City: unknown
Region: unknown
Country: Singapore
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 8.142.154.40
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 29381
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;8.142.154.40. IN A
;; AUTHORITY SECTION:
. 599 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022101101 1800 900 604800 86400
;; Query time: 77 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Oct 12 02:31:24 CST 2022
;; MSG SIZE rcvd: 105Host 40.154.142.8.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 40.154.142.8.in-addr.arpa: NXDOMAIN| IP | Type | Details | Datetime |
|---|---|---|---|
| 45.129.33.154 | attack | Sep 29 08:25:00 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=45.129.33.154 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=26840 PROTO=TCP SPT=49885 DPT=11027 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 29 08:25:37 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=45.129.33.154 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=25547 PROTO=TCP SPT=49885 DPT=22074 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 29 08:25:46 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=45.129.33.154 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=44715 PROTO=TCP SPT=49885 DPT=44088 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 29 08:26:01 *hidden* kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:05:0d:89:f8:66:f2:68:66:ff:08:00 SRC=45.129.33.154 DST=77.73.69.240 LEN=40 TOS=0x00 PREC=0x00 TTL=250 ID=50582 PROTO=TCP SPT=49885 DPT=33269 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 29 08:27:54 *hidden* ... |
2020-09-29 15:03:11 |
| 91.134.142.57 | attack | 91.134.142.57 - - [29/Sep/2020:08:19:47 +0200] "GET /wp-login.php HTTP/1.1" 200 8712 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 91.134.142.57 - - [29/Sep/2020:08:19:48 +0200] "POST /wp-login.php HTTP/1.1" 200 8942 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 91.134.142.57 - - [29/Sep/2020:08:19:49 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" |
2020-09-29 14:49:55 |
| 142.93.238.233 | attackspam | Port scan denied |
2020-09-29 15:21:39 |
| 138.197.200.16 | attackspambots | 2020-09-29T09:50:20.729131lavrinenko.info sshd[1825]: Failed password for root from 138.197.200.16 port 60768 ssh2 2020-09-29T09:54:50.427492lavrinenko.info sshd[2021]: Invalid user snabuser from 138.197.200.16 port 37210 2020-09-29T09:54:50.434426lavrinenko.info sshd[2021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.200.16 2020-09-29T09:54:50.427492lavrinenko.info sshd[2021]: Invalid user snabuser from 138.197.200.16 port 37210 2020-09-29T09:54:52.575341lavrinenko.info sshd[2021]: Failed password for invalid user snabuser from 138.197.200.16 port 37210 ssh2 ... |
2020-09-29 15:20:54 |
| 103.100.159.91 | attackspam | Sep 28 20:13:21 s5 sshd[27335]: Invalid user gpadmin from 103.100.159.91 port 60352 Sep 28 20:13:21 s5 sshd[27335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.100.159.91 Sep 28 20:13:24 s5 sshd[27335]: Failed password for invalid user gpadmin from 103.100.159.91 port 60352 ssh2 Sep 28 20:26:41 s5 sshd[28345]: Invalid user deployer from 103.100.159.91 port 52112 Sep 28 20:26:41 s5 sshd[28345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.100.159.91 Sep 28 20:26:42 s5 sshd[28345]: Failed password for invalid user deployer from 103.100.159.91 port 52112 ssh2 Sep 28 20:27:43 s5 sshd[28368]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.100.159.91 user=r.r Sep 28 20:27:45 s5 sshd[28368]: Failed password for r.r from 103.100.159.91 port 58566 ssh2 Sep 28 20:28:37 s5 sshd[28394]: pam_unix(sshd:auth): authentication failure; logname= uid=........ ------------------------------ |
2020-09-29 14:47:26 |
| 157.245.240.102 | attackbots | uvcm 157.245.240.102 [29/Sep/2020:03:45:40 "-" "POST /wp-login.php 200 6728 157.245.240.102 [29/Sep/2020:03:45:42 "-" "GET /wp-login.php 200 6619 157.245.240.102 [29/Sep/2020:03:45:43 "-" "POST /wp-login.php 200 6726 |
2020-09-29 14:41:41 |
| 112.45.114.76 | attackbotsspam | SASL PLAIN auth failed: ruser=... |
2020-09-29 15:16:45 |
| 202.189.238.235 | attack | srvr2: (mod_security) mod_security (id:920350) triggered by 202.189.238.235 (IN/-/-): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/09/28 22:38:08 [error] 890067#0: *830037 [client 202.189.238.235] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "160132548810.733798"] [ref "o0,16v21,16"], client: 202.189.238.235, [redacted] request: "GET / HTTP/1.1" [redacted] |
2020-09-29 14:54:27 |
| 182.189.83.220 | attackbots | Brute-force attempt banned |
2020-09-29 15:22:41 |
| 103.131.71.129 | attackbots | (mod_security) mod_security (id:210730) triggered by 103.131.71.129 (VN/Vietnam/bot-103-131-71-129.coccoc.com): 5 in the last 3600 secs |
2020-09-29 15:09:24 |
| 120.131.3.191 | attackspambots | Sep 29 13:17:59 NG-HHDC-SVS-001 sshd[30499]: Invalid user redis from 120.131.3.191 ... |
2020-09-29 15:02:37 |
| 183.62.25.218 | attackbotsspam | Sep 28 23:38:48 pve1 sshd[26514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.62.25.218 Sep 28 23:38:50 pve1 sshd[26514]: Failed password for invalid user brian from 183.62.25.218 port 3365 ssh2 ... |
2020-09-29 15:23:56 |
| 180.183.132.120 | attackbotsspam | Automatic report - Port Scan Attack |
2020-09-29 14:45:08 |
| 186.211.102.163 | attack | Automatic report - Banned IP Access |
2020-09-29 14:57:03 |
| 106.13.71.1 | attackbotsspam | Sep 29 08:45:09 mx sshd[1046571]: Failed password for root from 106.13.71.1 port 55464 ssh2 Sep 29 08:48:34 mx sshd[1046579]: Invalid user wp from 106.13.71.1 port 44944 Sep 29 08:48:34 mx sshd[1046579]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.71.1 Sep 29 08:48:34 mx sshd[1046579]: Invalid user wp from 106.13.71.1 port 44944 Sep 29 08:48:35 mx sshd[1046579]: Failed password for invalid user wp from 106.13.71.1 port 44944 ssh2 ... |
2020-09-29 15:18:57 |