City: unknown
Region: unknown
Country: Germany
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 53.5.138.29
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7911
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;53.5.138.29. IN A
;; AUTHORITY SECTION:
. 30 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025012200 1800 900 604800 86400
;; Query time: 14 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Jan 22 18:24:23 CST 2025
;; MSG SIZE rcvd: 104Host 29.138.5.53.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 29.138.5.53.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 140.206.242.83 | attackbotsspam | SSH brute-force attempt |
2020-10-09 18:18:51 |
| 101.0.123.170 | attack | [ThuOct0822:37:02.7039822020][:error][pid27471:tid47492349708032][client101.0.123.170:41750][client101.0.123.170]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\$mozilla\^\|mozilla/[45]\\\\\\\\.[1-9]\|\^mozilla/4\\\\\\\\.0\$\)"atREQUEST_HEADERS:User-Agent.[file"/usr/local/apache.ea3/conf/modsec_rules/20_asl_useragents.conf"][line"426"][id"330131"][rev"3"][msg"Atomicorp.comWAFRules:MaliciousBotBlocked\(FakeMozillaUserAgentStringDetected\)"][severity"CRITICAL"][hostname"wp.aaaa6877.org"][uri"/index.php"][unique_id"X394btszmTg2DNm15aJOGgAAAAs"]\,referer:wp.aaaa6877.org[ThuOct0822:43:29.8995792020][:error][pid27673:tid47492356011776][client101.0.123.170:56004][client101.0.123.170]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\$mozilla\^\|mozilla/[45]\\\\\\\\.[1-9]\|\^mozilla/4\\\\\\\\.0\$\)"atREQUEST_HEADERS:User-Agent.[file"/usr/local/apache.ea3/conf/modsec_rules/20_asl_useragents.conf"][line"426"][id"330131"][rev"3"][msg"Atomicorp.comWAFRules:Mal |
2020-10-09 18:10:54 |
| 37.147.29.86 | attack | Brute forcing email accounts |
2020-10-09 18:23:44 |
| 45.142.120.59 | attackspam | 2020-10-09 03:32:55 dovecot_login authenticator failed for \(localhost\) \[45.142.120.59\]: 535 Incorrect authentication data 2020-10-09 03:32:58 dovecot_login authenticator failed for \(localhost\) \[45.142.120.59\]: 535 Incorrect authentication data 2020-10-09 03:33:05 dovecot_login authenticator failed for \(localhost\) \[45.142.120.59\]: 535 Incorrect authentication data 2020-10-09 03:33:05 dovecot_login authenticator failed for \(localhost\) \[45.142.120.59\]: 535 Incorrect authentication data 2020-10-09 03:37:41 dovecot_login authenticator failed for \(localhost\) \[45.142.120.59\]: 535 Incorrect authentication data \(set_id=ags@no-server.de\) ... |
2020-10-09 17:50:14 |
| 219.92.50.41 | attackspam | Lines containing failures of 219.92.50.41 Oct 8 16:57:52 nemesis sshd[30964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.92.50.41 user=r.r Oct 8 16:57:54 nemesis sshd[30964]: Failed password for r.r from 219.92.50.41 port 28538 ssh2 Oct 8 16:57:56 nemesis sshd[30964]: Received disconnect from 219.92.50.41 port 28538:11: Bye Bye [preauth] Oct 8 16:57:56 nemesis sshd[30964]: Disconnected from authenticating user r.r 219.92.50.41 port 28538 [preauth] Oct 8 17:04:38 nemesis sshd[32651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.92.50.41 user=r.r Oct 8 17:04:40 nemesis sshd[32651]: Failed password for r.r from 219.92.50.41 port 44348 ssh2 Oct 8 17:04:41 nemesis sshd[32651]: Received disconnect from 219.92.50.41 port 44348:11: Bye Bye [preauth] Oct 8 17:04:41 nemesis sshd[32651]: Disconnected from authenticating user r.r 219.92.50.41 port 44348 [preauth] ........ ------------------------------------------- |
2020-10-09 18:11:11 |
