City: unknown
Region: unknown
Country: France
Internet Service Provider: OVH SAS
Hostname: unknown
Organization: unknown
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attackspam | [TueMar1700:33:44.1408382020][:error][pid28280:tid47485661804288][client54.38.242.164:41360][client54.38.242.164]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)"atREQUEST_FILENAME.[file"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf"][line"211"][id"390709"][rev"30"][msg"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely"][data"/.env"][severity"CRITICAL"][hostname"fit-easy.com"][uri"/.env"][unique_id"XnAM2DznIPW7lSPm5YLbdgAAAM8"][TueMar1700:33:45.0075242020][:error][pid28454:tid47485672310528][client54.38.242.164:41492][client54.38.242.164]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|bo |
2020-03-17 11:40:06 |
| IP | Type | Details | Datetime |
|---|---|---|---|
| 54.38.242.206 | attackbots | Repeated brute force against a port |
2020-09-23 20:12:54 |
| 54.38.242.206 | attackbots | 54.38.242.206 (FR/France/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 23 00:04:08 server4 sshd[14228]: Failed password for root from 142.4.212.121 port 42996 ssh2 Sep 23 00:01:35 server4 sshd[13105]: Failed password for root from 54.38.242.206 port 46190 ssh2 Sep 23 00:03:32 server4 sshd[14072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.38.252 user=root Sep 23 00:03:34 server4 sshd[14072]: Failed password for root from 139.59.38.252 port 55780 ssh2 Sep 23 00:03:26 server4 sshd[14058]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.69.237.54 user=root Sep 23 00:03:28 server4 sshd[14058]: Failed password for root from 177.69.237.54 port 45936 ssh2 IP Addresses Blocked: 142.4.212.121 (CA/Canada/-) |
2020-09-23 12:35:01 |
| 54.38.242.206 | attackspambots | Sep 22 19:56:37 onepixel sshd[1860398]: Failed password for root from 54.38.242.206 port 34244 ssh2 Sep 22 19:59:53 onepixel sshd[1860974]: Invalid user testuser1 from 54.38.242.206 port 43608 Sep 22 19:59:53 onepixel sshd[1860974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.242.206 Sep 22 19:59:53 onepixel sshd[1860974]: Invalid user testuser1 from 54.38.242.206 port 43608 Sep 22 19:59:55 onepixel sshd[1860974]: Failed password for invalid user testuser1 from 54.38.242.206 port 43608 ssh2 |
2020-09-23 04:20:38 |
| 54.38.242.206 | attackbotsspam | Sep 6 19:22:25 game-panel sshd[22018]: Failed password for root from 54.38.242.206 port 45584 ssh2 Sep 6 19:26:07 game-panel sshd[22182]: Failed password for root from 54.38.242.206 port 51320 ssh2 |
2020-09-07 03:42:21 |
| 54.38.242.206 | attack | (sshd) Failed SSH login from 54.38.242.206 (FR/France/206.ip-54-38-242.eu): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 6 05:20:17 server sshd[6496]: Failed password for root from 54.38.242.206 port 56194 ssh2 Sep 6 05:26:16 server sshd[8057]: Invalid user fujita from 54.38.242.206 port 33786 Sep 6 05:26:18 server sshd[8057]: Failed password for invalid user fujita from 54.38.242.206 port 33786 ssh2 Sep 6 05:29:35 server sshd[8890]: Failed password for root from 54.38.242.206 port 38420 ssh2 Sep 6 05:32:50 server sshd[9900]: Failed password for root from 54.38.242.206 port 43056 ssh2 |
2020-09-06 19:12:19 |
