必须是合法有效的IP地址, 可以是IPv4或者是IPv6, 例如127.0.0.1或者2001:DB8:0:0:8:800:200C:417A
基本信息:

城市(city): unknown

省份(region): unknown

国家(country): United States

运营商(isp): DigitalOcean LLC

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Data Center/Web Hosting/Transit

用户上报:
类型 评论内容 时间
attack
Sep  6 06:29:21 MK-Soft-VM4 sshd\[30132\]: Invalid user qwe123 from 138.68.1.18 port 42442
Sep  6 06:29:21 MK-Soft-VM4 sshd\[30132\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.1.18
Sep  6 06:29:24 MK-Soft-VM4 sshd\[30132\]: Failed password for invalid user qwe123 from 138.68.1.18 port 42442 ssh2
...
2019-09-06 14:45:10
attack
Automated report - ssh fail2ban:
Aug 31 00:58:18 authentication failure 
Aug 31 00:58:20 wrong password, user=aya, port=40824, ssh2
Aug 31 01:02:36 authentication failure
2019-08-31 07:18:39
attackbotsspam
Aug 21 13:16:41 mail sshd\[5244\]: Failed password for invalid user csgoserver from 138.68.1.18 port 51732 ssh2
Aug 21 13:33:02 mail sshd\[5671\]: Invalid user ts3 from 138.68.1.18 port 60094
...
2019-08-21 20:41:05
attackspam
Aug 20 03:37:01 ny01 sshd[2591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.1.18
Aug 20 03:37:03 ny01 sshd[2591]: Failed password for invalid user vbox from 138.68.1.18 port 46050 ssh2
Aug 20 03:41:33 ny01 sshd[3054]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.1.18
2019-08-20 15:41:44
相同子网IP讨论:
IP 类型 评论内容 时间
138.68.191.85 attackproxy
Malicious IP / Malware
2024-04-26 12:55:20
138.68.100.102 attackbotsspam
Lines containing failures of 138.68.100.102
Oct  8 08:42:23 newdogma sshd[22234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.100.102  user=r.r
Oct  8 08:42:25 newdogma sshd[22234]: Failed password for r.r from 138.68.100.102 port 36538 ssh2
Oct  8 08:42:26 newdogma sshd[22234]: Received disconnect from 138.68.100.102 port 36538:11: Bye Bye [preauth]
Oct  8 08:42:26 newdogma sshd[22234]: Disconnected from authenticating user r.r 138.68.100.102 port 36538 [preauth]
Oct  8 08:58:51 newdogma sshd[22800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.100.102  user=r.r
Oct  8 08:58:53 newdogma sshd[22800]: Failed password for r.r from 138.68.100.102 port 37066 ssh2
Oct  8 08:58:55 newdogma sshd[22800]: Received disconnect from 138.68.100.102 port 37066:11: Bye Bye [preauth]
Oct  8 08:58:55 newdogma sshd[22800]: Disconnected from authenticating user r.r 138.68.100.102 port 37066........
------------------------------
2020-10-10 02:09:51
138.68.100.102 attackbotsspam
Lines containing failures of 138.68.100.102
Oct  8 08:42:23 newdogma sshd[22234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.100.102  user=r.r
Oct  8 08:42:25 newdogma sshd[22234]: Failed password for r.r from 138.68.100.102 port 36538 ssh2
Oct  8 08:42:26 newdogma sshd[22234]: Received disconnect from 138.68.100.102 port 36538:11: Bye Bye [preauth]
Oct  8 08:42:26 newdogma sshd[22234]: Disconnected from authenticating user r.r 138.68.100.102 port 36538 [preauth]
Oct  8 08:58:51 newdogma sshd[22800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.100.102  user=r.r
Oct  8 08:58:53 newdogma sshd[22800]: Failed password for r.r from 138.68.100.102 port 37066 ssh2
Oct  8 08:58:55 newdogma sshd[22800]: Received disconnect from 138.68.100.102 port 37066:11: Bye Bye [preauth]
Oct  8 08:58:55 newdogma sshd[22800]: Disconnected from authenticating user r.r 138.68.100.102 port 37066........
------------------------------
2020-10-09 17:54:43
138.68.178.64 attack
Invalid user dev from 138.68.178.64 port 36768
2020-10-05 06:30:12
138.68.178.64 attack
Brute%20Force%20SSH
2020-10-04 22:31:37
138.68.148.177 attack
DATE:2020-10-03 20:05:08, IP:138.68.148.177, PORT:ssh SSH brute force auth (docker-dc)
2020-10-04 04:04:27
138.68.148.177 attackbotsspam
Invalid user web from 138.68.148.177 port 50132
2020-10-03 20:06:41
138.68.150.93 attackspam
