41.139.17.120 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Ghana

Internet Service Provider: Teledata ICT Ltd

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: lost connection after AUTH from unknown[41.139.17.120] Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: lost connection after AUTH from unknown[41.139.17.120] Sep 23 20:58:28 mail.srvfarm.net postfix/smtps/smtpd[243899]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed:	2020-09-24 20:45:32
attack	Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: lost connection after AUTH from unknown[41.139.17.120] Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: lost connection after AUTH from unknown[41.139.17.120] Sep 23 20:58:28 mail.srvfarm.net postfix/smtps/smtpd[243899]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed:	2020-09-24 12:41:55
attackspambots	Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: lost connection after AUTH from unknown[41.139.17.120] Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: lost connection after AUTH from unknown[41.139.17.120] Sep 23 20:58:28 mail.srvfarm.net postfix/smtps/smtpd[243899]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed:	2020-09-24 04:11:34

Type

Details

Datetime

attack

Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: 
Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: lost connection after AUTH from unknown[41.139.17.120]
Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: 
Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: lost connection after AUTH from unknown[41.139.17.120]
Sep 23 20:58:28 mail.srvfarm.net postfix/smtps/smtpd[243899]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed:

2020-09-24 20:45:32

attack

Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: 
Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: lost connection after AUTH from unknown[41.139.17.120]
Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: 
Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: lost connection after AUTH from unknown[41.139.17.120]
Sep 23 20:58:28 mail.srvfarm.net postfix/smtps/smtpd[243899]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed:

2020-09-24 12:41:55

attackspambots

Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: 
Sep 23 20:54:35 mail.srvfarm.net postfix/smtpd[241499]: lost connection after AUTH from unknown[41.139.17.120]
Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed: 
Sep 23 20:57:56 mail.srvfarm.net postfix/smtps/smtpd[241517]: lost connection after AUTH from unknown[41.139.17.120]
Sep 23 20:58:28 mail.srvfarm.net postfix/smtps/smtpd[243899]: warning: unknown[41.139.17.120]: SASL PLAIN authentication failed:

2020-09-24 04:11:34

Comments on same subnet:

IP	Type	Details	Datetime
41.139.176.250	attack	Icarus honeypot on github	2020-06-29 21:15:57
41.139.173.55	attackspam	failed_logins	2020-06-03 18:42:15
41.139.171.117	attackbots	(imapd) Failed IMAP login from 41.139.171.117 (KE/Kenya/41-139-171-117.safaricombusiness.co.ke): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 29 08:22:25 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=41.139.171.117, lip=5.63.12.44, session=	2020-04-29 19:05:13
41.139.171.137	attackbots	(imapd) Failed IMAP login from 41.139.171.137 (KE/Kenya/41-139-171-137.safaricombusiness.co.ke): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Apr 26 16:30:00 ir1 dovecot[264309]: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=41.139.171.137, lip=5.63.12.44, TLS, session=<1O1HVjCk784pi6uJ>	2020-04-27 01:56:53
41.139.172.117	attackspambots	Dovecot Invalid User Login Attempt.	2020-04-17 01:07:20
41.139.171.35	attackbotsspam	MultiHost/MultiPort Probe, Scan, Hack -	2020-02-29 04:43:17
41.139.171.139	attack	Brute force attempt	2020-02-05 05:06:59
41.139.170.203	attackbotsspam	Unauthorized connection attempt from IP address 41.139.170.203 on Port 445(SMB)	2020-01-16 04:46:28
41.139.174.30	attackspambots	Sun, 21 Jul 2019 18:28:08 +0000 likely compromised host or open proxy. ddos rate spidering	2019-07-22 05:55:07

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 41.139.17.120
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 53735
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;41.139.17.120.			IN	A

;; AUTHORITY SECTION:
.			489	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020092301 1800 900 604800 86400

;; Query time: 17 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Sep 24 04:11:29 CST 2020
;; MSG SIZE  rcvd: 117

Host info

Host 120.17.139.41.in-addr.arpa not found: 2(SERVFAIL)

Nslookup info:

;; Got SERVFAIL reply from 183.60.83.19, trying next server
Server:		183.60.82.98
Address:	183.60.82.98#53

** server can't find 120.17.139.41.in-addr.arpa: SERVFAIL

Related IP info:

