City: Amsterdam
Region: North Holland
Country: Netherlands
Internet Service Provider: Bunea Telecom SRL
Hostname: unknown
Organization: unknown
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attack | port scan and connect, tcp 22 (ssh) |
2020-05-20 00:22:51 |
| attackbots | May 6 19:15:41 debian-2gb-nbg1-2 kernel: \[11044230.327245\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=45.148.10.179 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40384 DPT=10000 WINDOW=65535 RES=0x00 SYN URGP=0 |
2020-05-07 03:38:23 |
| attackspambots | [Fri Feb 14 01:22:21.938674 2020] [:error] [pid 8535:tid 140443720324864] [client 45.148.10.179:60000] [client 45.148.10.179] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "XkWT3V4hW2oDbgQMnvebogAAAYM"]
... |
2020-02-14 03:09:31 |
| attack | [Mon Feb 10 03:00:16.646334 2020] [:error] [pid 4063:tid 140264400824064] [client 45.148.10.179:60000] [client 45.148.10.179] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "XkBk0PAiq7wP4HzQutKyfgAAAbs"]
... |
2020-02-10 04:58:20 |
| IP | Type | Details | Datetime |
|---|---|---|---|
| 45.148.10.241 | attack | DDoS Inbound |
2023-11-15 18:54:04 |
| 45.148.10.28 | attackspam | Oct 13 20:18:40 sshgateway sshd\[2360\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.28 user=root Oct 13 20:18:43 sshgateway sshd\[2360\]: Failed password for root from 45.148.10.28 port 40178 ssh2 Oct 13 20:19:07 sshgateway sshd\[2364\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.28 user=root |
2020-10-14 02:28:44 |
| 45.148.10.15 | attackspambots | Bruteforce detected by fail2ban |
2020-10-13 21:25:53 |
| 45.148.10.186 | attackspam | Unable to negotiate with 45.148.10.186 port 47964: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] |
2020-10-13 21:24:21 |
| 45.148.10.28 | attackbotsspam | SSH Server Abuse (45.148.10.28 as |
2020-10-13 17:43:00 |
| 45.148.10.15 | attackbotsspam | Oct 13 05:18:03 server2 sshd\[31409\]: Invalid user user from 45.148.10.15 Oct 13 05:18:48 server2 sshd\[31424\]: Invalid user server from 45.148.10.15 Oct 13 05:19:33 server2 sshd\[31465\]: Invalid user steam from 45.148.10.15 Oct 13 05:20:17 server2 sshd\[31678\]: Invalid user vmware from 45.148.10.15 Oct 13 05:21:00 server2 sshd\[31685\]: Invalid user microsoft from 45.148.10.15 Oct 13 05:21:44 server2 sshd\[31730\]: Invalid user cloud from 45.148.10.15 |
2020-10-13 12:52:46 |
| 45.148.10.186 | attackspam | Oct 13 05:33:03 ns308116 sshd[11001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.186 user=root Oct 13 05:33:05 ns308116 sshd[11001]: Failed password for root from 45.148.10.186 port 41866 ssh2 Oct 13 05:33:38 ns308116 sshd[11016]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.186 user=root Oct 13 05:33:40 ns308116 sshd[11016]: Failed password for root from 45.148.10.186 port 39380 ssh2 Oct 13 05:34:15 ns308116 sshd[11027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.186 user=root ... |
2020-10-13 12:50:57 |
| 45.148.10.15 | attack | Oct 12 23:36:06 srv-ubuntu-dev3 sshd[31523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.15 Oct 12 23:36:06 srv-ubuntu-dev3 sshd[31523]: Invalid user user from 45.148.10.15 Oct 12 23:36:08 srv-ubuntu-dev3 sshd[31523]: Failed password for invalid user user from 45.148.10.15 port 40704 ssh2 Oct 12 23:36:38 srv-ubuntu-dev3 sshd[31590]: Invalid user 123Diego from 45.148.10.15 Oct 12 23:36:38 srv-ubuntu-dev3 sshd[31590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.15 Oct 12 23:36:38 srv-ubuntu-dev3 sshd[31590]: Invalid user 123Diego from 45.148.10.15 Oct 12 23:36:40 srv-ubuntu-dev3 sshd[31590]: Failed password for invalid user 123Diego from 45.148.10.15 port 59760 ssh2 Oct 12 23:37:17 srv-ubuntu-dev3 sshd[31656]: Invalid user Alphanetworks from 45.148.10.15 Oct 12 23:37:17 srv-ubuntu-dev3 sshd[31656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rh ... |
2020-10-13 05:40:39 |
| 45.148.10.186 | attack | Fail2Ban |
2020-10-13 05:39:02 |
| 45.148.10.15 | attackbotsspam | Fail2Ban |
2020-10-12 05:52:51 |
| 45.148.10.65 | attackbots | Invalid user ubuntu from 45.148.10.65 port 43138 |
2020-10-12 05:36:52 |