138.68.150.93 - - [01/Oct/2020:12:48:02 +0100] "POST /wp-login.php HTTP/1.1" 200 2252 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
138.68.150.93 - - [01/Oct/2020:12:48:03 +0100] "POST /wp-login.php HTTP/1.1" 200 2255 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
138.68.150.93 - - [01/Oct/2020:12:48:04 +0100] "POST /wp-login.php HTTP/1.1" 200 2204 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...
2020-10-02 05:01:01
138.68.176.38 attackbotsspam
2020-10-01T13:52:46.3242641495-001 sshd[6947]: Invalid user techuser from 138.68.176.38 port 43908
2020-10-01T13:52:47.9374071495-001 sshd[6947]: Failed password for invalid user techuser from 138.68.176.38 port 43908 ssh2
2020-10-01T13:55:43.7073231495-001 sshd[7097]: Invalid user socks from 138.68.176.38 port 56220
2020-10-01T13:55:43.7108621495-001 sshd[7097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.176.38
2020-10-01T13:55:43.7073231495-001 sshd[7097]: Invalid user socks from 138.68.176.38 port 56220
2020-10-01T13:55:45.6148271495-001 sshd[7097]: Failed password for invalid user socks from 138.68.176.38 port 56220 ssh2
...
2020-10-02 02:31:30
138.68.150.93 attackbotsspam
138.68.150.93 - - [01/Oct/2020:12:48:02 +0100] "POST /wp-login.php HTTP/1.1" 200 2252 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
138.68.150.93 - - [01/Oct/2020:12:48:03 +0100] "POST /wp-login.php HTTP/1.1" 200 2255 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
138.68.150.93 - - [01/Oct/2020:12:48:04 +0100] "POST /wp-login.php HTTP/1.1" 200 2204 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...
2020-10-01 21:19:24
138.68.150.93 attackbotsspam
138.68.150.93 - - [01/Oct/2020:05:40:26 +0100] "POST /wp-login.php HTTP/1.1" 200 2596 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
138.68.150.93 - - [01/Oct/2020:05:40:27 +0100] "POST /wp-login.php HTTP/1.1" 200 2580 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
138.68.150.93 - - [01/Oct/2020:05:40:28 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...
2020-10-01 13:34:15
138.68.106.62 attack
[ssh] SSH attack
2020-10-01 02:37:08
138.68.106.62 attackspam
Brute force attempt
2020-09-30 18:46:41
138.68.14.219 attackbots
Invalid user admin from 138.68.14.219 port 50376
2020-09-30 05:38:13
138.68.148.177 attackspambots
2020-09-29T10:39:26.1576871495-001 sshd[4600]: Failed password for invalid user internet from 138.68.148.177 port 58416 ssh2
2020-09-29T10:43:32.3590071495-001 sshd[4775]: Invalid user seco from 138.68.148.177 port 40074
2020-09-29T10:43:32.3619891495-001 sshd[4775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.148.177
2020-09-29T10:43:32.3590071495-001 sshd[4775]: Invalid user seco from 138.68.148.177 port 40074
2020-09-29T10:43:34.4990511495-001 sshd[4775]: Failed password for invalid user seco from 138.68.148.177 port 40074 ssh2
2020-09-29T10:47:48.2306251495-001 sshd[4918]: Invalid user angel from 138.68.148.177 port 49974
...
2020-09-30 05:07:07
WHOIS信息:
b
DIG信息:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 138.68.1.18
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 53616
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;138.68.1.18.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019082000 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Tue Aug 20 15:41:36 CST 2019
;; MSG SIZE  rcvd: 115
HOST信息:
Host 18.1.68.138.in-addr.arpa. not found: 3(NXDOMAIN)
NSLOOKUP信息:
Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 18.1.68.138.in-addr.arpa: NXDOMAIN
相关IP信息:
最新评论:
IP 类型 评论内容 时间
60.30.98.194 attackspam
" "
2020-08-10 06:26:21
13.74.181.214 attackbots
ɪᴍᴘʀᴏᴠᴇs sʟᴇᴇᴘ ǫᴜᴀʟɪᴛʏ
2020-08-10 06:12:48
167.99.75.240 attackbotsspam
SSH invalid-user multiple login attempts
2020-08-10 06:51:59
5.115.76.130 attackspam
1597004684 - 08/09/2020 22:24:44 Host: 5.115.76.130/5.115.76.130 Port: 445 TCP Blocked
2020-08-10 06:15:37
110.88.97.86 attack
