61.164.149.68 - IPInfo

Basic Info

City: unknown

Region: Zhejiang

Country: China

Internet Service Provider: Wenzhou Telecom Co. Ltd

Hostname: unknown

Organization: No.31,Jin-rong Street

Usage Type: Commercial

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	Hi, Checking our logs we saw that we were receiving a lot of LDAP requests from the Public IP 61.164.149.68 on port 389 and we think they installed some infected files on our Server. Please block it. Thanks a lot in advance	2019-07-19 01:02:43

Type

Details

Datetime

attackspam

Hi,
Checking our logs we saw that we were receiving a lot of LDAP requests from the Public IP 61.164.149.68 on port 389 and we think they installed some infected files on our Server. Please block it.

Thanks a lot in advance

2019-07-19 01:02:43

Comments on same subnet:

IP	Type	Details	Datetime
61.164.149.191	attackbots	Port probing on unauthorized port 1433	2020-05-11 14:05:51
61.164.149.202	attackbotsspam	Port Scan 1433	2019-11-22 20:37:20

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 61.164.149.68
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 31112
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;61.164.149.68.			IN	A

;; AUTHORITY SECTION:
.			2274	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071800 1800 900 604800 86400

;; Query time: 0 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Fri Jul 19 01:02:35 CST 2019
;; MSG SIZE  rcvd: 117

Host info

Host 68.149.164.61.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 68.149.164.61.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
109.80.128.210	attackspambots	$f2bV_matches	2020-10-04 20:00:43
69.39.239.21	attackspam	Automatic report - Banned IP Access	2020-10-04 19:58:21
1.202.76.226	attack	Oct 4 11:32:06 eventyay sshd[26815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.202.76.226 Oct 4 11:32:08 eventyay sshd[26815]: Failed password for invalid user miguel from 1.202.76.226 port 5645 ssh2 Oct 4 11:34:22 eventyay sshd[26843]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.202.76.226 ...	2020-10-04 20:08:47
45.148.122.191	attackspambots	TCP (SYN) 45.148.122.191:34559 -> port 22, len 44	2020-10-04 19:44:10
185.228.113.65	attackbotsspam	Oct 4 19:35:00 itachi1706steam sshd[108558]: Invalid user pi from 185.228.113.65 port 49752 Oct 4 19:35:00 itachi1706steam sshd[108557]: Invalid user pi from 185.228.113.65 port 49750 Oct 4 19:35:00 itachi1706steam sshd[108558]: Connection closed by invalid user pi 185.228.113.65 port 49752 [preauth] ...	2020-10-04 20:05:25
185.202.1.106	attackspam	Repeated RDP login failures. Last user: Administrator	2020-10-04 19:48:06
82.148.19.60	attackbots	Automatic report - Banned IP Access	2020-10-04 19:39:35
64.90.40.100	attackspam	64.90.40.100 - - [04/Oct/2020:08:32:30 +0200] "POST /wp-login.php HTTP/1.0" 200 4794 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-10-04 20:15:07
194.180.224.115	attackbots	SSH Brute Force	2020-10-04 20:02:20
190.151.5.4	attackbotsspam	SMB Server BruteForce Attack	2020-10-04 20:10:17
213.32.92.57	attackspam	<6 unauthorized SSH connections	2020-10-04 20:03:35
213.108.134.121	attackspambots	Repeated RDP login failures. Last user: Test	2020-10-04 19:51:19
104.248.123.197	attackspam	<6 unauthorized SSH connections	2020-10-04 20:02:04
47.89.18.138	attackspambots	[munged]::443 47.89.18.138 - - [04/Oct/2020:11:30:31 +0200] "POST /[munged]: HTTP/1.1" 200 9183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 47.89.18.138 - - [04/Oct/2020:11:30:34 +0200] "POST /[munged]: HTTP/1.1" 200 9183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 47.89.18.138 - - [04/Oct/2020:11:30:36 +0200] "POST /[munged]: HTTP/1.1" 200 9183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 47.89.18.138 - - [04/Oct/2020:11:30:38 +0200] "POST /[munged]: HTTP/1.1" 200 9183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 47.89.18.138 - - [04/Oct/2020:11:30:41 +0200] "POST /[munged]: HTTP/1.1" 200 9183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 47.89.18.138 - - [04/Oct/2020:11:30:43 +0200] "POST /[munged]: HTTP/1.1" 200 9183 "-" "Mozilla/5.0 (X11; Ubuntu; Li	2020-10-04 19:41:48
195.54.161.31	attackspam	Repeated RDP login failures. Last user: SERVER01	2020-10-04 19:46:57

Recently Reported IPs

89.233.219.180	4.161.155.113	204.5.236.237	136.150.233.65
2003:c0:5f25:8538:ddc1:f32b:f497:88f	201.210.149.75	170.145.218.205	183.89.26.203
112.107.236.248	60.149.251.150	37.175.152.86	178.190.185.33
105.227.247.193	58.240.245.147	218.177.179.80	43.249.83.16
66.87.151.99	75.21.218.158	81.173.49.96	31.252.66.75