106.52.107.94 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): China

运营商(isp): Tencent Cloud Computing (Beijing) Co. Ltd.

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Data Center/Web Hosting/Transit

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attack	Jun 7 16:00:14 hell sshd[14344]: Failed password for root from 106.52.107.94 port 52576 ssh2 ...	2020-06-08 01:57:27
attackspambots	May 21 21:11:06 onepixel sshd[751765]: Invalid user gaw from 106.52.107.94 port 56010 May 21 21:11:06 onepixel sshd[751765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.107.94 May 21 21:11:06 onepixel sshd[751765]: Invalid user gaw from 106.52.107.94 port 56010 May 21 21:11:09 onepixel sshd[751765]: Failed password for invalid user gaw from 106.52.107.94 port 56010 ssh2 May 21 21:13:46 onepixel sshd[752013]: Invalid user ojv from 106.52.107.94 port 51138	2020-05-22 05:31:36

类型

评论内容

时间

attack

Jun  7 16:00:14 hell sshd[14344]: Failed password for root from 106.52.107.94 port 52576 ssh2
...

2020-06-08 01:57:27

attackspambots

May 21 21:11:06 onepixel sshd[751765]: Invalid user gaw from 106.52.107.94 port 56010
May 21 21:11:06 onepixel sshd[751765]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.107.94 
May 21 21:11:06 onepixel sshd[751765]: Invalid user gaw from 106.52.107.94 port 56010
May 21 21:11:09 onepixel sshd[751765]: Failed password for invalid user gaw from 106.52.107.94 port 56010 ssh2
May 21 21:13:46 onepixel sshd[752013]: Invalid user ojv from 106.52.107.94 port 51138

2020-05-22 05:31:36

相同子网IP讨论:

IP	类型	评论内容	时间
106.52.107.70	attackbots	Jun 18 14:31:54 srv1 sshd[30248]: Invalid user moodle from 106.52.107.70 Jun 18 14:31:56 srv1 sshd[30248]: Failed password for invalid user moodle from 106.52.107.70 port 59612 ssh2 Jun 18 15:06:04 srv1 sshd[25974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.107.70 user=r.r Jun 18 15:06:06 srv1 sshd[25974]: Failed password for r.r from 106.52.107.70 port 58944 ssh2 Jun 18 15:07:55 srv1 sshd[27999]: Invalid user abi from 106.52.107.70 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=106.52.107.70	2020-06-18 23:43:45
106.52.107.81	attack	Unauthorized connection attempt detected from IP address 106.52.107.81 to port 80 [J]	2020-02-01 10:50:19

类型

评论内容

时间

106.52.107.70

attackbots

Jun 18 14:31:54 srv1 sshd[30248]: Invalid user moodle from 106.52.107.70
Jun 18 14:31:56 srv1 sshd[30248]: Failed password for invalid user moodle from 106.52.107.70 port 59612 ssh2
Jun 18 15:06:04 srv1 sshd[25974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.107.70  user=r.r
Jun 18 15:06:06 srv1 sshd[25974]: Failed password for r.r from 106.52.107.70 port 58944 ssh2
Jun 18 15:07:55 srv1 sshd[27999]: Invalid user abi from 106.52.107.70


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=106.52.107.70

2020-06-18 23:43:45

106.52.107.81

attack

Unauthorized connection attempt detected from IP address 106.52.107.81 to port 80 [J]

2020-02-01 10:50:19

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 106.52.107.94
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10121
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;106.52.107.94.			IN	A

;; AUTHORITY SECTION:
.			578	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020052102 1800 900 604800 86400

;; Query time: 58 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri May 22 05:31:32 CST 2020
;; MSG SIZE  rcvd: 117

HOST信息:

