49.49.242.237 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Thailand

Internet Service Provider: Triple T Internet PCL

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbotsspam	Unauthorized connection attempt detected from IP address 49.49.242.237 to port 1022 [T]	2020-01-07 00:12:50

Comments on same subnet:

IP	Type	Details	Datetime
49.49.242.15	attackbots	"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:	2020-09-03 01:28:07
49.49.242.15	attackbotsspam	"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:	2020-09-02 16:53:58
49.49.242.109	attackspam	1586349776 - 04/08/2020 14:42:56 Host: 49.49.242.109/49.49.242.109 Port: 445 TCP Blocked	2020-04-08 21:41:06
49.49.242.130	attackbotsspam	Honeypot attack, port: 445, PTR: mx-ll-49.49.242-130.dynamic.3bb.in.th.	2020-03-26 00:27:19
49.49.242.104	attack	Lines containing failures of 49.49.242.104 Sep 4 04:41:51 server sshd[12449]: Connection from 49.49.242.104 port 53283 on 62.116.165.82 port 22 Sep 4 04:41:51 server sshd[12449]: Did not receive identification string from 49.49.242.104 port 53283 Sep 4 04:41:53 server sshd[12451]: Connection from 49.49.242.104 port 50382 on 62.116.165.82 port 22 Sep 4 04:41:54 server sshd[12451]: reveeclipse mapping checking getaddrinfo for mx-ll-49.49.242-104.dynamic.3bb.in.th [49.49.242.104] failed - POSSIBLE BREAK-IN ATTEMPT! Sep 4 04:41:54 server sshd[12451]: Invalid user noc from 49.49.242.104 port 50382 Sep 4 04:41:54 server sshd[12451]: Connection closed by 49.49.242.104 port 50382 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=49.49.242.104	2019-09-04 19:03:55

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 49.49.242.237
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55716
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;49.49.242.237.			IN	A

;; AUTHORITY SECTION:
.			166	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020010600 1800 900 604800 86400

;; Query time: 129 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Jan 07 00:12:47 CST 2020
;; MSG SIZE  rcvd: 117

