138.0.254.130 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Brazil

运营商(isp): Assunet Ltda - ME

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Fixed Line ISP

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackspam	Sep 29 10:45:03 host postfix/smtps/smtpd\[2999\]: warning: unknown\[138.0.254.130\]: SASL PLAIN authentication failed:	2020-09-30 01:49:30
attackbotsspam	Sep 29 10:45:03 host postfix/smtps/smtpd\[2999\]: warning: unknown\[138.0.254.130\]: SASL PLAIN authentication failed:	2020-09-29 17:49:21

类型

评论内容

时间

attackspam

Sep 29 10:45:03 *host* postfix/smtps/smtpd\[2999\]: warning: unknown\[138.0.254.130\]: SASL PLAIN authentication failed:

2020-09-30 01:49:30

attackbotsspam

Sep 29 10:45:03 *host* postfix/smtps/smtpd\[2999\]: warning: unknown\[138.0.254.130\]: SASL PLAIN authentication failed:

2020-09-29 17:49:21

相同子网IP讨论:

IP	类型	评论内容	时间
138.0.254.182	attackbots	Unauthorized connection attempt from IP address 138.0.254.182 on Port 465(SMTPS)	2020-08-31 22:57:30
138.0.254.204	attack	(smtpauth) Failed SMTP AUTH login from 138.0.254.204 (BR/Brazil/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-28 08:22:26 plain authenticator failed for ([138.0.254.204]) [138.0.254.204]: 535 Incorrect authentication data (set_id=adabavazeh@nazeranyekta.com)	2020-07-28 16:55:56
138.0.254.204	attack	Brute force attempt	2020-07-25 15:29:58
138.0.254.65	attackspam	138.0.254.65 (BR/Brazil/-), 10 distributed smtpauth attacks on account [info] in the last 3600 secs; ID: DAN	2020-07-08 02:01:53
138.0.254.40	attackspam	Jun 16 08:34:52 mail.srvfarm.net postfix/smtps/smtpd[1063772]: warning: unknown[138.0.254.40]: SASL PLAIN authentication failed: Jun 16 08:34:52 mail.srvfarm.net postfix/smtps/smtpd[1063772]: lost connection after AUTH from unknown[138.0.254.40] Jun 16 08:38:49 mail.srvfarm.net postfix/smtpd[1067539]: lost connection after CONNECT from unknown[138.0.254.40] Jun 16 08:44:09 mail.srvfarm.net postfix/smtpd[1072325]: warning: unknown[138.0.254.40]: SASL PLAIN authentication failed: Jun 16 08:44:10 mail.srvfarm.net postfix/smtpd[1072325]: lost connection after AUTH from unknown[138.0.254.40]	2020-06-16 17:25:01
138.0.254.73	attackspambots	Brute force attempt	2020-06-07 17:48:11
138.0.254.111	attackspam	Unauthorized SMTP/IMAP/POP3 connection attempt	2019-09-11 13:10:38
138.0.254.103	attackspambots	$f2bV_matches	2019-09-02 23:12:01
138.0.254.41	attack	failed_logins	2019-08-30 01:57:54
138.0.254.174	attackspam	Excessive failed login attempts on port 587	2019-08-27 19:13:28

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 138.0.254.130
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41205
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;138.0.254.130.			IN	A

;; AUTHORITY SECTION:
.			159	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020092900 1800 900 604800 86400

;; Query time: 16 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Sep 29 17:49:18 CST 2020
;; MSG SIZE  rcvd: 117

HOST信息:

