43.254.16.242 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Taiwan, Province of China

Internet Service Provider: Yuan-Jhen Info. Co. Ltd

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	X-DKIM-Failure: bodyhash_mismatch Received: from mg1.eee.tw ([43.254.16.242]) by mx68.antispamcloud.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1iQ11L-0000rl-9S for customerservice@canaan.com.sg; Thu, 31 Oct 2019 04:21:12 +0100 Received: from re34.cx901.com (re34.cx901.com [43.254.17.20]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mg1.eee.tw (Postfix) with ESMTPS id 56480E0114D; Thu, 31 Oct 2019 11:20:13 +0800 (CST) DKIM-Filter: OpenDKIM Filter v2.11.0 mg1.eee.tw 56480E0114D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mg1.eee.tw; s=default; t=1572492013; bh=eQhYLeE/BrOAVpKx7os/7aoVq8sbBvlkAoPjHjl9YKs=; h=Date:From:To:Subject:In-Reply-To:References:From; b=cKBuv9EjYyDuCX2b1Xt/se0QDx9RplRSVESR+/Uv6/Ob/Tw5gdS5BlU/tpUZOEK1s 5QLLKYdPzM9o2iGzTiKfANYxOTCbfV+zpu+3rW1iB1/OA+7Jhy/HMRTxzYctk2Wgfo rYm2lxpuGABTxcOMSdkQHvSL3UQM1ZbxBtXzPfsg=	2019-10-31 17:24:34

Type

Details

Datetime

attackspam

X-DKIM-Failure: bodyhash_mismatch
Received: from mg1.eee.tw ([43.254.16.242])
	by mx68.antispamcloud.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.89)
	(envelope-from )
	id 1iQ11L-0000rl-9S
	for customerservice@canaan.com.sg; Thu, 31 Oct 2019 04:21:12 +0100
Received: from re34.cx901.com (re34.cx901.com [43.254.17.20])
	(using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mg1.eee.tw (Postfix) with ESMTPS id 56480E0114D;
	Thu, 31 Oct 2019 11:20:13 +0800 (CST)
DKIM-Filter: OpenDKIM Filter v2.11.0 mg1.eee.tw 56480E0114D
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mg1.eee.tw;
	s=default; t=1572492013;
	bh=eQhYLeE/BrOAVpKx7os/7aoVq8sbBvlkAoPjHjl9YKs=;
	h=Date:From:To:Subject:In-Reply-To:References:From;
	b=cKBuv9EjYyDuCX2b1Xt/se0QDx9RplRSVESR+/Uv6/Ob/Tw5gdS5BlU/tpUZOEK1s
	 5QLLKYdPzM9o2iGzTiKfANYxOTCbfV+zpu+3rW1iB1/OA+7Jhy/HMRTxzYctk2Wgfo
	 rYm2lxpuGABTxcOMSdkQHvSL3UQM1ZbxBtXzPfsg=

2019-10-31 17:24:34

Comments on same subnet:

IP	Type	Details	Datetime
43.254.160.30	attackbotsspam	Unauthorized connection attempt from IP address 43.254.160.30 on Port 445(SMB)	2020-07-14 21:34:55
43.254.160.30	attack	Unauthorized connection attempt from IP address 43.254.160.30 on Port 445(SMB)	2020-05-31 05:27:50
43.254.160.186	attackspambots	Honeypot attack, port: 445, PTR: 43.254.160.186.static.belltele.in.	2020-02-10 21:25:18
43.254.160.186	attack	Unauthorized connection attempt from IP address 43.254.160.186 on Port 445(SMB)	2020-02-03 21:43:17
43.254.163.156	attack	Unauthorized connection attempt from IP address 43.254.163.156 on Port 445(SMB)	2020-01-04 19:31:05
43.254.16.253	attackspambots	X-DKIM-Failure: bodyhash_mismatch Received: from mg1.eee.tw ([43.254.16.253]) by mx145.antispamcloud.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1iQ0zJ-000QIH-8l for as@silk.com.sg; Thu, 31 Oct 2019 04:19:06 +0100 Received: from re34.cx901.com (re34.cx901.com [43.254.17.20]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mg1.eee.tw (Postfix) with ESMTPS id 3BA13E010FE; Thu, 31 Oct 2019 11:18:41 +0800 (CST) DKIM-Filter: OpenDKIM Filter v2.11.0 mg1.eee.tw 3BA13E010FE DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mg1.eee.tw; s=default; t=1572491921; bh=Nb0ZTMwsuXuBamK9CzRsFxbYzgl+iGvOm/ghvaZXHcQ=; h=Date:From:To:Subject:In-Reply-To:References:From; b=I11pp27PCr4ojkzUDKb3AxhIOo089d9NZke26JyttI0OcPMz2APst88MyPLK0dWfQ PnTUCsudXSJgQ3sLdIkrC58HOyY6FCAFcAVsYI3C4llrd1Hm45+7jhSXxegiIBiJbQ clMJrycCq+3VDX8eR0KqPqajNVuRLwqiabKy8JLY=	2019-10-31 15:00:30

