81.161.67.106 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Czechia

Internet Service Provider: GEMNET s.r.o.

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbotsspam	Unauthorized connection attempt IP: 81.161.67.106 Ports affected Message Submission (587) Abuse Confidence rating 54% ASN Details AS59479 GEMNET s.r.o. Czechia (CZ) CIDR 81.161.64.0/20 Log Date: 18/08/2020 11:52:01 AM UTC	2020-08-19 03:01:52
attack	Aug 17 05:16:18 mail.srvfarm.net postfix/smtps/smtpd[2599218]: warning: unknown[81.161.67.106]: SASL PLAIN authentication failed: Aug 17 05:16:18 mail.srvfarm.net postfix/smtps/smtpd[2599218]: lost connection after AUTH from unknown[81.161.67.106] Aug 17 05:20:12 mail.srvfarm.net postfix/smtpd[2597245]: warning: unknown[81.161.67.106]: SASL PLAIN authentication failed: Aug 17 05:20:12 mail.srvfarm.net postfix/smtpd[2597245]: lost connection after AUTH from unknown[81.161.67.106] Aug 17 05:20:56 mail.srvfarm.net postfix/smtpd[2597247]: warning: unknown[81.161.67.106]: SASL PLAIN authentication failed:	2020-08-17 12:23:19

Type

Details

Datetime

attackbotsspam

Unauthorized connection attempt
IP: 81.161.67.106
Ports affected
    Message Submission (587) 
Abuse Confidence rating 54%
ASN Details
   AS59479 GEMNET s.r.o.
   Czechia (CZ)
   CIDR 81.161.64.0/20
Log Date: 18/08/2020 11:52:01 AM UTC

2020-08-19 03:01:52

attack

Aug 17 05:16:18 mail.srvfarm.net postfix/smtps/smtpd[2599218]: warning: unknown[81.161.67.106]: SASL PLAIN authentication failed: 
Aug 17 05:16:18 mail.srvfarm.net postfix/smtps/smtpd[2599218]: lost connection after AUTH from unknown[81.161.67.106]
Aug 17 05:20:12 mail.srvfarm.net postfix/smtpd[2597245]: warning: unknown[81.161.67.106]: SASL PLAIN authentication failed: 
Aug 17 05:20:12 mail.srvfarm.net postfix/smtpd[2597245]: lost connection after AUTH from unknown[81.161.67.106]
Aug 17 05:20:56 mail.srvfarm.net postfix/smtpd[2597247]: warning: unknown[81.161.67.106]: SASL PLAIN authentication failed:

2020-08-17 12:23:19

Comments on same subnet:

IP	Type	Details	Datetime
81.161.67.88	attack	Attempted Brute Force (dovecot)	2020-09-18 01:40:35
81.161.67.90	attackbotsspam	Sep 16 18:39:40 mail.srvfarm.net postfix/smtps/smtpd[3603056]: warning: unknown[81.161.67.90]: SASL PLAIN authentication failed: Sep 16 18:39:40 mail.srvfarm.net postfix/smtps/smtpd[3603056]: lost connection after AUTH from unknown[81.161.67.90] Sep 16 18:43:50 mail.srvfarm.net postfix/smtpd[3603171]: warning: unknown[81.161.67.90]: SASL PLAIN authentication failed: Sep 16 18:43:50 mail.srvfarm.net postfix/smtpd[3603171]: lost connection after AUTH from unknown[81.161.67.90] Sep 16 18:44:18 mail.srvfarm.net postfix/smtpd[3601766]: warning: unknown[81.161.67.90]: SASL PLAIN authentication failed:	2020-09-18 01:40:05
81.161.67.88	attackspam	Attempted Brute Force (dovecot)	2020-09-17 17:42:15
81.161.67.90	attack	Sep 16 18:39:40 mail.srvfarm.net postfix/smtps/smtpd[3603056]: warning: unknown[81.161.67.90]: SASL PLAIN authentication failed: Sep 16 18:39:40 mail.srvfarm.net postfix/smtps/smtpd[3603056]: lost connection after AUTH from unknown[81.161.67.90] Sep 16 18:43:50 mail.srvfarm.net postfix/smtpd[3603171]: warning: unknown[81.161.67.90]: SASL PLAIN authentication failed: Sep 16 18:43:50 mail.srvfarm.net postfix/smtpd[3603171]: lost connection after AUTH from unknown[81.161.67.90] Sep 16 18:44:18 mail.srvfarm.net postfix/smtpd[3601766]: warning: unknown[81.161.67.90]: SASL PLAIN authentication failed:	2020-09-17 17:41:44
81.161.67.194	attackspambots	SASL PLAIN auth failed: ruser=...	2020-09-15 23:24:20
81.161.67.194	attackspambots	SASL PLAIN auth failed: ruser=...	2020-09-15 15:17:24
81.161.67.194	attackbotsspam	SASL PLAIN auth failed: ruser=...	2020-09-15 07:23:56
81.161.67.161	attackspam	(smtpauth) Failed SMTP AUTH login from 81.161.67.161 (CZ/Czechia/static67-161.gemnet.cz): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-31 08:22:51 plain authenticator failed for ([81.161.67.161]) [81.161.67.161]: 535 Incorrect authentication data (set_id=peter@fmc-co.com)	2020-08-31 16:28:08
81.161.67.134	attackbotsspam	Aug 27 04:26:04 mail.srvfarm.net postfix/smtpd[1314738]: warning: unknown[81.161.67.134]: SASL PLAIN authentication failed: Aug 27 04:26:04 mail.srvfarm.net postfix/smtpd[1314738]: lost connection after AUTH from unknown[81.161.67.134] Aug 27 04:34:11 mail.srvfarm.net postfix/smtps/smtpd[1314660]: warning: unknown[81.161.67.134]: SASL PLAIN authentication failed: Aug 27 04:34:11 mail.srvfarm.net postfix/smtps/smtpd[1314660]: lost connection after AUTH from unknown[81.161.67.134] Aug 27 04:35:33 mail.srvfarm.net postfix/smtps/smtpd[1333102]: warning: unknown[81.161.67.134]: SASL PLAIN authentication failed:	2020-08-28 09:35:39