Host 130.254.0.138.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 130.254.0.138.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
222.186.180.130	attack	Jul 23 12:21:59 abendstille sshd\[12654\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.130 user=root Jul 23 12:22:01 abendstille sshd\[12654\]: Failed password for root from 222.186.180.130 port 40858 ssh2 Jul 23 12:22:08 abendstille sshd\[12855\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.130 user=root Jul 23 12:22:09 abendstille sshd\[12855\]: Failed password for root from 222.186.180.130 port 10966 ssh2 Jul 23 12:22:16 abendstille sshd\[12985\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.130 user=root ...	2020-07-23 18:23:18
185.147.215.13	attackbotsspam	\[Jul 23 20:16:19\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.215.13:61287' - Wrong password \[Jul 23 20:16:46\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.215.13:56211' - Wrong password \[Jul 23 20:17:16\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.215.13:51409' - Wrong password \[Jul 23 20:17:44\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.215.13:62723' - Wrong password \[Jul 23 20:18:13\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.215.13:58058' - Wrong password \[Jul 23 20:18:41\] NOTICE\[31025\] chan_sip.c: Registration from '\' failed for '185.147.215.13:53094' - Wrong password \[Jul 23 20:19:09\] NOTICE\[31025\] chan_sip.c: Registration from '\	2020-07-23 18:28:05
40.77.167.44	attackspam	IP 40.77.167.44 attacked honeypot on port: 80 at 7/22/2020 8:51:34 PM	2020-07-23 18:11:48
222.186.30.218	attack	Jul 23 10:07:18 rush sshd[9887]: Failed password for root from 222.186.30.218 port 48063 ssh2 Jul 23 10:07:32 rush sshd[9889]: Failed password for root from 222.186.30.218 port 39000 ssh2 ...	2020-07-23 18:09:18
200.118.57.190	attackspam	Jul 23 11:04:29 ncomp sshd[24495]: Invalid user sentry from 200.118.57.190 Jul 23 11:04:29 ncomp sshd[24495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.118.57.190 Jul 23 11:04:29 ncomp sshd[24495]: Invalid user sentry from 200.118.57.190 Jul 23 11:04:31 ncomp sshd[24495]: Failed password for invalid user sentry from 200.118.57.190 port 39156 ssh2	2020-07-23 18:13:33
1.30.219.93	attackspambots	07/23/2020-04:10:47.402659 1.30.219.93 Protocol: 6 ET SCAN Suspicious inbound to MSSQL port 1433	2020-07-23 18:31:37
5.196.72.11	attackspambots	2020-07-23T10:39:33.808817ks3355764 sshd[2950]: Invalid user node2 from 5.196.72.11 port 43154 2020-07-23T10:39:35.212281ks3355764 sshd[2950]: Failed password for invalid user node2 from 5.196.72.11 port 43154 ssh2 ...	2020-07-23 18:07:11
187.149.124.11	attackbotsspam	Lines containing failures of 187.149.124.11 Jul 22 23:38:13 neweola sshd[10659]: Invalid user hsk from 187.149.124.11 port 37952 Jul 22 23:38:13 neweola sshd[10659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.149.124.11 Jul 22 23:38:15 neweola sshd[10659]: Failed password for invalid user hsk from 187.149.124.11 port 37952 ssh2 Jul 22 23:38:15 neweola sshd[10659]: Received disconnect from 187.149.124.11 port 37952:11: Bye Bye [preauth] Jul 22 23:38:15 neweola sshd[10659]: Disconnected from invalid user hsk 187.149.124.11 port 37952 [preauth] Jul 22 23:47:24 neweola sshd[11228]: Invalid user su from 187.149.124.11 port 40993 Jul 22 23:47:24 neweola sshd[11228]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.149.124.11 Jul 22 23:47:26 neweola sshd[11228]: Failed password for invalid user su from 187.149.124.11 port 40993 ssh2 ........ ----------------------------------------------- https://www.blocklist.de/en/view.	2020-07-23 18:31:01
208.113.164.202	attack	Invalid user nss from 208.113.164.202 port 37722	2020-07-23 18:27:09
27.71.227.198	attack	Jul 23 09:18:37 vps sshd[695874]: Failed password for invalid user alumni from 27.71.227.198 port 51088 ssh2 Jul 23 09:22:45 vps sshd[714442]: Invalid user joelma from 27.71.227.198 port 52184 Jul 23 09:22:46 vps sshd[714442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.227.198 Jul 23 09:22:47 vps sshd[714442]: Failed password for invalid user joelma from 27.71.227.198 port 52184 ssh2 Jul 23 09:27:24 vps sshd[733226]: Invalid user admin from 27.71.227.198 port 53280 ...	2020-07-23 18:01:09
35.222.207.7	attack	Invalid user sybase from 35.222.207.7 port 38418	2020-07-23 18:28:41
217.111.239.37	attack	Jul 23 10:57:17 pve1 sshd[26873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.111.239.37 Jul 23 10:57:19 pve1 sshd[26873]: Failed password for invalid user ranjit from 217.111.239.37 port 55942 ssh2 ...	2020-07-23 18:08:25
85.204.246.240	attack	85.204.246.240 - - [23/Jul/2020:07:14:25 +0100] "POST /wp-login.php HTTP/1.1" 200 3568 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.90 Safari/537.36 2345Explorer/9.3.2.17331" 85.204.246.240 - - [23/Jul/2020:07:14:26 +0100] "POST /wp-login.php HTTP/1.1" 200 3568 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.90 Safari/537.36 2345Explorer/9.3.2.17331" 85.204.246.240 - - [23/Jul/2020:07:14:27 +0100] "POST /wp-login.php HTTP/1.1" 200 3625 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.90 Safari/537.36 2345Explorer/9.3.2.17331" ...	2020-07-23 17:58:11
36.89.157.197	attackspam	Invalid user ubuntu from 36.89.157.197 port 60856	2020-07-23 18:10:16
1.9.128.17	attackbots	Jul 23 08:22:49 abendstille sshd\[4075\]: Invalid user user from 1.9.128.17 Jul 23 08:22:49 abendstille sshd\[4075\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.9.128.17 Jul 23 08:22:51 abendstille sshd\[4075\]: Failed password for invalid user user from 1.9.128.17 port 4276 ssh2 Jul 23 08:29:10 abendstille sshd\[10577\]: Invalid user chronos from 1.9.128.17 Jul 23 08:29:10 abendstille sshd\[10577\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.9.128.17 ...	2020-07-23 18:16:33

最近上报的IP列表

11.8.53.166	138.97.54.231	171.252.151.250	145.192.9.27
86.230.169.239	91.160.172.239	70.62.172.212	45.248.210.23
14.117.239.71	119.182.77.141	192.59.135.167	160.7.188.90
163.30.246.18	3.128.248.73	101.217.144.197	44.235.128.207
198.93.138.48	155.245.62.77	190.83.45.241	253.119.29.168