124.158.12.246

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Vietnam

运营商(isp): CMC Telecom Infrastructure Company

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Fixed Line ISP

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attack	May 20 18:05:21 debian-2gb-nbg1-2 kernel: \[12249547.311255\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=124.158.12.246 DST=195.201.40.59 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=11544 DF PROTO=TCP SPT=64040 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0	2020-05-21 00:44:52
attackspam	" "	2020-04-30 05:56:01

类型

评论内容

时间

attack

May 20 18:05:21 debian-2gb-nbg1-2 kernel: \[12249547.311255\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=124.158.12.246 DST=195.201.40.59 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=11544 DF PROTO=TCP SPT=64040 DPT=1433 WINDOW=8192 RES=0x00 SYN URGP=0

2020-05-21 00:44:52

attackspam

" "

2020-04-30 05:56:01

相同子网IP讨论:

IP	类型	评论内容	时间
124.158.12.202	attackbots	124.158.12.202 - - [30/Sep/2020:01:38:46 +0100] "POST /wp-login.php HTTP/1.1" 200 4406 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [30/Sep/2020:01:38:50 +0100] "POST /wp-login.php HTTP/1.1" 200 4426 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [30/Sep/2020:01:38:53 +0100] "POST /wp-login.php HTTP/1.1" 200 4426 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-30 09:08:18
124.158.12.202	attackspam	124.158.12.202 - - [29/Sep/2020:13:26:58 +0100] "POST /wp-login.php HTTP/1.1" 200 2201 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [29/Sep/2020:13:27:00 +0100] "POST /wp-login.php HTTP/1.1" 200 2255 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [29/Sep/2020:13:27:02 +0100] "POST /wp-login.php HTTP/1.1" 200 2255 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-30 01:59:48
124.158.12.202	attackspambots	124.158.12.202 - - [29/Sep/2020:06:13:43 +0200] "POST /wp-login.php HTTP/1.0" 200 4794 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-29 18:01:35
124.158.12.202	attack	124.158.12.202 - - [06/Sep/2020:12:08:28 +0200] "GET /wp-login.php HTTP/1.1" 200 9184 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [06/Sep/2020:12:08:31 +0200] "POST /wp-login.php HTTP/1.1" 200 9435 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [06/Sep/2020:12:08:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-07 00:02:30
124.158.12.202	attackspam	124.158.12.202 - - [06/Sep/2020:07:59:45 +0100] "POST /wp-login.php HTTP/1.1" 200 2208 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [06/Sep/2020:07:59:48 +0100] "POST /wp-login.php HTTP/1.1" 200 2183 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [06/Sep/2020:07:59:50 +0100] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-09-06 15:24:45
124.158.12.202	attackbots	124.158.12.202 - - [06/Sep/2020:00:09:43 +0200] "GET /wp-login.php HTTP/1.1" 200 9184 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [06/Sep/2020:00:09:46 +0200] "POST /wp-login.php HTTP/1.1" 200 9435 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [06/Sep/2020:00:09:48 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-06 07:26:52
124.158.12.202	attackspambots	124.158.12.202 - - \[02/Sep/2020:03:07:22 +0200\] "POST /wp-login.php HTTP/1.0" 200 2797 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 124.158.12.202 - - \[02/Sep/2020:03:07:26 +0200\] "POST /wp-login.php HTTP/1.0" 200 2796 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 124.158.12.202 - - \[02/Sep/2020:03:07:29 +0200\] "POST /wp-login.php HTTP/1.0" 200 2770 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-09-02 21:16:22
124.158.12.202	attackbots	124.158.12.202 - - \[02/Sep/2020:03:07:22 +0200\] "POST /wp-login.php HTTP/1.0" 200 2797 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 124.158.12.202 - - \[02/Sep/2020:03:07:26 +0200\] "POST /wp-login.php HTTP/1.0" 200 2796 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 124.158.12.202 - - \[02/Sep/2020:03:07:29 +0200\] "POST /wp-login.php HTTP/1.0" 200 2770 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2020-09-02 13:10:51
124.158.12.202	attackspambots	124.158.12.202 - - [01/Sep/2020:23:42:46 +0200] "GET /wp-login.php HTTP/1.1" 200 2566 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [01/Sep/2020:23:42:47 +0200] "POST /wp-login.php HTTP/1.1" 200 2698 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [01/Sep/2020:23:42:48 +0200] "GET /wp-login.php HTTP/1.1" 200 2566 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [01/Sep/2020:23:42:49 +0200] "POST /wp-login.php HTTP/1.1" 200 2672 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [01/Sep/2020:23:42:50 +0200] "GET /wp-login.php HTTP/1.1" 200 2566 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [01/Sep/2020:23:42:51 +0200] "POST /wp-login.php HTTP/1.1" 200 2673 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/201001 ...	2020-09-02 06:13:34
124.158.12.202	attack	124.158.12.202 - - [14/Aug/2020:05:40:19 +0200] "GET /wp-login.php HTTP/1.1" 200 5738 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [14/Aug/2020:05:40:22 +0200] "POST /wp-login.php HTTP/1.1" 200 5989 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.202 - - [14/Aug/2020:05:40:24 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-08-14 13:49:37
124.158.124.161	attack	port scan and connect, tcp 23 (telnet)	2020-02-22 01:48:52
124.158.12.76	attackspambots	124.158.12.76 - - [14/Dec/2019:08:36:43 +0000] "POST /wp-login.php HTTP/1.1" 200 6393 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.76 - - [14/Dec/2019:08:36:44 +0000] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-12-14 19:32:38
124.158.126.229	attack	Scanning random ports - tries to find possible vulnerable services	2019-09-29 19:57:50
124.158.126.229	attack	Input Traffic from this IP, but critial abuseconfidencescore	2019-09-15 12:58:59
124.158.12.204	attackbots	124.158.12.204 - - [03/Aug/2019:03:58:22 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.204 - - [03/Aug/2019:03:58:23 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.204 - - [03/Aug/2019:03:58:24 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.204 - - [03/Aug/2019:03:58:25 +0200] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.204 - - [03/Aug/2019:03:58:26 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 124.158.12.204 - - [03/Aug/2019:03:58:27 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-08-03 10:23:47