Host 94.107.52.106.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 94.107.52.106.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
193.201.212.132	attack	TCP (SYN) 193.201.212.132:4111 -> port 23, len 44	2020-09-27 21:06:12
169.239.120.11	attack	port scan and connect, tcp 1433 (ms-sql-s)	2020-09-27 21:05:10
138.255.148.35	attack	Ssh brute force	2020-09-27 20:57:39
5.62.20.22	attack	0,59-02/04 [bc00/m59] PostRequest-Spammer scoring: lisboa	2020-09-27 21:21:03
121.10.139.68	attackbots	firewall-block, port(s): 16218/tcp	2020-09-27 21:16:46
91.214.114.7	attackspam	leo_www	2020-09-27 21:05:30
36.255.156.126	attackspambots	Sep 27 17:04:13 dhoomketu sshd[3407453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.255.156.126 Sep 27 17:04:13 dhoomketu sshd[3407453]: Invalid user anna from 36.255.156.126 port 35750 Sep 27 17:04:15 dhoomketu sshd[3407453]: Failed password for invalid user anna from 36.255.156.126 port 35750 ssh2 Sep 27 17:08:28 dhoomketu sshd[3407473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.255.156.126 user=root Sep 27 17:08:30 dhoomketu sshd[3407473]: Failed password for root from 36.255.156.126 port 43646 ssh2 ...	2020-09-27 20:49:55
192.95.30.59	attackbots	bad	2020-09-27 21:02:38
49.88.112.73	attackbotsspam	Sep 27 13:17:51 onepixel sshd[3010533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.73 user=root Sep 27 13:17:54 onepixel sshd[3010533]: Failed password for root from 49.88.112.73 port 25615 ssh2 Sep 27 13:17:51 onepixel sshd[3010533]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.88.112.73 user=root Sep 27 13:17:54 onepixel sshd[3010533]: Failed password for root from 49.88.112.73 port 25615 ssh2 Sep 27 13:17:58 onepixel sshd[3010533]: Failed password for root from 49.88.112.73 port 25615 ssh2	2020-09-27 21:23:28
49.233.11.118	attackbots	Sep 27 12:02:26 prox sshd[24713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.233.11.118 Sep 27 12:02:29 prox sshd[24713]: Failed password for invalid user ubuntu from 49.233.11.118 port 47214 ssh2	2020-09-27 21:20:47
162.243.232.174	attack	Sep 27 11:46:58 pornomens sshd\[20989\]: Invalid user asdf from 162.243.232.174 port 57118 Sep 27 11:46:58 pornomens sshd\[20989\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.243.232.174 Sep 27 11:47:00 pornomens sshd\[20989\]: Failed password for invalid user asdf from 162.243.232.174 port 57118 ssh2 ...	2020-09-27 20:51:07
103.145.13.43	attackspam	scans 2 times in preceeding hours on the ports (in chronological order) 50802 5038 resulting in total of 23 scans from 103.145.13.0/24 block.	2020-09-27 21:03:56
37.49.230.164	attackbots	srvr3: (mod_security) mod_security (id:920350) triggered by 37.49.230.164 (NL/-/circlepole.xyz): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/09/26 22:39:25 [error] 324565#0: 1391 [client 37.49.230.164] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "160115276567.272105"] [ref "o0,14v21,14"], client: 37.49.230.164, [redacted] request: "GET / HTTP/1.1" [redacted]	2020-09-27 21:17:59
77.185.108.97	attackbotsspam	Port Scan: TCP/443	2020-09-27 21:17:31
180.76.165.107	attackspam	2020-09-27T09:13:53.922625abusebot.cloudsearch.cf sshd[12678]: Invalid user ubuntu from 180.76.165.107 port 50950 2020-09-27T09:13:53.928128abusebot.cloudsearch.cf sshd[12678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.165.107 2020-09-27T09:13:53.922625abusebot.cloudsearch.cf sshd[12678]: Invalid user ubuntu from 180.76.165.107 port 50950 2020-09-27T09:13:55.652771abusebot.cloudsearch.cf sshd[12678]: Failed password for invalid user ubuntu from 180.76.165.107 port 50950 ssh2 2020-09-27T09:22:43.353317abusebot.cloudsearch.cf sshd[12812]: Invalid user bbs from 180.76.165.107 port 33058 2020-09-27T09:22:43.360571abusebot.cloudsearch.cf sshd[12812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.165.107 2020-09-27T09:22:43.353317abusebot.cloudsearch.cf sshd[12812]: Invalid user bbs from 180.76.165.107 port 33058 2020-09-27T09:22:45.511608abusebot.cloudsearch.cf sshd[12812]: Failed password ...	2020-09-27 21:26:24

最近上报的IP列表

183.48.88.28	179.117.242.48	12.102.82.184	83.178.239.231
162.216.102.130	60.27.8.242	96.241.127.195	186.183.248.121
115.31.63.181	23.121.35.136	220.152.113.137	44.205.209.169
125.100.243.69	170.29.70.165	194.197.223.83	36.22.145.108
63.145.169.143	174.110.165.31	94.255.122.239	137.84.90.145