| 54.38.242.206 | attackspambots | Time: Sat Aug 29 18:05:57 2020 +0000 IP: 54.38.242.206 (FR/France/206.ip-54-38-242.eu) Failures: 5 (sshd) Interval: 3600 seconds Blocked: Permanent Block [LF_SSHD] Log entries: Aug 29 18:03:22 pv-14-ams2 sshd[12119]: Failed password for root from 54.38.242.206 port 55438 ssh2 Aug 29 18:05:12 pv-14-ams2 sshd[18310]: Invalid user lee from 54.38.242.206 port 48860 Aug 29 18:05:14 pv-14-ams2 sshd[18310]: Failed password for invalid user lee from 54.38.242.206 port 48860 ssh2 Aug 29 18:05:52 pv-14-ams2 sshd[20489]: Invalid user yzf from 54.38.242.206 port 57328 Aug 29 18:05:54 pv-14-ams2 sshd[20489]: Failed password for invalid user yzf from 54.38.242.206 port 57328 ssh2 |
2020-08-30 02:45:36 |
| 54.38.242.206 | attack | Aug 24 10:14:22 ip106 sshd[14232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.242.206 Aug 24 10:14:23 ip106 sshd[14232]: Failed password for invalid user tose from 54.38.242.206 port 49586 ssh2 ... |
2020-08-24 16:55:58 |
| 54.38.242.206 | attack | Time: Sun Aug 23 15:34:02 2020 +0000 IP: 54.38.242.206 (FR/France/206.ip-54-38-242.eu) Failures: 5 (sshd) Interval: 3600 seconds Blocked: Permanent Block [LF_SSHD] Log entries: Aug 23 15:17:49 vps1 sshd[30625]: Invalid user backup from 54.38.242.206 port 47856 Aug 23 15:17:52 vps1 sshd[30625]: Failed password for invalid user backup from 54.38.242.206 port 47856 ssh2 Aug 23 15:30:28 vps1 sshd[31170]: Invalid user postgres from 54.38.242.206 port 39884 Aug 23 15:30:30 vps1 sshd[31170]: Failed password for invalid user postgres from 54.38.242.206 port 39884 ssh2 Aug 23 15:33:58 vps1 sshd[31393]: Invalid user rainbow from 54.38.242.206 port 47022 |
2020-08-24 02:05:05 |
| 54.38.242.206 | attack | *Port Scan* detected from 54.38.242.206 (FR/France/Hauts-de-France/Gravelines/206.ip-54-38-242.eu). 4 hits in the last 90 seconds |
2020-08-13 13:38:43 |
| 54.38.242.206 | attack | Fail2Ban |
2020-08-11 23:19:09 |
| 54.38.242.206 | attackbotsspam | Aug 9 07:42:00 eventyay sshd[19424]: Failed password for root from 54.38.242.206 port 39478 ssh2 Aug 9 07:45:43 eventyay sshd[19476]: Failed password for root from 54.38.242.206 port 46496 ssh2 ... |
2020-08-09 14:54:09 |
| 54.38.242.206 | attackspambots | Jul 31 06:56:18 inter-technics sshd[7606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.242.206 user=root Jul 31 06:56:20 inter-technics sshd[7606]: Failed password for root from 54.38.242.206 port 36996 ssh2 Jul 31 07:00:20 inter-technics sshd[7887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.242.206 user=root Jul 31 07:00:21 inter-technics sshd[7887]: Failed password for root from 54.38.242.206 port 47544 ssh2 Jul 31 07:04:21 inter-technics sshd[8121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.38.242.206 user=root Jul 31 07:04:23 inter-technics sshd[8121]: Failed password for root from 54.38.242.206 port 58072 ssh2 ... |
2020-07-31 17:35:45 |
| 54.38.242.206 | attack | 2020-07-25T08:45:49.329092+02:00 |
2020-07-25 17:51:13 |
| 54.38.242.206 | attackspam | Unauthorised connection attempt detected at AUO NODE 4. System is sshd. Protected by AUO Stack Web Application Firewall (WAF) |
2020-07-24 02:00:22 |
| 54.38.242.206 | attackbots | $f2bV_matches |
2020-07-15 05:39:30 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 54.38.242.164
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2380
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;54.38.242.164. IN A
;; AUTHORITY SECTION:
. 542 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2020031602 1800 900 604800 86400
