City: Beijing
Region: Beijing
Country: China
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 39.99.153.212
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 63699
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;39.99.153.212. IN A
;; AUTHORITY SECTION:
. 29 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025042200 1800 900 604800 86400
;; Query time: 33 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Apr 22 15:30:38 CST 2025
;; MSG SIZE rcvd: 106Host 212.153.99.39.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 212.153.99.39.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 45.252.250.201 | attack | [FriJul0500:54:05.2852492019][:error][pid4583:tid47152594962176][client45.252.250.201:58682][client45.252.250.201]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\<\|script\|\>\)"atARGS:domain.[file"/usr/local/apache.ea3/conf/modsec_rules/99_asl_jitp.conf"][line"317"][id"347147"][rev"1"][msg"Atomicorp.comWAFRules:Wordpressadmin-ajaxXSSattack"][data"admin-ajax.php"][severity"CRITICAL"][hostname"cser.ch"][uri"/wp-admin/admin-ajax.php"][unique_id"XR6DjRmG7onBEAjys9uJmQAAAMk"][FriJul0500:58:24.9255002019][:error][pid29575:tid47152590759680][client45.252.250.201:42480][client45.252.250.201]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"miglaa\?_"atARGS:action.[file"/usr/local/apache.ea3/conf/modsec_rules/99_asl_jitp.conf"][line"60"][id"334072"][rev"5"][msg"Atomicorp.comWAFRules:CVE-2019-6703Attackblocked"][severity"ALERT"][hostname"cser.ch"][uri"/wp-admin/admin-ajax.php"][unique_id"XR6EkOJOLgY93J5KRwqZPAAAAUc"] |
2019-07-05 07:42:20 |
| 199.7.206.186 | attackbots | HARP phishing From: Lower.My.Bills [mailto:farfetch@email.vnfu651rt.com] Unsolicited bulk spam - li2027-59.members.linode.com, Linode - 172.105.71.59 Spam link u11375183.ct.sendgrid.net = 167.89.123.16, SendGrid Permitted sender domain sendgrid.net = 167.89.123.54, SendGrid Header: Message ID omp.email.farfetch.com = 199.7.206.186, Responsys Inc Header: Unsubscribe email.farfetch.com = 162.223.232.96, Responsys Inc Spam link http://46.101.208.238 = DigitalOcean |
2019-07-05 07:37:31 |
| 180.76.15.156 | attackbots | Bad bot/spoofed identity |
2019-07-05 07:53:53 |
| 118.163.219.49 | attackspam | @LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-07-03 15:26:46,895 INFO [shellcode_manager] (118.163.219.49) no match, writing hexdump (47cc91e8cc91cbbab2a922b832f82195 :2469067) - MS17010 (EternalBlue) |
2019-07-05 07:44:07 |
| 104.152.52.27 | attackbots | Web application attack detected by fail2ban |
2019-07-05 08:04:06 |
| 140.143.4.188 | attack | Automated report - ssh fail2ban: Jul 5 00:29:16 wrong password, user=warehouse123, port=53934, ssh2 Jul 5 00:59:24 authentication failure Jul 5 00:59:26 wrong password, user=password, port=46146, ssh2 |
2019-07-05 07:15:06 |
| 172.111.243.132 | attack | Jul 5 00:58:11 mail postfix/smtpd[29574]: lost connection after STARTTLS from unknown[172.111.243.132] ... |
2019-07-05 07:47:47 |
| 81.83.5.246 | attackspambots | Jul 4 18:57:11 aragorn sshd\[16642\]: Invalid user admin from 81.83.5.246\ Jul 4 18:57:11 aragorn sshd\[16644\]: Invalid user admin from 81.83.5.246\ Jul 4 18:57:11 aragorn sshd\[16643\]: Invalid user admin from 81.83.5.246\ Jul 4 18:58:37 aragorn sshd\[16655\]: Invalid user ubuntu from 81.83.5.246\ Jul 4 18:58:37 aragorn sshd\[16654\]: Invalid user ubuntu from 81.83.5.246\ Jul 4 18:58:37 aragorn sshd\[16653\]: Invalid user ubuntu from 81.83.5.246\ |
2019-07-05 07:36:09 |
| 138.68.55.201 | attack | masters-of-media.de 138.68.55.201 \[05/Jul/2019:00:59:23 +0200\] "POST /wp-login.php HTTP/1.1" 200 5856 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" masters-of-media.de 138.68.55.201 \[05/Jul/2019:00:59:25 +0200\] "POST /wp-login.php HTTP/1.1" 200 5820 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" |
2019-07-05 07:15:33 |
| 5.202.94.22 | attack | Mail sent to address hacked/leaked from Last.fm |
2019-07-05 07:17:15 |
| 178.62.47.177 | attackbots | Jul 5 01:23:17 dedicated sshd[20137]: Invalid user mwang2 from 178.62.47.177 port 42238 |
2019-07-05 07:46:52 |
| 209.97.187.108 | attackspambots | Jul 4 22:58:32 thevastnessof sshd[11606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.97.187.108 ... |
2019-07-05 07:39:51 |
| 153.36.236.151 | attackbots | Jul501:24:40server2sshd[10020]:refusedconnectfrom153.36.236.151\(153.36.236.151\)Jul501:24:41server2sshd[10033]:refusedconnectfrom153.36.236.151\(153.36.236.151\)Jul501:24:42server2sshd[10059]:refusedconnectfrom153.36.236.151\(153.36.236.151\)Jul501:24:45server2sshd[10089]:refusedconnectfrom153.36.236.151\(153.36.236.151\)Jul501:24:57server2sshd[10264]:refusedconnectfrom153.36.236.151\(153.36.236.151\) |
2019-07-05 07:33:28 |
| 106.12.73.236 | attackspambots | SSH Brute-Force attacks |
2019-07-05 07:51:49 |
| 153.36.236.234 | attack | Jul 5 01:30:57 mail sshd\[13273\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.36.236.234 user=root Jul 5 01:30:59 mail sshd\[13273\]: Failed password for root from 153.36.236.234 port 47867 ssh2 Jul 5 01:31:01 mail sshd\[13273\]: Failed password for root from 153.36.236.234 port 47867 ssh2 Jul 5 01:31:03 mail sshd\[13273\]: Failed password for root from 153.36.236.234 port 47867 ssh2 Jul 5 01:31:07 mail sshd\[13310\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=153.36.236.234 user=root |
2019-07-05 07:34:00 |