City: unknown
Region: unknown
Country: Thailand
Internet Service Provider: Triple T Internet PCL
Hostname: unknown
Organization: unknown
Usage Type: Fixed Line ISP
| Type | Details | Datetime |
|---|---|---|
| attack | Dec 1 12:05:11 nginx sshd[74095]: Invalid user admin from 49.49.245.155 Dec 1 12:05:11 nginx sshd[74095]: Connection closed by 49.49.245.155 port 59906 [preauth] |
2019-12-01 20:56:41 |
| IP | Type | Details | Datetime |
|---|---|---|---|
| 49.49.245.225 | attackspambots | WordPress brute force |
2020-08-25 05:37:17 |
| 49.49.245.40 | attack | Unauthorized connection attempt from IP address 49.49.245.40 on Port 445(SMB) |
2020-08-22 03:34:33 |
| 49.49.245.93 | attackspambots | Unauthorised access (May 24) SRC=49.49.245.93 LEN=52 TTL=114 ID=15200 DF TCP DPT=445 WINDOW=8192 SYN |
2020-05-25 04:29:23 |
| 49.49.245.84 | attackspam | Invalid user admin from 49.49.245.84 port 51591 |
2020-05-23 12:31:17 |
| 49.49.245.78 | attackbots | MultiHost/MultiPort Probe, Scan, Hack - |
2020-02-18 16:33:34 |
| 49.49.245.103 | attackbots | Lines containing failures of 49.49.245.103 Jan 17 13:48:06 shared05 sshd[8729]: Invalid user ubnt from 49.49.245.103 port 30995 Jan 17 13:48:07 shared05 sshd[8729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.49.245.103 Jan 17 13:48:08 shared05 sshd[8729]: Failed password for invalid user ubnt from 49.49.245.103 port 30995 ssh2 Jan 17 13:48:09 shared05 sshd[8729]: Connection closed by invalid user ubnt 49.49.245.103 port 30995 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=49.49.245.103 |
2020-01-17 22:02:11 |
| 49.49.245.71 | attackbots | Unauthorized connection attempt detected from IP address 49.49.245.71 to port 445 |
2020-01-02 20:50:45 |
| 49.49.245.132 | attackbots | 445/tcp [2019-11-06]1pkt |
2019-11-06 14:19:45 |
| 49.49.245.5 | attackbotsspam | Sat, 20 Jul 2019 21:55:27 +0000 likely compromised host or open proxy. ddos rate spidering |
2019-07-21 10:28:54 |
| 49.49.245.238 | attackbotsspam | php WP PHPmyadamin ABUSE blocked for 12h |
2019-07-02 12:41:22 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 49.49.245.155
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44774
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;49.49.245.155. IN A
;; AUTHORITY SECTION:
. 267 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019120100 1800 900 604800 86400
;; Query time: 180 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Dec 01 20:56:37 CST 2019
;; MSG SIZE rcvd: 117155.245.49.49.in-addr.arpa domain name pointer mx-ll-49.49.245-155.dynamic.3bb.co.th.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
155.245.49.49.in-addr.arpa name = mx-ll-49.49.245-155.dynamic.3bb.co.th.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 91.132.103.64 | attackbots | 2019-10-18T20:53:16.324175abusebot-8.cloudsearch.cf sshd\[6800\]: Invalid user odroid from 91.132.103.64 port 46684 |
2019-10-19 05:57:34 |
| 67.231.240.195 | attackspambots | port scan and connect, tcp 1433 (ms-sql-s) |
2019-10-19 05:51:16 |
| 35.161.13.149 | attack | #Make The Web Safe Again - BLOCKED Bad Bots Host! :: deny from AmazonAWS.com Amazon.com Amazon Bad Bot: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/68.0.3440.106 Safari/537.36 Amazon Bad Bot: Mozilla/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36 |
2019-10-19 05:37:10 |
| 139.59.41.154 | attack | Oct 19 00:30:09 pkdns2 sshd\[49558\]: Invalid user user from 139.59.41.154Oct 19 00:30:11 pkdns2 sshd\[49558\]: Failed password for invalid user user from 139.59.41.154 port 46652 ssh2Oct 19 00:34:41 pkdns2 sshd\[49705\]: Invalid user awgsahmat from 139.59.41.154Oct 19 00:34:43 pkdns2 sshd\[49705\]: Failed password for invalid user awgsahmat from 139.59.41.154 port 57488 ssh2Oct 19 00:39:20 pkdns2 sshd\[49931\]: Invalid user willie from 139.59.41.154Oct 19 00:39:23 pkdns2 sshd\[49931\]: Failed password for invalid user willie from 139.59.41.154 port 56936 ssh2 ... |
2019-10-19 05:47:17 |
| 217.219.23.162 | attackbots | firewall-block, port(s): 445/tcp |
2019-10-19 05:50:16 |