Aug  6 18:22:03 myhostname sshd[23196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.88.97.86  user=r.r
Aug  6 18:22:05 myhostname sshd[23196]: Failed password for r.r from 110.88.97.86 port 15773 ssh2
Aug  6 18:22:07 myhostname sshd[23196]: Received disconnect from 110.88.97.86 port 15773:11: Bye Bye [preauth]
Aug  6 18:22:07 myhostname sshd[23196]: Disconnected from 110.88.97.86 port 15773 [preauth]
Aug  6 18:50:26 myhostname sshd[19726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=110.88.97.86  user=r.r
Aug  6 18:50:27 myhostname sshd[19726]: Failed password for r.r from 110.88.97.86 port 14235 ssh2
Aug  6 18:50:27 myhostname sshd[19726]: Received disconnect from 110.88.97.86 port 14235:11: Bye Bye [preauth]
Aug  6 18:50:27 myhostname sshd[19726]: Disconnected from 110.88.97.86 port 14235 [preauth]
Aug  6 18:52:21 myhostname sshd[21515]: pam_unix(sshd:auth): authentication fail........
-------------------------------
2020-08-10 06:38:17
103.226.250.28 attack
Automatic report - Banned IP Access
2020-08-10 06:50:35
183.14.135.209 attackbots
detected by Fail2Ban
2020-08-10 06:29:49
36.232.178.161 attackspambots
Automatic report - Port Scan Attack
2020-08-10 06:27:51
80.82.70.118 attack
firewall-block, port(s): 50/tcp
2020-08-10 06:17:45
188.126.89.4 attackbots
Brute forcing RDP port 3389
2020-08-10 06:40:08
138.255.148.35 attack
20 attempts against mh-ssh on echoip
2020-08-10 06:16:23
149.56.70.9 attack
Lines containing failures of 149.56.70.9 (max 1000)
Aug  7 06:41:24 HOSTNAME sshd[9462]: Failed password for invalid user r.r from 149.56.70.9 port 57486 ssh2
Aug  7 06:41:24 HOSTNAME sshd[9462]: Received disconnect from 149.56.70.9 port 57486:11: Bye Bye [preauth]
Aug  7 06:41:24 HOSTNAME sshd[9462]: Disconnected from 149.56.70.9 port 57486 [preauth]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=149.56.70.9
2020-08-10 06:44:55
115.23.48.47 attack
Aug  9 22:02:05 h2646465 sshd[22714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.23.48.47  user=root
Aug  9 22:02:07 h2646465 sshd[22714]: Failed password for root from 115.23.48.47 port 43404 ssh2
Aug  9 22:11:58 h2646465 sshd[24008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.23.48.47  user=root
Aug  9 22:12:00 h2646465 sshd[24008]: Failed password for root from 115.23.48.47 port 58854 ssh2
Aug  9 22:16:14 h2646465 sshd[24652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.23.48.47  user=root
Aug  9 22:16:16 h2646465 sshd[24652]: Failed password for root from 115.23.48.47 port 42066 ssh2
Aug  9 22:20:33 h2646465 sshd[25261]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.23.48.47  user=root
Aug  9 22:20:35 h2646465 sshd[25261]: Failed password for root from 115.23.48.47 port 53512 ssh2
Aug  9 22:24:46 h2646465 sshd[25417]
2020-08-10 06:12:11
121.122.81.195 attackbotsspam
2020-08-09T14:44:25.260363correo.[domain] sshd[43933]: Failed password for root from 121.122.81.195 port 12447 ssh2 2020-08-09T14:48:22.104524correo.[domain] sshd[44775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.122.81.195 user=root 2020-08-09T14:48:23.974918correo.[domain] sshd[44775]: Failed password for root from 121.122.81.195 port 48260 ssh2 ...
2020-08-10 06:29:27
222.186.180.142 attackbots
Aug 10 00:31:06 vps639187 sshd\[6977\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.142  user=root
Aug 10 00:31:08 vps639187 sshd\[6977\]: Failed password for root from 222.186.180.142 port 64812 ssh2
Aug 10 00:31:10 vps639187 sshd\[6977\]: Failed password for root from 222.186.180.142 port 64812 ssh2
...
2020-08-10 06:33:01

最近上报的IP列表

125.27.83.134 92.249.143.33 40.88.179.18 125.161.70.63
121.67.44.191 94.230.135.178 93.171.65.191 51.79.140.137
143.107.232.252 142.28.119.55 217.168.66.243 223.166.74.28
213.124.36.186 167.71.212.68 113.220.231.32 73.247.12.4
138.94.211.164 98.17.155.25 189.141.24.236 177.50.138.1