128.234.20.1 - IPInfo

基本信息:

城市(city): Jeddah

省份(region): Makkah Province

国家(country): Saudi Arabia

运营商(isp): Saudi Telecom Company JSC

主机名(hostname): unknown

机构(organization): Saudi Telecom Company JSC

使用类型(Usage Type): unknown

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attack	Honeypot attack, port: 81, PTR: PTR record not found	2019-07-19 00:03:28

相同子网IP讨论:

IP	类型	评论内容	时间
128.234.205.52	attack	Jan 1 15:49:45 grey postfix/smtpd\[23722\]: NOQUEUE: reject: RCPT from unknown\[128.234.205.52\]: 554 5.7.1 Service unavailable\; Client host \[128.234.205.52\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[128.234.205.52\]\; from=\ to=\ proto=ESMTP helo=\<\[128.234.205.52\]\> ...	2020-01-02 01:53:37

类型

评论内容

时间

128.234.205.52

attack

Jan  1 15:49:45 grey postfix/smtpd\[23722\]: NOQUEUE: reject: RCPT from unknown\[128.234.205.52\]: 554 5.7.1 Service unavailable\; Client host \[128.234.205.52\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[128.234.205.52\]\; from=\ to=\ proto=ESMTP helo=\<\[128.234.205.52\]\>
...

2020-01-02 01:53:37

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 128.234.20.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18374
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;128.234.20.1.			IN	A

;; AUTHORITY SECTION:
.			954	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071800 1800 900 604800 86400

;; Query time: 1 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Fri Jul 19 00:03:18 CST 2019
;; MSG SIZE  rcvd: 116

HOST信息:

Host 1.20.234.128.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 1.20.234.128.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
222.186.30.35	attackbots	Oct 4 19:50:11 gw1 sshd[13112]: Failed password for root from 222.186.30.35 port 33048 ssh2 ...	2020-10-04 22:55:26
1.34.16.210	attack	TCP (SYN) 1.34.16.210:2676 -> port 23, len 44	2020-10-04 23:00:08
147.0.22.179	attack	TCP (SYN) 147.0.22.179:40826 -> port 3486, len 44	2020-10-04 22:59:51
42.240.129.58	attack	firewall-block, port(s): 8126/tcp	2020-10-04 22:56:07
106.12.214.128	attackspambots	Found on CINS badguys / proto=6 . srcport=52002 . dstport=10679 . (1272)	2020-10-04 23:22:18
189.207.46.15	attackspam	Oct 4 16:29:32 santamaria sshd\[4986\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.207.46.15 user=root Oct 4 16:29:34 santamaria sshd\[4986\]: Failed password for root from 189.207.46.15 port 43274 ssh2 Oct 4 16:33:20 santamaria sshd\[4995\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.207.46.15 user=root ...	2020-10-04 22:45:33
88.248.186.59	attack	445/tcp 445/tcp 445/tcp... [2020-09-12/10-03]6pkt,1pt.(tcp)	2020-10-04 23:16:23
125.227.0.210	attackspambots	SCAN: Host Sweep CloudCIX Reconnaissance Scan Detected, PTR: 125-227-0-210.HINET-IP.hinet.net.	2020-10-04 22:52:41
64.225.126.137	attack	Oct 4 13:04:21 s1 sshd\[30247\]: Failed password for invalid user rodrigo from 64.225.126.137 port 56734 ssh2 Oct 4 13:15:03 s1 sshd\[10799\]: User root from 64.225.126.137 not allowed because not listed in AllowUsers Oct 4 13:15:03 s1 sshd\[10799\]: Failed password for invalid user root from 64.225.126.137 port 50084 ssh2 Oct 4 13:18:44 s1 sshd\[15261\]: Invalid user alfresco from 64.225.126.137 port 57276 Oct 4 13:18:44 s1 sshd\[15261\]: Failed password for invalid user alfresco from 64.225.126.137 port 57276 ssh2 Oct 4 13:22:22 s1 sshd\[19836\]: Invalid user labuser from 64.225.126.137 port 36230 ...	2020-10-04 23:13:42
193.242.104.31	attackspambots	Unauthorised access (Oct 4) SRC=193.242.104.31 LEN=52 TOS=0x10 PREC=0x40 TTL=115 ID=19905 DF TCP DPT=1433 WINDOW=8192 SYN	2020-10-04 22:57:51
139.199.14.128	attackspambots	2020-10-04T03:11:55.088931Z 7474e83e79ed New connection: 139.199.14.128:39700 (172.17.0.5:2222) [session: 7474e83e79ed] 2020-10-04T03:19:53.709557Z 630dc3796768 New connection: 139.199.14.128:56288 (172.17.0.5:2222) [session: 630dc3796768]	2020-10-04 22:48:44
37.187.181.155	attackbots	Brute%20Force%20SSH	2020-10-04 23:16:47
36.81.81.40	attackspam	139/tcp 445/tcp [2020-10-01]2pkt	2020-10-04 23:24:31
114.33.102.200	attackspambots	5555/tcp 61376/tcp [2020-09-24/10-03]2pkt	2020-10-04 22:55:51
108.62.123.167	attackbots	\[2020-10-04 03:00:18\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-04T03:00:18.987+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="1000000000001",SessionID="0x7f0ffeabb5a8",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/108.62.123.167/5069",Challenge="322e55fd",ReceivedChallenge="322e55fd",ReceivedHash="56b594278f1da155d27d0d54d9298239" \[2020-10-04 03:48:59\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-04T03:48:59.248+0200",Severity="Error",Service="SIP",EventVersion="2",AccountID="1000",SessionID="0x7f0ffea6efd8",LocalAddress="IPV4/UDP/204.8.216.89/5060",RemoteAddress="IPV4/UDP/108.62.123.167/6072",Challenge="29b7f2d2",ReceivedChallenge="29b7f2d2",ReceivedHash="388bcec59ee341cd8e21188b9e33a564" \[2020-10-04 03:48:59\] SECURITY\[6939\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-10-04T03:48:59.756+0200",Severity="Error",Service="SIP",EventVersi ...	2020-10-04 23:04:09

最近上报的IP列表

36.78.15.164	46.105.121.222	223.81.69.182	108.29.35.119
89.210.243.246	67.142.235.252	179.12.238.55	204.242.74.13
103.92.11.180	42.101.64.100	100.158.42.157	193.222.55.78
202.46.55.207	182.74.108.2	36.218.246.132	123.25.113.66
138.255.165.86	97.23.225.35	68.43.176.7	2003:f5:f3d3:f4b:488c:add8:5d10:27b1