城市(city): unknown
省份(region): unknown
国家(country): United States
运营商(isp): unknown
主机名(hostname): unknown
机构(organization): unknown
使用类型(Usage Type): unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 107.173.107.39
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44043
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;107.173.107.39. IN A
;; AUTHORITY SECTION:
. 600 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022022800 1800 900 604800 86400
;; Query time: 17 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Feb 28 14:57:52 CST 2022
;; MSG SIZE rcvd: 10739.107.173.107.in-addr.arpa domain name pointer 107-173-107-39-host.colocrossing.com.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
39.107.173.107.in-addr.arpa name = 107-173-107-39-host.colocrossing.com.
Authoritative answers can be found from:| IP | 类型 | 评论内容 | 时间 |
|---|---|---|---|
| 138.68.178.64 | attack | Aug 15 06:49:40 ws24vmsma01 sshd[181142]: Failed password for root from 138.68.178.64 port 36586 ssh2 ... |
2020-08-15 20:18:03 |
| 122.54.103.65 | attackbotsspam | Automatic report - Port Scan Attack |
2020-08-15 20:19:46 |
| 106.13.44.83 | attack | Aug 15 07:54:53 sso sshd[17432]: Failed password for root from 106.13.44.83 port 58238 ssh2 ... |
2020-08-15 20:24:16 |
| 80.157.192.53 | attackbots | Aug 9 15:06:25 h1946882 sshd[30039]: pam_unix(sshd:auth): authenticati= on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D80.1= 57.192.53 user=3Dr.r Aug 9 15:06:27 h1946882 sshd[30039]: Failed password for r.r from 80.= 157.192.53 port 43910 ssh2 Aug 9 15:06:27 h1946882 sshd[30039]: Received disconnect from 80.157.1= 92.53: 11: Bye Bye [preauth] Aug 9 15:13:28 h1946882 sshd[30258]: pam_unix(sshd:auth): authenticati= on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D80.1= 57.192.53 user=3Dr.r Aug 9 15:13:29 h1946882 sshd[30258]: Failed password for r.r from 80.= 157.192.53 port 55984 ssh2 Aug 9 15:13:29 h1946882 sshd[30258]: Received disconnect from 80.157.1= 92.53: 11: Bye Bye [preauth] Aug 9 15:17:52 h1946882 sshd[30359]: pam_unix(sshd:auth): authenticati= on failure; logname=3D uid=3D0 euid=3D0 tty=3Dssh ruser=3D rhost=3D80.1= 57.192.53 user=3Dr.r Aug 9 15:17:54 h1946882 sshd[30359]: Failed password for r.r from 80.= 157.19........ ------------------------------- |
2020-08-15 20:48:30 |
| 173.252.95.35 | attackspambots | [Sat Aug 15 19:25:50.690691 2020] [:error] [pid 3316:tid 140592583423744] [client 173.252.95.35:45702] [client 173.252.95.35] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/prakiraan-bulanan/prakiraan-daerah-potensi-banjir-di-provinsi-jawa-timur/555558208-prakiraan-bulanan-daerah-potensi-banjir-di-provinsi-jawa-timur-untuk-bulan-september-tahun-2020-update-10-agustus-2020"] [unique_id "XzfUTua0Xgxjnrgkau-8LgACeAM"] ... |
2020-08-15 20:38:36 |
| 122.51.37.133 | attackspambots | Aug 15 14:15:56 ns382633 sshd\[18292\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.37.133 user=root Aug 15 14:15:58 ns382633 sshd\[18292\]: Failed password for root from 122.51.37.133 port 57096 ssh2 Aug 15 14:21:42 ns382633 sshd\[19211\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.37.133 user=root Aug 15 14:21:44 ns382633 sshd\[19211\]: Failed password for root from 122.51.37.133 port 52472 ssh2 Aug 15 14:25:39 ns382633 sshd\[20051\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.37.133 user=root |
2020-08-15 20:42:55 |