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 124.158.12.246
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 32178
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;124.158.12.246.			IN	A

;; AUTHORITY SECTION:
.			212	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020042902 1800 900 604800 86400

;; Query time: 57 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Apr 30 05:55:57 CST 2020
;; MSG SIZE  rcvd: 118

HOST信息:

Host 246.12.158.124.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 246.12.158.124.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
45.118.144.31	attack	Sep 15 06:01:57 nextcloud sshd\[11435\]: Invalid user donna from 45.118.144.31 Sep 15 06:01:57 nextcloud sshd\[11435\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.118.144.31 Sep 15 06:01:58 nextcloud sshd\[11435\]: Failed password for invalid user donna from 45.118.144.31 port 48678 ssh2 ...	2019-09-15 12:46:52
159.203.193.43	attack	nginx-botsearch jail	2019-09-15 12:12:37
206.189.212.81	attackbotsspam	Sep 15 05:30:24 lnxweb61 sshd[18946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.212.81 Sep 15 05:30:24 lnxweb61 sshd[18946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.212.81	2019-09-15 12:31:31
193.29.15.175	attackbots	2019-09-15T04:19:10.771082abusebot.cloudsearch.cf sshd\[20516\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.29.15.175 user=root	2019-09-15 12:33:31
194.88.204.163	attackspam	Sep 15 06:04:10 nextcloud sshd\[14460\]: Invalid user duckie from 194.88.204.163 Sep 15 06:04:10 nextcloud sshd\[14460\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.88.204.163 Sep 15 06:04:12 nextcloud sshd\[14460\]: Failed password for invalid user duckie from 194.88.204.163 port 49342 ssh2 ...	2019-09-15 12:34:58
51.91.251.20	attack	Sep 15 05:53:00 vtv3 sshd\[26261\]: Invalid user ubnt from 51.91.251.20 port 53468 Sep 15 05:53:00 vtv3 sshd\[26261\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.251.20 Sep 15 05:53:02 vtv3 sshd\[26261\]: Failed password for invalid user ubnt from 51.91.251.20 port 53468 ssh2 Sep 15 05:56:37 vtv3 sshd\[28348\]: Invalid user test2 from 51.91.251.20 port 42958 Sep 15 05:56:37 vtv3 sshd\[28348\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.251.20 Sep 15 06:07:45 vtv3 sshd\[1275\]: Invalid user pi from 51.91.251.20 port 40640 Sep 15 06:07:45 vtv3 sshd\[1275\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.91.251.20 Sep 15 06:07:47 vtv3 sshd\[1275\]: Failed password for invalid user pi from 51.91.251.20 port 40640 ssh2 Sep 15 06:11:31 vtv3 sshd\[3306\]: Invalid user sympa from 51.91.251.20 port 58514 Sep 15 06:11:31 vtv3 sshd\[3306\]: pam_unix$sshd:auth$: auth	2019-09-15 12:13:26