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 43.254.16.242
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 40713
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;43.254.16.242.			IN	A

;; AUTHORITY SECTION:
.			457	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019103100 1800 900 604800 86400

;; Query time: 63 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Oct 31 17:24:30 CST 2019
;; MSG SIZE  rcvd: 117

Host info

242.16.254.43.in-addr.arpa domain name pointer mg1.eee.tw.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
242.16.254.43.in-addr.arpa	name = mg1.eee.tw.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
51.83.2.148	attack	51.83.2.148 - - \[01/Apr/2020:04:10:11 +0200\] "POST /wp-login.php HTTP/1.1" 200 9691 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 51.83.2.148 - - \[01/Apr/2020:05:53:21 +0200\] "POST /wp-login.php HTTP/1.1" 200 9691 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" ...	2020-04-01 14:47:03
82.118.236.186	attackbotsspam	Mar 31 16:34:26 server sshd\[23521\]: Failed password for invalid user RCadmin from 82.118.236.186 port 47910 ssh2 Apr 1 09:09:47 server sshd\[9702\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.118.236.186 user=root Apr 1 09:09:49 server sshd\[9702\]: Failed password for root from 82.118.236.186 port 54396 ssh2 Apr 1 09:15:05 server sshd\[11240\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.118.236.186 user=root Apr 1 09:15:07 server sshd\[11240\]: Failed password for root from 82.118.236.186 port 35712 ssh2 ...	2020-04-01 15:09:16
178.33.229.120	attackspambots	Apr 1 02:11:57 lanister sshd[29484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.33.229.120 user=root Apr 1 02:11:58 lanister sshd[29484]: Failed password for root from 178.33.229.120 port 40340 ssh2 Apr 1 02:15:27 lanister sshd[29537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.33.229.120 user=root Apr 1 02:15:29 lanister sshd[29537]: Failed password for root from 178.33.229.120 port 45265 ssh2	2020-04-01 15:12:56
94.19.29.200	attackspambots	DATE:2020-04-01 05:53:00, IP:94.19.29.200, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)	2020-04-01 15:02:30
115.29.246.243	attackbotsspam	Invalid user xmz from 115.29.246.243 port 55770	2020-04-01 14:43:16
122.51.48.52	attack	Apr 1 06:47:54 lukav-desktop sshd\[8987\]: Invalid user ya from 122.51.48.52 Apr 1 06:47:54 lukav-desktop sshd\[8987\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.48.52 Apr 1 06:47:56 lukav-desktop sshd\[8987\]: Failed password for invalid user ya from 122.51.48.52 port 60842 ssh2 Apr 1 06:53:03 lukav-desktop sshd\[9043\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.48.52 user=root Apr 1 06:53:04 lukav-desktop sshd\[9043\]: Failed password for root from 122.51.48.52 port 32820 ssh2	2020-04-01 14:55:52
67.207.88.180	attackbots	Apr 1 07:40:33 ns382633 sshd\[1360\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.207.88.180 user=root Apr 1 07:40:35 ns382633 sshd\[1360\]: Failed password for root from 67.207.88.180 port 46460 ssh2 Apr 1 07:53:03 ns382633 sshd\[3360\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.207.88.180 user=root Apr 1 07:53:05 ns382633 sshd\[3360\]: Failed password for root from 67.207.88.180 port 55872 ssh2 Apr 1 07:56:38 ns382633 sshd\[4182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.207.88.180 user=root	2020-04-01 15:01:27