81.161.67.187	attackbotsspam	Aug 27 04:40:07 mail.srvfarm.net postfix/smtps/smtpd[1331222]: warning: unknown[81.161.67.187]: SASL PLAIN authentication failed: Aug 27 04:40:07 mail.srvfarm.net postfix/smtps/smtpd[1331222]: lost connection after AUTH from unknown[81.161.67.187] Aug 27 04:46:13 mail.srvfarm.net postfix/smtps/smtpd[1335343]: warning: unknown[81.161.67.187]: SASL PLAIN authentication failed: Aug 27 04:46:13 mail.srvfarm.net postfix/smtps/smtpd[1335343]: lost connection after AUTH from unknown[81.161.67.187] Aug 27 04:48:12 mail.srvfarm.net postfix/smtps/smtpd[1337554]: warning: unknown[81.161.67.187]: SASL PLAIN authentication failed:	2020-08-28 09:20:23
81.161.67.234	attackspam	Aug 27 15:45:15 mail.srvfarm.net postfix/smtpd[1615176]: warning: unknown[81.161.67.234]: SASL PLAIN authentication failed: Aug 27 15:45:15 mail.srvfarm.net postfix/smtpd[1615176]: lost connection after AUTH from unknown[81.161.67.234] Aug 27 15:46:31 mail.srvfarm.net postfix/smtps/smtpd[1612977]: warning: unknown[81.161.67.234]: SASL PLAIN authentication failed: Aug 27 15:46:31 mail.srvfarm.net postfix/smtps/smtpd[1612977]: lost connection after AUTH from unknown[81.161.67.234] Aug 27 15:48:27 mail.srvfarm.net postfix/smtpd[1615959]: warning: unknown[81.161.67.234]: SASL PLAIN authentication failed:	2020-08-28 09:19:56
81.161.67.205	attackbotsspam	Brute force attempt	2020-08-17 06:12:04
81.161.67.131	attack	Aug 16 05:48:16 mail.srvfarm.net postfix/smtpd[1910319]: warning: unknown[81.161.67.131]: SASL PLAIN authentication failed: Aug 16 05:48:16 mail.srvfarm.net postfix/smtpd[1910319]: lost connection after AUTH from unknown[81.161.67.131] Aug 16 05:50:01 mail.srvfarm.net postfix/smtpd[1907574]: warning: unknown[81.161.67.131]: SASL PLAIN authentication failed: Aug 16 05:50:01 mail.srvfarm.net postfix/smtpd[1907574]: lost connection after AUTH from unknown[81.161.67.131] Aug 16 05:50:11 mail.srvfarm.net postfix/smtpd[1907801]: warning: unknown[81.161.67.131]: SASL PLAIN authentication failed:	2020-08-16 12:29:12
81.161.67.95	attackbotsspam	Attempts against SMTP/SSMTP	2020-08-10 12:06:14
81.161.67.150	attackspambots	Aug 9 13:47:49 mail.srvfarm.net postfix/smtpd[780536]: warning: unknown[81.161.67.150]: SASL PLAIN authentication failed: Aug 9 13:47:49 mail.srvfarm.net postfix/smtpd[780536]: lost connection after AUTH from unknown[81.161.67.150] Aug 9 13:50:20 mail.srvfarm.net postfix/smtpd[781673]: warning: unknown[81.161.67.150]: SASL PLAIN authentication failed: Aug 9 13:50:20 mail.srvfarm.net postfix/smtpd[781673]: lost connection after AUTH from unknown[81.161.67.150] Aug 9 13:54:21 mail.srvfarm.net postfix/smtpd[779993]: warning: unknown[81.161.67.150]: SASL PLAIN authentication failed:	2020-08-10 03:40:45