| 95.169.5.166 | attack | Lines containing failures of 95.169.5.166 Aug 13 18:04:41 cdb sshd[12452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.169.5.166 user=r.r Aug 13 18:04:43 cdb sshd[12452]: Failed password for r.r from 95.169.5.166 port 42102 ssh2 Aug 13 18:04:46 cdb sshd[12452]: Received disconnect from 95.169.5.166 port 42102:11: Bye Bye [preauth] Aug 13 18:04:46 cdb sshd[12452]: Disconnected from authenticating user r.r 95.169.5.166 port 42102 [preauth] Aug 13 18:43:09 cdb sshd[15019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.169.5.166 user=r.r Aug 13 18:43:10 cdb sshd[15019]: Failed password for r.r from 95.169.5.166 port 49708 ssh2 Aug 13 18:43:10 cdb sshd[15019]: Received disconnect from 95.169.5.166 port 49708:11: Bye Bye [preauth] Aug 13 18:43:10 cdb sshd[15019]: Disconnected from authenticating user r.r 95.169.5.166 port 49708 [preauth] Aug 13 18:48:51 cdb sshd[15432]: pam_unix(sshd:........ ------------------------------ |
2020-08-15 20:52:14 |
| 207.46.13.73 | attackbotsspam | [Sat Aug 15 19:25:33.076150 2020] [:error] [pid 1165:tid 140592466097920] [client 207.46.13.73:3804] [client 207.46.13.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/profil/galeri-kegiatan"] [unique_id "XzfUPeniW-eKEEIJLUNKMAAAAcI"] ... |
2020-08-15 20:48:01 |
| 104.248.175.156 | attackspam | Aug 14 02:35:56 fwservlet sshd[20252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.175.156 user=r.r Aug 14 02:35:58 fwservlet sshd[20252]: Failed password for r.r from 104.248.175.156 port 48018 ssh2 Aug 14 02:35:58 fwservlet sshd[20252]: Received disconnect from 104.248.175.156 port 48018:11: Bye Bye [preauth] Aug 14 02:35:58 fwservlet sshd[20252]: Disconnected from 104.248.175.156 port 48018 [preauth] Aug 14 02:46:26 fwservlet sshd[20702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.175.156 user=r.r Aug 14 02:46:28 fwservlet sshd[20702]: Failed password for r.r from 104.248.175.156 port 55844 ssh2 Aug 14 02:46:28 fwservlet sshd[20702]: Received disconnect from 104.248.175.156 port 55844:11: Bye Bye [preauth] Aug 14 02:46:28 fwservlet sshd[20702]: Disconnected from 104.248.175.156 port 55844 [preauth] Aug 14 02:50:05 fwservlet sshd[20856]: pam_unix(sshd:auth): auth........ ------------------------------- |
2020-08-15 20:29:15 |
| 209.126.3.185 | attack | TCP ports : 4443 / 8080 / 8082 / 9443 |
2020-08-15 20:24:00 |
| 101.231.166.39 | attackbotsspam | Aug 15 05:48:14 serwer sshd\[16073\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.166.39 user=root Aug 15 05:48:15 serwer sshd\[16073\]: Failed password for root from 101.231.166.39 port 2061 ssh2 Aug 15 05:50:18 serwer sshd\[17657\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.231.166.39 user=root ... |
2020-08-15 20:23:12 |
| 222.186.173.154 | attack | Aug 15 09:27:35 firewall sshd[7279]: Failed password for root from 222.186.173.154 port 25664 ssh2 Aug 15 09:27:38 firewall sshd[7279]: Failed password for root from 222.186.173.154 port 25664 ssh2 Aug 15 09:27:41 firewall sshd[7279]: Failed password for root from 222.186.173.154 port 25664 ssh2 ... |
2020-08-15 20:31:17 |
| 68.183.89.147 | attackbots | frenzy |
2020-08-15 20:33:10 |
| 49.88.112.76 | attackspambots | Aug 15 09:05:23 ws24vmsma01 sshd[169770]: Failed password for root from 49.88.112.76 port 30475 ssh2 ... |
2020-08-15 20:23:28 |
| 192.241.172.175 | attackspam | 2020-08-15T12:01:49.053653shield sshd\[16844\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.172.175 user=root 2020-08-15T12:01:51.312909shield sshd\[16844\]: Failed password for root from 192.241.172.175 port 59838 ssh2 2020-08-15T12:06:27.663545shield sshd\[17259\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.172.175 user=root 2020-08-15T12:06:29.900140shield sshd\[17259\]: Failed password for root from 192.241.172.175 port 41760 ssh2 2020-08-15T12:11:14.649698shield sshd\[17700\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.172.175 user=root |
2020-08-15 20:21:26 |