Host info

237.242.49.49.in-addr.arpa domain name pointer mx-ll-49.49.242-237.dynamic.3bb.in.th.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
237.242.49.49.in-addr.arpa	name = mx-ll-49.49.242-237.dynamic.3bb.co.th.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
106.12.84.4	attackspam	Lines containing failures of 106.12.84.4 Aug 3 09:39:01 shared02 sshd[5853]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.84.4 user=r.r Aug 3 09:39:02 shared02 sshd[5853]: Failed password for r.r from 106.12.84.4 port 58078 ssh2 Aug 3 09:39:03 shared02 sshd[5853]: Received disconnect from 106.12.84.4 port 58078:11: Bye Bye [preauth] Aug 3 09:39:03 shared02 sshd[5853]: Disconnected from authenticating user r.r 106.12.84.4 port 58078 [preauth] Aug 3 09:44:04 shared02 sshd[7925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.84.4 user=r.r Aug 3 09:44:06 shared02 sshd[7925]: Failed password for r.r from 106.12.84.4 port 45668 ssh2 Aug 3 09:44:06 shared02 sshd[7925]: Received disconnect from 106.12.84.4 port 45668:11: Bye Bye [preauth] Aug 3 09:44:06 shared02 sshd[7925]: Disconnected from authenticating user r.r 106.12.84.4 port 45668 [preauth] ........ ----------------------------------------------- http	2020-08-05 19:00:22
37.59.47.61	attackbots	37.59.47.61 - - [05/Aug/2020:11:42:23 +0100] "POST /wp-login.php HTTP/1.1" 200 6981 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" 37.59.47.61 - - [05/Aug/2020:11:44:28 +0100] "POST /wp-login.php HTTP/1.1" 200 6981 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" 37.59.47.61 - - [05/Aug/2020:11:45:47 +0100] "POST /wp-login.php HTTP/1.1" 200 6981 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36" ...	2020-08-05 18:48:36
188.75.74.171	attackbotsspam	Aug 5 05:50:10 ajax sshd[9347]: Failed password for root from 188.75.74.171 port 44336 ssh2	2020-08-05 18:41:02
178.176.165.177	attackbotsspam	20/8/5@01:19:42: FAIL: Alarm-Network address from=178.176.165.177 20/8/5@01:19:42: FAIL: Alarm-Network address from=178.176.165.177 ...	2020-08-05 18:59:06
91.126.98.41	attackspambots	Aug 5 00:39:55 ws24vmsma01 sshd[239055]: Failed password for root from 91.126.98.41 port 49314 ssh2 ...	2020-08-05 18:55:53
152.136.112.251	attackbotsspam	TCP (SYN) 152.136.112.251:45101 -> port 27672, len 44	2020-08-05 18:43:10
39.100.123.55	attackbotsspam	" "	2020-08-05 19:09:25
5.190.116.11	attack	20/8/5@00:28:57: FAIL: Alarm-Network address from=5.190.116.11 ...	2020-08-05 18:44:16
46.229.173.68	attackspambots	Fail2Ban Ban Triggered	2020-08-05 19:10:00
193.176.86.170	attack	0,16-16/24 [bc05/m74] PostRequest-Spammer scoring: zurich	2020-08-05 18:39:51
111.229.132.48	attack	Aug 3 01:45:28 euve59663 sshd[27295]: pam_unix(sshd:auth): authenticat= ion failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D111= .229.132.48 user=3Dr.r Aug 3 01:45:29 euve59663 sshd[27295]: Failed password for r.r from 11= 1.229.132.48 port 35462 ssh2 Aug 3 01:45:30 euve59663 sshd[27295]: Received disconnect from 111.229= .132.48: 11: Bye Bye [preauth] Aug 3 01:48:00 euve59663 sshd[27322]: pam_unix(sshd:auth): authenticat= ion failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D111= .229.132.48 user=3Dr.r Aug 3 01:48:03 euve59663 sshd[27322]: Failed password for r.r from 11= 1.229.132.48 port 57370 ssh2 Aug 3 01:48:03 euve59663 sshd[27322]: Received disconnect from 111.229= .132.48: 11: Bye Bye [preauth] Aug 3 01:49:06 euve59663 sshd[27324]: pam_unix(sshd:auth): authenticat= ion failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D111= .229.132.48 user=3Dr.r Aug 3 01:49:09 euve59663 sshd[27324]: Failed password for r.r f........ -------------------------------	2020-08-05 19:05:01
162.243.129.245	attackbots	Unauthorized connection attempt detected from IP address 162.243.129.245 to port 8200 [T]	2020-08-05 19:15:09
212.83.132.45	attack	[2020-08-05 06:49:00] NOTICE[1248] chan_sip.c: Registration from '"1253"' failed for '212.83.132.45:9343' - Wrong password [2020-08-05 06:49:00] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-05T06:49:00.946-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1253",SessionID="0x7f27204a5448",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.83.132.45/9343",Challenge="65670887",ReceivedChallenge="65670887",ReceivedHash="b107c4f082e535103082a78dfe55e326" [2020-08-05 06:49:27] NOTICE[1248] chan_sip.c: Registration from '"1259"' failed for '212.83.132.45:9652' - Wrong password [2020-08-05 06:49:27] SECURITY[1275] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-08-05T06:49:27.325-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="1259",SessionID="0x7f27200a09d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212. ...	2020-08-05 19:07:39
183.134.199.68	attackbots	Aug 5 09:34:55 sip sshd[8730]: Failed password for root from 183.134.199.68 port 52803 ssh2 Aug 5 09:45:58 sip sshd[11862]: Failed password for root from 183.134.199.68 port 44585 ssh2	2020-08-05 18:45:04
51.83.42.66	attackspambots	Connection to SSH Honeypot - Detected by HoneypotDB	2020-08-05 18:50:18

Recently Reported IPs

39.100.79.25	39.100.42.95	39.100.33.173	39.98.244.158
39.98.229.188	39.98.229.49	39.98.219.245	39.98.205.38
39.98.182.86	39.98.166.90	39.98.139.34	22.250.240.15
39.98.68.64	154.63.189.112	39.98.62.28	205.186.135.42
193.56.28.103	65.78.197.204	72.85.56.3	39.79.126.253