Related comments:

IP	Type	Details	Datetime
94.102.50.137	attackbotsspam	Multiport scan : 5 ports scanned 1046 2001 2002 2003 2004	2020-05-11 08:29:41
89.248.172.85	attack	Multiport scan : 18 ports scanned 2264 2269 3705 5609 5736 5909 6228 6606 7050 7354 9499 9513 10389 12012 12389 50039 50051 63003	2020-05-11 08:34:05
86.62.5.233	attack	ET CINS Active Threat Intelligence Poor Reputation IP group 77 - port: 2323 proto: TCP cat: Misc Attack	2020-05-11 08:37:26
103.46.12.14	attack	ET SCAN Suspicious inbound to MSSQL port 1433 - port: 1433 proto: TCP cat: Potentially Bad Traffic	2020-05-11 08:26:43
104.206.128.10	attackbots	GPL SNMP public access udp - port: 161 proto: UDP cat: Attempted Information Leak	2020-05-11 08:24:40
46.101.224.184	attack	May 11 06:47:53 lukav-desktop sshd\[11855\]: Invalid user nagyg from 46.101.224.184 May 11 06:47:53 lukav-desktop sshd\[11855\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.224.184 May 11 06:47:55 lukav-desktop sshd\[11855\]: Failed password for invalid user nagyg from 46.101.224.184 port 56556 ssh2 May 11 06:56:13 lukav-desktop sshd\[12085\]: Invalid user didi from 46.101.224.184 May 11 06:56:13 lukav-desktop sshd\[12085\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.224.184	2020-05-11 12:24:27
59.172.6.244	attackspambots	May 11 06:54:13 lukav-desktop sshd\[12046\]: Invalid user deploy from 59.172.6.244 May 11 06:54:13 lukav-desktop sshd\[12046\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.172.6.244 May 11 06:54:15 lukav-desktop sshd\[12046\]: Failed password for invalid user deploy from 59.172.6.244 port 44891 ssh2 May 11 06:56:31 lukav-desktop sshd\[12112\]: Invalid user by from 59.172.6.244 May 11 06:56:31 lukav-desktop sshd\[12112\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.172.6.244	2020-05-11 12:07:45
93.174.95.106	attack	May 11 00:25:34 debian-2gb-nbg1-2 kernel: \[11408404.030681\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=93.174.95.106 DST=195.201.40.59 LEN=44 TOS=0x10 PREC=0x00 TTL=120 ID=39047 PROTO=TCP SPT=24858 DPT=12000 WINDOW=18050 RES=0x00 SYN URGP=0	2020-05-11 08:29:57
94.102.50.144	attackspam	46402/tcp 46482/tcp 46494/tcp... [2020-04-22/05-10]384pkt,171pt.(tcp)	2020-05-11 08:29:10
122.228.208.113	botsattack	scan tcp port 6666	2020-05-11 10:06:45
217.165.22.147	attack	May 11 05:56:26 mail sshd[3252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.165.22.147 May 11 05:56:28 mail sshd[3252]: Failed password for invalid user ftp1 from 217.165.22.147 port 59336 ssh2 ...	2020-05-11 12:11:46
93.170.36.5	attack	May 11 05:56:24 [host] sshd[10453]: Invalid user m May 11 05:56:24 [host] sshd[10453]: pam_unix(sshd: May 11 05:56:26 [host] sshd[10453]: Failed passwor	2020-05-11 12:12:56
89.248.172.16	attackspambots	Fail2Ban Ban Triggered	2020-05-11 08:34:23
211.252.85.17	attack	$f2bV_matches	2020-05-11 12:25:43
140.143.145.55	attackbots	(sshd) Failed SSH login from 140.143.145.55 (CN/China/-): 5 in the last 3600 secs	2020-05-11 12:02:36

Recently Reported IPs

170.136.176.129	12.224.238.116	187.70.131.68	83.24.187.139
168.70.143.10	135.171.49.135	127.43.246.210	18.74.125.3
62.91.197.149	231.104.64.161	65.27.61.104	94.60.148.199
90.153.116.146	40.115.190.45	185.73.237.75	193.187.101.126
176.193.253.168	145.32.176.194	52.20.156.18	48.235.55.28