| 45.148.10.15 | attack | Brute force attempt |
2020-10-11 21:59:38 |
| 45.148.10.65 | attackspam | Oct 01 10:49:15 host sshd[12378]: Invalid user ubuntu from 45.148.10.65 port 41060 |
2020-10-11 21:43:21 |
| 45.148.10.28 | attack | Fail2Ban automatic report: SSH brute-force: |
2020-10-11 21:05:28 |
| 45.148.10.15 | attackspam | Cowrie Honeypot: 10 unauthorised SSH/Telnet login attempts between 2020-10-11T05:41:40Z and 2020-10-11T05:47:54Z |
2020-10-11 13:57:38 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 45.148.10.179
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43804
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;45.148.10.179. IN A
;; AUTHORITY SECTION:
. 547 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2020020901 1800 900 604800 86400
;; Query time: 269 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Feb 10 04:58:16 CST 2020
;; MSG SIZE rcvd: 117Host 179.10.148.45.in-addr.arpa not found: 2(SERVFAIL)
;; Got SERVFAIL reply from 183.60.83.19, trying next server
Server: 183.60.82.98
Address: 183.60.82.98#53
** server can't find 179.10.148.45.in-addr.arpa: SERVFAIL| IP | Type | Details | Datetime |
|---|---|---|---|
| 111.2.29.244 | attack | Automatic report - Web App Attack |
2019-07-13 14:58:24 |
| 68.183.97.220 | attackbotsspam | 2019-07-13T08:03:49.9060971240 sshd\[21055\]: Invalid user network from 68.183.97.220 port 38900 2019-07-13T08:03:49.9119501240 sshd\[21055\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.97.220 2019-07-13T08:03:51.2803391240 sshd\[21055\]: Failed password for invalid user network from 68.183.97.220 port 38900 ssh2 ... |
2019-07-13 15:06:20 |
| 159.65.150.212 | attack | Jul 13 09:19:29 hosting sshd[22114]: Invalid user fake from 159.65.150.212 port 58586 Jul 13 09:19:29 hosting sshd[22114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.150.212 Jul 13 09:19:29 hosting sshd[22114]: Invalid user fake from 159.65.150.212 port 58586 Jul 13 09:19:31 hosting sshd[22114]: Failed password for invalid user fake from 159.65.150.212 port 58586 ssh2 Jul 13 09:19:33 hosting sshd[22116]: Invalid user ubnt from 159.65.150.212 port 37216 ... |
2019-07-13 15:25:49 |
| 223.205.186.100 | attackbotsspam | Invalid user admin from 223.205.186.100 port 49835 |
2019-07-13 15:14:32 |
| 104.248.255.118 | attack | Jul 13 06:57:32 sshgateway sshd\[20859\]: Invalid user karen from 104.248.255.118 Jul 13 06:57:32 sshgateway sshd\[20859\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.255.118 Jul 13 06:57:34 sshgateway sshd\[20859\]: Failed password for invalid user karen from 104.248.255.118 port 54246 ssh2 |
2019-07-13 15:00:05 |
| 107.172.3.124 | attackbots | Jul 13 08:44:08 bouncer sshd\[12808\]: Invalid user mary from 107.172.3.124 port 34093 Jul 13 08:44:08 bouncer sshd\[12808\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.3.124 Jul 13 08:44:10 bouncer sshd\[12808\]: Failed password for invalid user mary from 107.172.3.124 port 34093 ssh2 ... |
2019-07-13 14:59:21 |
| 78.97.92.249 | attack | Invalid user jboss from 78.97.92.249 port 49538 |
2019-07-13 15:42:27 |
| 64.53.199.198 | attack | Invalid user admin from 64.53.199.198 port 53686 |
2019-07-13 15:43:50 |
| 220.163.107.130 | attackspambots | Invalid user build from 220.163.107.130 port 9702 |
2019-07-13 15:15:53 |
| 114.223.51.133 | attackbotsspam | Invalid user usuario from 114.223.51.133 port 33140 |
2019-07-13 15:33:20 |
| 175.203.95.49 | attackspambots | Jul 13 09:10:58 vps691689 sshd[28867]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.203.95.49 Jul 13 09:11:01 vps691689 sshd[28867]: Failed password for invalid user webmaster from 175.203.95.49 port 43580 ssh2 ... |
2019-07-13 15:23:47 |
| 204.48.31.143 | attackbots | Invalid user guest from 204.48.31.143 port 50182 |
2019-07-13 15:53:14 |
| 51.83.42.244 | attackbots | Invalid user xg from 51.83.42.244 port 53598 |
2019-07-13 15:08:41 |
| 41.65.64.36 | attackspambots | Invalid user service from 41.65.64.36 port 57590 |
2019-07-13 15:12:03 |
| 201.91.132.170 | attack | Invalid user e from 201.91.132.170 port 33871 |
2019-07-13 15:53:42 |