| 189.101.129.222 | attackspam | Oct 18 23:17:26 server sshd\[19592\]: Invalid user maya from 189.101.129.222 Oct 18 23:17:26 server sshd\[19592\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.101.129.222 Oct 18 23:17:28 server sshd\[19592\]: Failed password for invalid user maya from 189.101.129.222 port 48886 ssh2 Oct 18 23:34:42 server sshd\[23923\]: Invalid user gv from 189.101.129.222 Oct 18 23:34:42 server sshd\[23923\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.101.129.222 ... |
2019-10-19 05:39:41 |
| 77.42.105.196 | attack | Automatic report - Port Scan Attack |
2019-10-19 05:17:44 |
| 222.180.168.38 | attack | Oct 18 23:09:22 andromeda postfix/smtpd\[19669\]: warning: unknown\[222.180.168.38\]: SASL LOGIN authentication failed: authentication failure Oct 18 23:09:24 andromeda postfix/smtpd\[19669\]: warning: unknown\[222.180.168.38\]: SASL LOGIN authentication failed: authentication failure Oct 18 23:09:28 andromeda postfix/smtpd\[25199\]: warning: unknown\[222.180.168.38\]: SASL LOGIN authentication failed: authentication failure Oct 18 23:09:48 andromeda postfix/smtpd\[25199\]: warning: unknown\[222.180.168.38\]: SASL LOGIN authentication failed: authentication failure Oct 18 23:09:54 andromeda postfix/smtpd\[29621\]: warning: unknown\[222.180.168.38\]: SASL LOGIN authentication failed: authentication failure |
2019-10-19 05:22:41 |
| 95.52.63.40 | attackspam | /var/log/messages:Oct 18 19:33:44 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1571427224.245:32797): pid=22219 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-server cipher=aexxxxxxx28-ctr ksize=128 mac=hmac-sha2-256 pfs=diffie-hellman-group-exchange-sha256 spid=22225 suid=74 rport=42398 laddr=104.167.106.93 lport=22 exe="/usr/sbin/sshd" hostname=? addr=95.52.63.40 terminal=? res=success' /var/log/messages:Oct 18 19:33:44 sanyalnet-cloud-vps audispd: node=sanyalnet-cloud-vps.freeddns.org type=CRYPTO_SESSION msg=audhostname(1571427224.249:32798): pid=22219 uid=0 auid=4294967295 ses=4294967295 msg='op=start direction=from-client cipher=aexxxxxxx28-ctr ksize=128 mac=hmac-sha2-256 pfs=diffie-hellman-group-exchange-sha256 spid=22225 suid=74 rport=42398 laddr=104.167.106.93 lport=22 exe="/usr/sbin/sshd" hostname=? addr=95.52.63.40 terminal=? res=success' /var/log/messages:Oct 18 19:33:46 sanyalnet-........ ------------------------------- |
2019-10-19 05:24:27 |
| 185.99.212.23 | attack | Fail2Ban Ban Triggered |
2019-10-19 05:47:49 |
| 51.83.69.78 | attackspam | Oct 18 23:02:53 SilenceServices sshd[9607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.69.78 Oct 18 23:02:55 SilenceServices sshd[9607]: Failed password for invalid user march from 51.83.69.78 port 42260 ssh2 Oct 18 23:06:44 SilenceServices sshd[10631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.69.78 |
2019-10-19 05:46:35 |
| 104.206.128.38 | attackspambots | Portscan or hack attempt detected by psad/fwsnort |
2019-10-19 05:53:41 |
| 106.75.55.123 | attackbotsspam | $f2bV_matches |
2019-10-19 05:56:19 |
| 138.68.92.121 | attackspam | Oct 19 00:34:34 server sshd\[31620\]: Invalid user ld from 138.68.92.121 port 49302 Oct 19 00:34:34 server sshd\[31620\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.92.121 Oct 19 00:34:37 server sshd\[31620\]: Failed password for invalid user ld from 138.68.92.121 port 49302 ssh2 Oct 19 00:41:49 server sshd\[18551\]: User root from 138.68.92.121 not allowed because listed in DenyUsers Oct 19 00:41:49 server sshd\[18551\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.92.121 user=root |
2019-10-19 05:45:59 |
| 177.24.15.137 | attackspambots | Oct 18 21:36:42 iago sshd[31021]: Address 177.24.15.137 maps to ip-177-24-15-137.user.vivozap.com.br, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Oct 18 21:36:42 iago sshd[31021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.24.15.137 user=r.r Oct 18 21:36:45 iago sshd[31021]: Failed password for r.r from 177.24.15.137 port 63554 ssh2 Oct 18 21:36:45 iago sshd[31022]: Received disconnect from 177.24.15.137: 11: Bye Bye ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=177.24.15.137 |
2019-10-19 05:29:40 |