54.37.158.40	attackbotsspam	Sep 15 05:58:12 vps647732 sshd[12435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.158.40 Sep 15 05:58:14 vps647732 sshd[12435]: Failed password for invalid user 123123 from 54.37.158.40 port 48697 ssh2 ...	2019-09-15 12:10:46
92.118.37.97	attack	09/15/2019-00:01:16.510893 92.118.37.97 Protocol: 6 ET SCAN NMAP -sS window 1024	2019-09-15 12:28:29
222.186.52.89	attack	SSH Brute Force, server-1 sshd[27725]: Failed password for root from 222.186.52.89 port 57728 ssh2	2019-09-15 12:22:30
173.245.239.181	attack	Sep 15 02:57:45 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 4 secs): user=, method=PLAIN, rip=173.245.239.181, lip=10.140.194.78, TLS, session=<3E2Tpo6SJQCt9e+1> Sep 15 02:57:56 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 8 secs): user=, method=PLAIN, rip=173.245.239.181, lip=10.140.194.78, TLS, session= Sep 15 02:57:57 flomail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 9 secs): user=, method=PLAIN, rip=173.245.239.181, lip=10.140.194.78, TLS: Disconnected, session=	2019-09-15 12:31:00
165.22.123.146	attack	Sep 15 00:09:22 plusreed sshd[7873]: Invalid user user from 165.22.123.146 ...	2019-09-15 12:15:39
116.196.90.254	attackbots	Sep 14 18:22:33 web1 sshd\[14619\]: Invalid user jcs from 116.196.90.254 Sep 14 18:22:33 web1 sshd\[14619\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.90.254 Sep 14 18:22:35 web1 sshd\[14619\]: Failed password for invalid user jcs from 116.196.90.254 port 50364 ssh2 Sep 14 18:27:26 web1 sshd\[15023\]: Invalid user jasper from 116.196.90.254 Sep 14 18:27:26 web1 sshd\[15023\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.90.254	2019-09-15 12:39:26
195.154.226.235	attack	Sep 15 02:58:26 sshgateway sshd\[6007\]: Invalid user john from 195.154.226.235 Sep 15 02:58:26 sshgateway sshd\[6007\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.154.226.235 Sep 15 02:58:28 sshgateway sshd\[6007\]: Failed password for invalid user john from 195.154.226.235 port 47776 ssh2	2019-09-15 12:12:18
134.209.34.30	attackspam	$f2bV_matches	2019-09-15 12:44:33
95.167.39.12	attackspambots	Sep 14 18:26:28 sachi sshd\[18782\]: Invalid user db2das from 95.167.39.12 Sep 14 18:26:28 sachi sshd\[18782\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.167.39.12 Sep 14 18:26:29 sachi sshd\[18782\]: Failed password for invalid user db2das from 95.167.39.12 port 53850 ssh2 Sep 14 18:30:18 sachi sshd\[19116\]: Invalid user user0 from 95.167.39.12 Sep 14 18:30:18 sachi sshd\[19116\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.167.39.12	2019-09-15 12:45:19

最近上报的IP列表

146.158.131.236	179.69.123.146	137.74.155.56	140.226.232.180
189.147.196.150	223.204.75.150	75.157.112.57	98.16.148.96
140.151.244.112	119.78.217.170	63.107.78.192	128.1.131.73
54.153.131.139	175.93.66.119	188.189.30.173	110.175.174.235
52.35.208.154	50.207.206.52	194.88.76.218	104.189.93.229