;; Query time: 110 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Mar 17 11:40:02 CST 2020
;; MSG SIZE rcvd: 117164.242.38.54.in-addr.arpa domain name pointer 164.ip-54-38-242.eu.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
164.242.38.54.in-addr.arpa name = 164.ip-54-38-242.eu.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 91.218.163.74 | attackspambots | TCP src-port=47649 dst-port=25 Listed on dnsbl-sorbs abuseat-org barracuda (Project Honey Pot rated Suspicious & Spammer) (266) |
2020-03-21 01:07:09 |
| 87.103.120.250 | attackbots | Mar 20 15:26:09 mout sshd[2045]: Invalid user charity from 87.103.120.250 port 37502 |
2020-03-21 01:22:46 |
| 109.190.43.165 | attackspambots | Mar 20 17:27:23 localhost sshd\[26017\]: Invalid user sig from 109.190.43.165 port 50463 Mar 20 17:27:23 localhost sshd\[26017\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=109.190.43.165 Mar 20 17:27:26 localhost sshd\[26017\]: Failed password for invalid user sig from 109.190.43.165 port 50463 ssh2 ... |
2020-03-21 01:32:04 |
| 162.243.129.179 | attackspam | MultiHost/MultiPort Probe, Scan, Hack - |
2020-03-21 01:27:05 |
| 116.97.91.220 | attack | Unauthorized access detected from black listed ip! |
2020-03-21 00:45:43 |
| 82.64.15.106 | attackspam | $f2bV_matches |
2020-03-21 00:42:10 |
| 113.193.243.35 | attack | SSH auth scanning - multiple failed logins |
2020-03-21 01:16:25 |
| 91.193.253.248 | attack | proto=tcp . spt=58193 . dpt=25 . Found on Blocklist de (271) |
2020-03-21 00:41:19 |
| 37.187.3.53 | attackspambots | Mar 20 17:31:04 ns381471 sshd[19926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.187.3.53 Mar 20 17:31:06 ns381471 sshd[19926]: Failed password for invalid user guest from 37.187.3.53 port 59829 ssh2 |
2020-03-21 01:18:15 |
| 185.109.250.48 | attackbots | Unauthorized connection attempt detected from IP address 185.109.250.48 to port 5555 |
2020-03-21 01:13:40 |
| 128.199.66.137 | attackspam | RDP Brute-Force (honeypot 13) |
2020-03-21 00:42:40 |
| 31.207.34.147 | attack | Mar 20 13:45:57 web8 sshd\[8831\]: Invalid user tx from 31.207.34.147 Mar 20 13:45:57 web8 sshd\[8831\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.207.34.147 Mar 20 13:45:59 web8 sshd\[8831\]: Failed password for invalid user tx from 31.207.34.147 port 45480 ssh2 Mar 20 13:52:48 web8 sshd\[12553\]: Invalid user im from 31.207.34.147 Mar 20 13:52:48 web8 sshd\[12553\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.207.34.147 |
2020-03-21 00:51:01 |
| 111.224.40.207 | attack | Automatic report - Port Scan Attack |
2020-03-21 01:35:14 |
| 130.25.97.97 | attackbots | Automatic report - Port Scan Attack |
2020-03-21 01:08:26 |
| 78.128.113.94 | attackbots | Mar 20 17:57:30 relay postfix/smtpd\[2292\]: warning: unknown\[78.128.113.94\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 20 17:57:48 relay postfix/smtpd\[29264\]: warning: unknown\[78.128.113.94\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 20 18:01:41 relay postfix/smtpd\[1358\]: warning: unknown\[78.128.113.94\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 20 18:01:59 relay postfix/smtpd\[29264\]: warning: unknown\[78.128.113.94\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Mar 20 18:05:12 relay postfix/smtpd\[2292\]: warning: unknown\[78.128.113.94\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ... |
2020-03-21 01:20:08 |