173.249.15.13	attackspambots	Apr 1 08:18:57 MainVPS sshd[32598]: Invalid user chenlin from 173.249.15.13 port 38066 Apr 1 08:18:57 MainVPS sshd[32598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.249.15.13 Apr 1 08:18:57 MainVPS sshd[32598]: Invalid user chenlin from 173.249.15.13 port 38066 Apr 1 08:18:59 MainVPS sshd[32598]: Failed password for invalid user chenlin from 173.249.15.13 port 38066 ssh2 Apr 1 08:24:14 MainVPS sshd[10732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.249.15.13 user=root Apr 1 08:24:16 MainVPS sshd[10732]: Failed password for root from 173.249.15.13 port 53598 ssh2 ...	2020-04-01 15:18:03
2.34.48.54	attack	(imapd) Failed IMAP login from 2.34.48.54 (IT/Italy/net-2-34-48-54.cust.vodafonedsl.it): 1 in the last 3600 secs	2020-04-01 15:10:04
206.214.2.12	attackbots	(eximsyntax) Exim syntax errors from 206.214.2.12 (AG/Antigua and Barbuda/206-214-2-12.candw.ag): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-04-01 08:23:05 SMTP call from [206.214.2.12] dropped: too many syntax or protocol errors (last command was "?\034?\032?\027?\031?\034?\033?\030?\032?\026?\016?\r?\v?\f? ?")	2020-04-01 14:53:01
74.119.146.41	attack	blocked after repeated ssh login attempts	2020-04-01 14:37:15
31.46.16.95	attackbotsspam	Mar 31 19:36:14 sachi sshd\[21663\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.46.16.95 user=root Mar 31 19:36:16 sachi sshd\[21663\]: Failed password for root from 31.46.16.95 port 59528 ssh2 Mar 31 19:40:35 sachi sshd\[22047\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.46.16.95 user=root Mar 31 19:40:36 sachi sshd\[22047\]: Failed password for root from 31.46.16.95 port 45470 ssh2 Mar 31 19:44:55 sachi sshd\[22425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.46.16.95 user=root	2020-04-01 15:14:33
221.228.78.56	attackspambots	Automatic report BANNED IP	2020-04-01 14:49:48
177.159.219.203	attackbots	Mar 31 19:37:20 kapalua sshd\[28075\]: Invalid user kd from 177.159.219.203 Mar 31 19:37:20 kapalua sshd\[28075\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.159.219.203 Mar 31 19:37:23 kapalua sshd\[28075\]: Failed password for invalid user kd from 177.159.219.203 port 43738 ssh2 Mar 31 19:42:37 kapalua sshd\[28476\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.159.219.203 user=root Mar 31 19:42:39 kapalua sshd\[28476\]: Failed password for root from 177.159.219.203 port 58232 ssh2	2020-04-01 15:06:47
208.97.188.13	attackspam	208.97.188.13 - - \[01/Apr/2020:07:41:39 +0200\] "POST /wp-login.php HTTP/1.0" 200 7561 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 208.97.188.13 - - \[01/Apr/2020:07:41:41 +0200\] "POST /wp-login.php HTTP/1.0" 200 7380 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 208.97.188.13 - - \[01/Apr/2020:07:41:43 +0200\] "POST /wp-login.php HTTP/1.0" 200 7384 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0"	2020-04-01 14:52:38

Recently Reported IPs

235.134.84.137	55.131.72.155	226.216.207.174	16.30.61.36
168.107.92.24	16.101.188.234	123.243.163.99	241.70.17.15
52.157.224.142	226.228.141.29	137.222.215.247	215.38.93.91
166.42.244.181	94.121.222.192	212.95.148.56	3.208.134.10
136.137.71.176	167.86.172.58	103.78.180.221	55.118.12.226