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 81.161.67.106
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24223
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;81.161.67.106.			IN	A

;; AUTHORITY SECTION:
.			254	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020081601 1800 900 604800 86400

;; Query time: 70 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Aug 17 12:23:13 CST 2020
;; MSG SIZE  rcvd: 117

Host info

106.67.161.81.in-addr.arpa domain name pointer static67-106.gemnet.cz.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
106.67.161.81.in-addr.arpa	name = static67-106.gemnet.cz.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
62.210.14.241	attackbotsspam	From: "Apple" IP: 163.172.205.197 (toyal4.dorepi.com) IP: 62.210.14.241 (toyal3.dorepi.com) Message: This is the last time we are reminding you about your pending shipping cost. The pending delivery will be canceled if the amount is not paid within 48 hours List-Unsubscribe:	2020-08-08 02:40:21
139.59.61.103	attackspam	Too many connections or unauthorized access detected from Arctic banned ip	2020-08-08 02:51:11
106.13.73.59	attackbotsspam	Aug 7 18:47:50 Ubuntu-1404-trusty-64-minimal sshd\[3870\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.73.59 user=root Aug 7 18:47:52 Ubuntu-1404-trusty-64-minimal sshd\[3870\]: Failed password for root from 106.13.73.59 port 40678 ssh2 Aug 7 18:50:20 Ubuntu-1404-trusty-64-minimal sshd\[5846\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.73.59 user=root Aug 7 18:50:22 Ubuntu-1404-trusty-64-minimal sshd\[5846\]: Failed password for root from 106.13.73.59 port 60362 ssh2 Aug 7 18:53:01 Ubuntu-1404-trusty-64-minimal sshd\[6905\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.73.59 user=root	2020-08-08 02:29:59
178.128.226.2	attackbotsspam	Aug 7 20:24:32 buvik sshd[6146]: Failed password for root from 178.128.226.2 port 43111 ssh2 Aug 7 20:28:17 buvik sshd[6734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.226.2 user=root Aug 7 20:28:19 buvik sshd[6734]: Failed password for root from 178.128.226.2 port 47958 ssh2 ...	2020-08-08 02:29:03
112.30.136.31	attackspambots	Lines containing failures of 112.30.136.31 Aug 4 13:37:50 new sshd[27101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.30.136.31 user=r.r Aug 4 13:37:52 new sshd[27101]: Failed password for r.r from 112.30.136.31 port 36992 ssh2 Aug 4 13:37:53 new sshd[27101]: Received disconnect from 112.30.136.31 port 36992:11: Bye Bye [preauth] Aug 4 13:37:53 new sshd[27101]: Disconnected from authenticating user r.r 112.30.136.31 port 36992 [preauth] Aug 4 13:59:00 new sshd[1229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.30.136.31 user=r.r Aug 4 13:59:01 new sshd[1229]: Failed password for r.r from 112.30.136.31 port 39270 ssh2 Aug 4 13:59:02 new sshd[1229]: Received disconnect from 112.30.136.31 port 39270:11: Bye Bye [preauth] Aug 4 13:59:02 new sshd[1229]: Disconnected from authenticating user r.r 112.30.136.31 port 39270 [preauth] Aug 4 14:03:59 new sshd[2813]: pam_unix(s........ ------------------------------	2020-08-08 02:39:36
106.12.28.152	attackspambots	Aug 7 10:31:05 firewall sshd[3877]: Failed password for root from 106.12.28.152 port 46646 ssh2 Aug 7 10:35:59 firewall sshd[4021]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.28.152 user=root Aug 7 10:36:01 firewall sshd[4021]: Failed password for root from 106.12.28.152 port 43316 ssh2 ...	2020-08-08 02:18:38
157.230.235.233	attackspambots	Too many connections or unauthorized access detected from Arctic banned ip	2020-08-08 02:52:32
5.24.40.81	attackspambots	Unauthorized connection attempt from IP address 5.24.40.81 on Port 445(SMB)	2020-08-08 02:49:32
197.247.28.231	attackbotsspam	Unauthorized connection attempt from IP address 197.247.28.231 on Port 445(SMB)	2020-08-08 02:52:12
80.51.70.48	attackspambots	(smtpauth) Failed SMTP AUTH login from 80.51.70.48 (PL/Poland/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-08-07 16:31:35 plain authenticator failed for ([80.51.70.48]) [80.51.70.48]: 535 Incorrect authentication data (set_id=info@biscuit777.com)	2020-08-08 02:46:33
78.142.29.199	attackspam	Email login attempts - missing mail login name (IMAP)	2020-08-08 02:33:21
121.10.41.109	attack	20/8/7@08:43:13: FAIL: Alarm-Network address from=121.10.41.109 20/8/7@08:43:13: FAIL: Alarm-Network address from=121.10.41.109 ...	2020-08-08 02:43:23
41.69.229.141	attackspambots	(sshd) Failed SSH login from 41.69.229.141 (EG/Egypt/-): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD	2020-08-08 02:51:55
95.85.38.127	attackspam	SSH brutforce	2020-08-08 02:30:27
103.140.105.62	attack	Unauthorized connection attempt from IP address 103.140.105.62 on Port 445(SMB)	2020-08-08 02:23:40

Recently Reported IPs

115.236.136.115	212.227.15.15	103.242.237.105	209.85.221.43
209.85.218.53	34.207.247.134	209.85.214.201	18.140.175.61
95.107.6.3	209.85.221.99	209.85.208.100	209.85.167.46
209.85.166.180	101.78.54.217	209.85.166.45	55.161.67.166
166.175.59.58	156.230.100.110	209.85.222.173	209.85.208.226