49.149.161.221

Basic Info

City: unknown

Region: unknown

Country: Philippines

Internet Service Provider: DSL

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Attempts to probe for or exploit a Drupal 7.67 site on url: /wp-login.php. Reported by the module https://www.drupal.org/project/abuseipdb.	2019-08-08 21:33:28

Comments on same subnet:

No discussion about this subnet yet..

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 49.149.161.221
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 34786
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;49.149.161.221.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019080800 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Thu Aug 08 21:33:20 CST 2019
;; MSG SIZE  rcvd: 118

Host info

221.161.149.49.in-addr.arpa domain name pointer dsl.49.149.161.221.pldt.net.

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
221.161.149.49.in-addr.arpa	name = dsl.49.149.161.221.pldt.net.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
23.95.220.201	attack	Automatic report - Banned IP Access	2020-09-09 00:11:14
210.71.232.236	attack	SSH login attempts.	2020-09-09 00:46:16
163.172.42.123	attackspam	163.172.42.123 - - [08/Sep/2020:07:22:48 +0200] "POST /wp-login.php HTTP/1.0" 200 4793 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-09 00:56:03
51.91.159.46	attackbotsspam	Fail2Ban Ban Triggered (2)	2020-09-09 00:49:01
37.239.102.42	attackbots	[Mon Sep 07 11:47:31.235746 2020] [php7:error] [pid 72470] [client 37.239.102.42:60794] script /Library/Server/Web/Data/Sites/worldawakeinc.org/wp-login.php not found or unable to stat	2020-09-09 00:10:36
185.220.101.213	attack	Sep 8 15:37:50 shivevps sshd[21950]: Failed password for root from 185.220.101.213 port 14188 ssh2 Sep 8 15:38:02 shivevps sshd[21950]: Failed password for root from 185.220.101.213 port 14188 ssh2 Sep 8 15:38:02 shivevps sshd[21950]: error: maximum authentication attempts exceeded for root from 185.220.101.213 port 14188 ssh2 [preauth] ...	2020-09-09 00:23:41
212.83.163.170	attack	[2020-09-08 12:17:16] NOTICE[1194] chan_sip.c: Registration from '"1108"' failed for '212.83.163.170:7177' - Wrong password [2020-09-08 12:17:16] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-08T12:17:16.618-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1108",SessionID="0x7f2ddc945c58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.163.170/7177",Challenge="27ca29d7",ReceivedChallenge="27ca29d7",ReceivedHash="dd2475d7d52369d174cf3ab5a2784a5d" [2020-09-08 12:17:27] NOTICE[1194] chan_sip.c: Registration from '"1104"' failed for '212.83.163.170:6957' - Wrong password [2020-09-08 12:17:27] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-08T12:17:27.698-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1104",SessionID="0x7f2ddc181df8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/2 ...	2020-09-09 00:35:40
112.120.156.177	attack	Scanned 3 times in the last 24 hours on port 22	2020-09-09 00:18:47
106.13.190.84	attackspambots	Sep 8 14:54:03 lnxweb62 sshd[20728]: Failed password for root from 106.13.190.84 port 54604 ssh2 Sep 8 14:54:03 lnxweb62 sshd[20728]: Failed password for root from 106.13.190.84 port 54604 ssh2	2020-09-09 01:00:07
196.218.58.203	attackbotsspam	Icarus honeypot on github	2020-09-09 00:42:35
119.45.151.125	attack	Aug 4 15:52:12 server sshd[5691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.151.125 user=root Aug 4 15:52:14 server sshd[5691]: Failed password for invalid user root from 119.45.151.125 port 39852 ssh2 Aug 4 16:14:41 server sshd[7767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.151.125 user=root Aug 4 16:14:43 server sshd[7767]: Failed password for invalid user root from 119.45.151.125 port 44496 ssh2	2020-09-09 00:28:14
162.247.74.200	attackbots	Sep 8 18:07:26 server sshd[30228]: Failed password for root from 162.247.74.200 port 58090 ssh2 Sep 8 18:07:30 server sshd[30228]: Failed password for root from 162.247.74.200 port 58090 ssh2 Sep 8 18:07:34 server sshd[30228]: Failed password for root from 162.247.74.200 port 58090 ssh2	2020-09-09 00:22:17
175.181.104.69	attackbotsspam	Sep 7 18:50:52 ks10 sshd[894800]: Failed password for root from 175.181.104.69 port 57794 ssh2 ...	2020-09-09 00:15:31
222.186.175.212	attack	Sep 8 17:31:16 host sshd\[25032\]: Unable to negotiate with 222.186.175.212 port 11986: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 \[preauth\]	2020-09-09 00:09:12
94.54.17.183	attack	Honeypot attack, port: 445, PTR: PTR record not found	2020-09-09 00:41:21

Recently Reported IPs

40.84.36.250	78.174.186.27	35.206.6.20	206.60.255.209
88.74.203.237	58.221.86.8	12.228.89.190	211.23.167.241
212.156.220.44	177.69.245.140	187.109.52.18	2001:8d8:5ff:5f:82:165:86:235
5.188.86.220	177.91.117.134	14.232.1.36	219.67.26.112
121.131.52.49	193.31.118.205	177.184.240.201	118.24.167.186