City: unknown
Region: unknown
Country: United States
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 74.135.42.16
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43980
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;74.135.42.16. IN A
;; AUTHORITY SECTION:
. 600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022020701 1800 900 604800 86400
;; Query time: 57 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Feb 08 01:27:50 CST 2022
;; MSG SIZE rcvd: 10516.42.135.74.in-addr.arpa domain name pointer 074-135-042-016.res.spectrum.com.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
16.42.135.74.in-addr.arpa name = 074-135-042-016.res.spectrum.com.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 94.128.80.10 | attackspambots | Sep 29 07:18:08 server3 sshd[10470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.128.80.10 user=mysql Sep 29 07:18:10 server3 sshd[10470]: Failed password for mysql from 94.128.80.10 port 28607 ssh2 Sep 29 07:18:10 server3 sshd[10470]: Received disconnect from 94.128.80.10 port 28607:11: Bye Bye [preauth] Sep 29 07:18:10 server3 sshd[10470]: Disconnected from 94.128.80.10 port 28607 [preauth] Sep 29 07:19:12 server3 sshd[10482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.128.80.10 user=r.r Sep 29 07:19:14 server3 sshd[10482]: Failed password for r.r from 94.128.80.10 port 28608 ssh2 Sep 29 07:19:14 server3 sshd[10482]: Received disconnect from 94.128.80.10 port 28608:11: Bye Bye [preauth] Sep 29 07:19:14 server3 sshd[10482]: Disconnected from 94.128.80.10 port 28608 [preauth] Sep 29 07:20:04 server3 sshd[10520]: Invalid user sshduser from 94.128.80.10 port 28609 Sep 29 07:20........ ------------------------------- |
2020-10-01 05:38:05 |
| 92.63.197.83 | attack | Sep 30 23:16:30 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=92.63.197.83 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=14954 PROTO=TCP SPT=52155 DPT=6550 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 30 23:17:00 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=92.63.197.83 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=10546 PROTO=TCP SPT=52155 DPT=6361 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 30 23:18:27 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=92.63.197.83 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=27013 PROTO=TCP SPT=52155 DPT=6551 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 30 23:20:50 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=92.63.197.83 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=5401 PROTO=TCP SPT=52155 DPT=6336 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 30 23:20:53 *hidden* kernel: ... |
2020-10-01 05:43:30 |
| 112.225.139.232 | attack | Automatic report - Port Scan Attack |
2020-10-01 05:43:52 |
| 211.80.102.189 | attackspambots | Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-30T19:55:14Z and 2020-09-30T20:07:18Z |
2020-10-01 05:16:14 |
| 167.99.108.13 | attack | 167.99.108.13 - - \[30/Sep/2020:23:14:06 +0200\] "POST /wp-login.php HTTP/1.0" 200 5983 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 167.99.108.13 - - \[30/Sep/2020:23:14:07 +0200\] "POST /wp-login.php HTTP/1.0" 200 5981 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" 167.99.108.13 - - \[30/Sep/2020:23:14:08 +0200\] "POST /xmlrpc.php HTTP/1.0" 200 736 "-" "Mozilla/5.0 \(X11\; Ubuntu\; Linux x86_64\; rv:62.0\) Gecko/20100101 Firefox/62.0" |
2020-10-01 05:32:29 |
| 138.197.146.132 | attackbots | 138.197.146.132 - - [30/Sep/2020:23:11:08 +0200] "GET /wp-login.php HTTP/1.1" 200 9061 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.146.132 - - [30/Sep/2020:23:11:10 +0200] "POST /wp-login.php HTTP/1.1" 200 9312 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 138.197.146.132 - - [30/Sep/2020:23:11:11 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" |
2020-10-01 05:49:46 |
| 35.236.59.177 | attackbots | Automatic report - XMLRPC Attack |
2020-10-01 05:37:33 |
| 42.229.183.35 | attack | Automatic report - Port Scan Attack |
2020-10-01 05:14:23 |
| 188.128.39.127 | attackbots | 2020-09-30T19:51:26.454749abusebot-6.cloudsearch.cf sshd[31828]: Invalid user jira from 188.128.39.127 port 39526 2020-09-30T19:51:26.460684abusebot-6.cloudsearch.cf sshd[31828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.128.39.127 2020-09-30T19:51:26.454749abusebot-6.cloudsearch.cf sshd[31828]: Invalid user jira from 188.128.39.127 port 39526 2020-09-30T19:51:27.968103abusebot-6.cloudsearch.cf sshd[31828]: Failed password for invalid user jira from 188.128.39.127 port 39526 ssh2 2020-09-30T19:53:59.594391abusebot-6.cloudsearch.cf sshd[31944]: Invalid user mcserver from 188.128.39.127 port 39908 2020-09-30T19:53:59.600122abusebot-6.cloudsearch.cf sshd[31944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.128.39.127 2020-09-30T19:53:59.594391abusebot-6.cloudsearch.cf sshd[31944]: Invalid user mcserver from 188.128.39.127 port 39908 2020-09-30T19:54:02.111339abusebot-6.cloudsearch.cf sshd[3194 ... |
2020-10-01 05:34:14 |
| 142.93.126.181 | attackbotsspam | 142.93.126.181 - - [30/Sep/2020:21:53:08 +0100] "POST /wp-login.php HTTP/1.1" 200 1908 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 142.93.126.181 - - [30/Sep/2020:21:53:09 +0100] "POST /wp-login.php HTTP/1.1" 200 1856 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 142.93.126.181 - - [30/Sep/2020:21:53:11 +0100] "POST /wp-login.php HTTP/1.1" 200 1835 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ... |
2020-10-01 05:23:50 |
| 119.8.152.92 | attack | Automatic report - Brute Force attack using this IP address |
2020-10-01 05:36:33 |
| 161.35.232.146 | attackbotsspam | C1,WP GET /suche/wp-login.php |
2020-10-01 05:45:08 |
| 213.141.157.220 | attackspambots | SSH login attempts. |
2020-10-01 05:44:48 |
| 139.155.86.214 | attack | SSH login attempts. |
2020-10-01 05:28:24 |
| 118.67.248.16 | attackspam | Probing for vulnerable services |
2020-10-01 05:40:50 |