| 179.218.210.117 | attackspam | Oct 8 22:13:35 s1 sshd\[21523\]: User root from 179.218.210.117 not allowed because not listed in AllowUsers Oct 8 22:13:35 s1 sshd\[21523\]: Failed password for invalid user root from 179.218.210.117 port 49346 ssh2 Oct 8 22:26:11 s1 sshd\[24781\]: Invalid user test2 from 179.218.210.117 port 52450 Oct 8 22:26:11 s1 sshd\[24781\]: Failed password for invalid user test2 from 179.218.210.117 port 52450 ssh2 Oct 8 22:43:33 s1 sshd\[28510\]: User root from 179.218.210.117 not allowed because not listed in AllowUsers Oct 8 22:43:33 s1 sshd\[28510\]: Failed password for invalid user root from 179.218.210.117 port 42964 ssh2 ... |
2020-10-09 18:06:54 |
| 112.85.42.94 | attackbots | Unauthorized access to SSH at 9/Oct/2020:06:49:33 +0000. Received: (SSH-2.0-PUTTY) |
2020-10-09 18:18:00 |
| 103.46.243.178 | attackspambots | [portscan] tcp/23 [TELNET] *(RWIN=33742)(10090804) |
2020-10-09 17:46:57 |
| 162.158.89.45 | attack | srv02 DDoS Malware Target(80:http) .. |
2020-10-09 18:10:27 |
| 72.167.190.203 | attackbots | 72.167.190.203 - - \[09/Oct/2020:00:03:55 +0300\] "POST /WORDPRESS/xmlrpc.php HTTP/1.1" 404 564 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/60.0.3112.113 Safari/537.36" "-" 72.167.190.203 - - \[09/Oct/2020:00:03:56 +0300\] "POST /wordpress/xmlrpc.php HTTP/1.1" 200 443 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/60.0.3112.113 Safari/537.36" "-" ... |
2020-10-09 18:14:45 |
| 139.155.91.141 | attackbots | Connection to SSH Honeypot - Detected by HoneypotDB |
2020-10-09 17:57:38 |
| 148.101.124.111 | attack | Oct 8 23:57:56 v11 sshd[3616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.101.124.111 user=r.r Oct 8 23:57:58 v11 sshd[3616]: Failed password for r.r from 148.101.124.111 port 42584 ssh2 Oct 8 23:57:58 v11 sshd[3616]: Received disconnect from 148.101.124.111 port 42584:11: Bye Bye [preauth] Oct 8 23:57:58 v11 sshd[3616]: Disconnected from 148.101.124.111 port 42584 [preauth] Oct 9 00:03:07 v11 sshd[4107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.101.124.111 user=r.r Oct 9 00:03:09 v11 sshd[4107]: Failed password for r.r from 148.101.124.111 port 48633 ssh2 Oct 9 00:03:09 v11 sshd[4107]: Received disconnect from 148.101.124.111 port 48633:11: Bye Bye [preauth] Oct 9 00:03:09 v11 sshd[4107]: Disconnected from 148.101.124.111 port 48633 [preauth] Oct 9 00:07:27 v11 sshd[4560]: Invalid user admin from 148.101.124.111 port 48614 Oct 9 00:07:27 v11 sshd[4560]: pam_u........ ------------------------------- |
2020-10-09 18:16:07 |
| 203.130.242.68 | attackspambots | Oct 9 03:01:55 *hidden* sshd[32151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.130.242.68 Oct 9 03:01:57 *hidden* sshd[32151]: Failed password for invalid user user from 203.130.242.68 port 59938 ssh2 Oct 9 03:20:42 *hidden* sshd[3131]: Invalid user sharon from 203.130.242.68 port 40489 |
2020-10-09 17:47:29 |
| 130.162.64.72 | attackspambots | Oct 9 11:31:18 OPSO sshd\[23046\]: Invalid user guest123 from 130.162.64.72 port 35887 Oct 9 11:31:18 OPSO sshd\[23046\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.162.64.72 Oct 9 11:31:20 OPSO sshd\[23046\]: Failed password for invalid user guest123 from 130.162.64.72 port 35887 ssh2 Oct 9 11:37:08 OPSO sshd\[24182\]: Invalid user git1 from 130.162.64.72 port 9576 Oct 9 11:37:08 OPSO sshd\[24182\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=130.162.64.72 |
2020-10-09 17:58:02 |
| 103.251.45.235 | attackspam | detected by Fail2Ban |
2020-10-09 17:57:17 |