:25 CST 2025
;; MSG SIZE rcvd: 104Host 39.32.85.21.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 39.32.85.21.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 35.222.207.7 | attackspam | Sep 21 12:09:40 buvik sshd[28916]: Failed password for invalid user oracle from 35.222.207.7 port 59293 ssh2 Sep 21 12:16:28 buvik sshd[29889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.222.207.7 user=root Sep 21 12:16:31 buvik sshd[29889]: Failed password for root from 35.222.207.7 port 37570 ssh2 ... |
2020-09-21 18:56:03 |
| 51.38.188.20 | attackbotsspam | Triggered by Fail2Ban at Ares web server |
2020-09-21 19:02:17 |
| 49.88.112.114 | attackspam | Sep 21 10:23:29 staging sshd[25951]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.114 user=root Sep 21 10:23:31 staging sshd[25951]: Failed password for root from 49.88.112.114 port 54741 ssh2 Sep 21 10:26:00 staging sshd[25984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.114 user=root Sep 21 10:26:02 staging sshd[25984]: Failed password for root from 49.88.112.114 port 48079 ssh2 ... |
2020-09-21 18:46:19 |
| 195.54.160.183 | attackspambots | Sep 21 10:43:15 marvibiene sshd[6202]: Invalid user admin from 195.54.160.183 port 34845 Sep 21 10:43:15 marvibiene sshd[6202]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.54.160.183 Sep 21 10:43:15 marvibiene sshd[6202]: Invalid user admin from 195.54.160.183 port 34845 Sep 21 10:43:18 marvibiene sshd[6202]: Failed password for invalid user admin from 195.54.160.183 port 34845 ssh2 Sep 21 10:43:18 marvibiene sshd[6205]: Invalid user admin from 195.54.160.183 port 43466 |
2020-09-21 18:45:34 |
| 196.214.163.19 | attack | 信息 Transfer-Encoding: chunked HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate Server: nginx Connection: keep-alive Set-Cookie: PHPSESSID=ed3p7b7734v3jqeh4rmq6j16lc; path=/ Vary: Accept-Encoding Pragma: no-cache Expires: Thu, 19 Nov 1981 08:52:00 GMT Date: Mon, 21 Sep 2020 10:07:20 GMT Content-Type: text/html; charset=utf-8 |
2020-09-21 18:30:22 |
| 54.37.71.204 | attackbots | 2020-09-21T11:01:16.869678amanda2.illicoweb.com sshd\[6624\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=204.ip-54-37-71.eu user=root 2020-09-21T11:01:19.049588amanda2.illicoweb.com sshd\[6624\]: Failed password for root from 54.37.71.204 port 45892 ssh2 2020-09-21T11:06:01.390250amanda2.illicoweb.com sshd\[6807\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=204.ip-54-37-71.eu user=root 2020-09-21T11:06:03.359551amanda2.illicoweb.com sshd\[6807\]: Failed password for root from 54.37.71.204 port 57192 ssh2 2020-09-21T11:10:25.932493amanda2.illicoweb.com sshd\[6932\]: Invalid user minecraft from 54.37.71.204 port 40258 2020-09-21T11:10:25.937970amanda2.illicoweb.com sshd\[6932\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=204.ip-54-37-71.eu ... |
2020-09-21 18:35:29 |
| 112.254.55.131 | attack | [Sun Sep 20 23:58:02.153212 2020] [:error] [pid 23423:tid 140118059661056] [client 112.254.55.131:39665] [client 112.254.55.131] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/coreruleset-3.3.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1041"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/setup.cgi"] [unique_id "AAAAAKyLvmllluV-tW9b4QAAAC0"]
... |
2020-09-21 18:45:11 |
| 104.223.29.193 | attackbots | Registration form abuse |
2020-09-21 19:07:25 |
| 180.250.18.20 | attackspambots | Port scan followed by SSH. |
2020-09-21 18:34:59 |
| 69.51.16.248 | attack | (sshd) Failed SSH login from 69.51.16.248 (US/United States/-): 5 in the last 3600 secs |
2020-09-21 18:38:53 |
| 52.187.65.64 | attackspambots | 52.187.65.64 - - [21/Sep/2020:11:44:29 +0100] "POST /wp-login.php HTTP/1.1" 200 2470 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 52.187.65.64 - - [21/Sep/2020:11:44:31 +0100] "POST /wp-login.php HTTP/1.1" 200 2451 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 52.187.65.64 - - [21/Sep/2020:11:44:32 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ... |
2020-09-21 18:53:57 |
| 203.130.242.68 | attack | Time: Mon Sep 21 12:43:22 2020 +0200 IP: 203.130.242.68 (ID/Indonesia/ts14.techscape.co.id) Failures: 5 (sshd) Interval: 3600 seconds Blocked: Permanent Block [LF_SSHD] Log entries: Sep 21 12:32:16 3-1 sshd[36694]: Invalid user deployment from 203.130.242.68 port 56018 Sep 21 12:32:18 3-1 sshd[36694]: Failed password for invalid user deployment from 203.130.242.68 port 56018 ssh2 Sep 21 12:38:55 3-1 sshd[36990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.130.242.68 user=root Sep 21 12:38:57 3-1 sshd[36990]: Failed password for root from 203.130.242.68 port 44440 ssh2 Sep 21 12:43:19 3-1 sshd[37169]: Invalid user vncuser from 203.130.242.68 port 49859 |
2020-09-21 18:49:15 |
| 74.120.14.31 | attackbotsspam |
|
2020-09-21 18:40:39 |
| 170.150.241.202 | attackbotsspam | Sep 20 18:58:18 mail sshd[18396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.150.241.202 Sep 20 18:58:20 mail sshd[18396]: Failed password for invalid user 666666 from 170.150.241.202 port 34997 ssh2 ... |
2020-09-21 18:30:13 |
| 101.231.146.34 | attackspam | Sep 21 12:45:55 buvik sshd[1534]: Failed password for invalid user ftpuser from 101.231.146.34 port 35604 ssh2 Sep 21 12:51:37 buvik sshd[2305]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.146.34 user=root Sep 21 12:51:38 buvik sshd[2305]: Failed password for root from 101.231.146.34 port 39284 ssh2 ... |
2020-09-21 19:09:52 |