City: unknown
Region: unknown
Country: Norway
Internet Service Provider: Eltele AS
Hostname: unknown
Organization: unknown
Usage Type: Data Center/Web Hosting/Transit
| Type | Details | Datetime |
|---|---|---|
| attack | Scanning random ports - tries to find possible vulnerable services |
2019-06-22 19:10:32 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 85.113.162.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 32794
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;85.113.162.42. IN A
;; AUTHORITY SECTION:
. 3600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019062201 1800 900 604800 86400
;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sat Jun 22 19:10:25 CST 2019
;; MSG SIZE rcvd: 11742.162.113.85.in-addr.arpa domain name pointer varanger-kraft1-042.ftth.trollnet.no.
Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
42.162.113.85.in-addr.arpa name = varanger-kraft1-042.ftth.trollnet.no.
Authoritative answers can be found from:
| IP | Type | Details | Datetime |
|---|---|---|---|
| 198.108.67.91 | attackbotsspam | Port scan: Attack repeated for 24 hours |
2019-09-12 01:44:58 |
| 88.255.199.45 | attackbots | Automatic report - Port Scan Attack |
2019-09-11 23:47:20 |
| 138.68.223.84 | attackspambots | firewall-block, port(s): 6379/tcp |
2019-09-12 00:20:11 |
| 183.166.98.210 | attackbotsspam | SMTP/25/465/587-993/995 Probe, Reject, BadAuth, Hack, SPAM - |
2019-09-12 01:05:52 |
| 185.176.27.174 | attack | Portscan or hack attempt detected by psad/fwsnort |
2019-09-12 01:50:21 |
| 45.136.109.33 | attackspambots | Sep 11 18:24:59 mc1 kernel: \[769664.710925\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.33 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=8301 PROTO=TCP SPT=44546 DPT=2721 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 11 18:29:16 mc1 kernel: \[769921.516077\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.33 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=20316 PROTO=TCP SPT=44546 DPT=2289 WINDOW=1024 RES=0x00 SYN URGP=0 Sep 11 18:30:56 mc1 kernel: \[770021.926485\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:11:a9:7b:d2:74:7f:6e:37:e3:08:00 SRC=45.136.109.33 DST=159.69.205.51 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=53488 PROTO=TCP SPT=44546 DPT=2354 WINDOW=1024 RES=0x00 SYN URGP=0 ... |
2019-09-12 00:43:01 |
| 183.129.160.229 | attackspam | Sep 10 17:37:13 lenivpn01 kernel: \[362637.926426\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=183.129.160.229 DST=195.201.121.15 LEN=44 TOS=0x00 PREC=0x00 TTL=109 ID=34115 PROTO=TCP SPT=36548 DPT=48202 WINDOW=29200 RES=0x00 SYN URGP=0 Sep 10 19:02:38 lenivpn01 kernel: \[367763.090103\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=183.129.160.229 DST=195.201.121.15 LEN=44 TOS=0x00 PREC=0x00 TTL=109 ID=60586 PROTO=TCP SPT=34262 DPT=3966 WINDOW=29200 RES=0x00 SYN URGP=0 Sep 10 19:31:45 lenivpn01 kernel: \[369509.605184\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=183.129.160.229 DST=195.201.121.15 LEN=44 TOS=0x00 PREC=0x00 TTL=108 ID=53418 PROTO=TCP SPT=6138 DPT=17018 WINDOW=29200 RES=0x00 SYN URGP=0 Sep 10 19:32:40 lenivpn01 kernel: \[369564.922185\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:2f:6c:1b:d2:74:7f:6e:37:e3:08:00 SRC=183.129.160.229 DST=195.201.121.15 LEN=44 TOS=0x00 PREC=0x00 ... |
2019-09-12 01:53:58 |
| 103.104.17.139 | attackbots | Sep 11 10:39:52 aat-srv002 sshd[20488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.104.17.139 Sep 11 10:39:54 aat-srv002 sshd[20488]: Failed password for invalid user chris from 103.104.17.139 port 52222 ssh2 Sep 11 10:47:40 aat-srv002 sshd[20762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.104.17.139 Sep 11 10:47:42 aat-srv002 sshd[20762]: Failed password for invalid user ftpusr from 103.104.17.139 port 34836 ssh2 ... |
2019-09-11 23:52:37 |
| 165.22.129.95 | attack | MultiHost/MultiPort Probe, Scan, Hack - |
2019-09-11 23:50:24 |
| 89.248.160.193 | attackspam | Port scan on 10 port(s): 3973 3974 3977 3978 3980 3981 3983 3985 3988 3993 |
2019-09-12 02:03:23 |
| 207.46.13.53 | attackbots | Automatic report - Banned IP Access |
2019-09-11 23:44:25 |
| 185.176.27.18 | attackbots | Excessive Port-Scanning |
2019-09-12 01:02:27 |
| 218.2.88.25 | attackspam | Unauthorised access (Sep 11) SRC=218.2.88.25 LEN=40 TOS=0x10 PREC=0x40 TTL=50 ID=60097 TCP DPT=8080 WINDOW=9636 SYN |
2019-09-12 00:00:31 |
| 198.108.67.93 | attackspambots | firewall-block, port(s): 3059/tcp |
2019-09-12 01:43:48 |
| 187.15.17.33 | attackspam | @LucianNitescu Personal Honeypot Network <<<>>> Donate at paypal.me/LNitescu <<<>>> 2019-09-11 06:25:22,970 INFO [amun_request_handler] PortScan Detected on Port: 445 (187.15.17.33) |
2019-09-12 01:49:06 |