139.155.88.11 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): China

运营商(isp): Tencent Cloud Computing (Beijing) Co. Ltd.

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Data Center/Web Hosting/Transit

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackspam	Lines containing failures of 139.155.88.11 Aug 5 19:54:33 kmh-mb-001 sshd[28949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.88.11 user=r.r Aug 5 19:54:35 kmh-mb-001 sshd[28949]: Failed password for r.r from 139.155.88.11 port 58770 ssh2 Aug 5 19:54:37 kmh-mb-001 sshd[28949]: Received disconnect from 139.155.88.11 port 58770:11: Bye Bye [preauth] Aug 5 19:54:37 kmh-mb-001 sshd[28949]: Disconnected from authenticating user r.r 139.155.88.11 port 58770 [preauth] Aug 5 20:00:13 kmh-mb-001 sshd[29720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.88.11 user=r.r Aug 5 20:00:15 kmh-mb-001 sshd[29720]: Failed password for r.r from 139.155.88.11 port 49150 ssh2 Aug 5 20:00:17 kmh-mb-001 sshd[29720]: Received disconnect from 139.155.88.11 port 49150:11: Bye Bye [preauth] Aug 5 20:00:17 kmh-mb-001 sshd[29720]: Disconnected from authenticating user r.r 139.155.88.11 por........ ------------------------------	2020-08-09 02:33:38

类型

评论内容

时间

attackspam

Lines containing failures of 139.155.88.11
Aug  5 19:54:33 kmh-mb-001 sshd[28949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.88.11  user=r.r
Aug  5 19:54:35 kmh-mb-001 sshd[28949]: Failed password for r.r from 139.155.88.11 port 58770 ssh2
Aug  5 19:54:37 kmh-mb-001 sshd[28949]: Received disconnect from 139.155.88.11 port 58770:11: Bye Bye [preauth]
Aug  5 19:54:37 kmh-mb-001 sshd[28949]: Disconnected from authenticating user r.r 139.155.88.11 port 58770 [preauth]
Aug  5 20:00:13 kmh-mb-001 sshd[29720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.88.11  user=r.r
Aug  5 20:00:15 kmh-mb-001 sshd[29720]: Failed password for r.r from 139.155.88.11 port 49150 ssh2
Aug  5 20:00:17 kmh-mb-001 sshd[29720]: Received disconnect from 139.155.88.11 port 49150:11: Bye Bye [preauth]
Aug  5 20:00:17 kmh-mb-001 sshd[29720]: Disconnected from authenticating user r.r 139.155.88.11 por........
------------------------------

2020-08-09 02:33:38

相同子网IP讨论:

IP	类型	评论内容	时间
139.155.88.128	attackbotsspam	(mod_security) mod_security (id:240335) triggered by 139.155.88.128 (CN/China/-): 5 in the last 3600 secs	2020-08-31 06:21:24

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 139.155.88.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 32964
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;139.155.88.11.			IN	A

;; AUTHORITY SECTION:
.			285	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020080801 1800 900 604800 86400

;; Query time: 159 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Aug 09 02:33:35 CST 2020
;; MSG SIZE  rcvd: 117

HOST信息:

Host 11.88.155.139.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 11.88.155.139.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
141.98.80.150	attackbotsspam	Jun 27 22:15:14 relay postfix/smtpd\[8544\]: warning: unknown\[141.98.80.150\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jun 27 22:15:32 relay postfix/smtpd\[1434\]: warning: unknown\[141.98.80.150\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jun 27 22:19:44 relay postfix/smtpd\[8544\]: warning: unknown\[141.98.80.150\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jun 27 22:20:03 relay postfix/smtpd\[21099\]: warning: unknown\[141.98.80.150\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jun 27 22:22:44 relay postfix/smtpd\[8544\]: warning: unknown\[141.98.80.150\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ...	2020-06-28 04:32:14
49.232.100.177	attackbotsspam	$f2bV_matches \| Triggered by Fail2Ban at Vostok web server	2020-06-28 04:20:47
193.178.131.133	attackbots	Jun 27 21:48:21 * sshd[15118]: Failed password for news from 193.178.131.133 port 32936 ssh2	2020-06-28 04:31:34
117.53.40.215	attackbots	117.53.40.215 - - [27/Jun/2020:14:12:13 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" 117.53.40.215 - - [27/Jun/2020:14:13:38 +0200] "POST /xmlrpc.php HTTP/1.1" 403 5 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" ...	2020-06-28 04:39:56
172.69.71.46	attackspam	Apache - FakeGoogleBot	2020-06-28 04:14:52
185.220.102.7	attackspambots	Jun 27 20:55:26 mellenthin sshd[15577]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.220.102.7 user=root Jun 27 20:55:28 mellenthin sshd[15577]: Failed password for invalid user root from 185.220.102.7 port 42979 ssh2	2020-06-28 04:24:11
103.102.1.39	attackspambots	Repeated RDP login failures. Last user: User2	2020-06-28 04:38:10
182.141.234.98	attackbots	TCP (SYN) 182.141.234.98:30191 -> port 23, len 40	2020-06-28 04:31:57
103.145.12.179	attackbotsspam	ET SCAN Sipvicious Scan - port: 5060 proto: UDP cat: Attempted Information Leak	2020-06-28 04:25:02
46.38.150.132	attack	Jun 27 21:07:25 blackbee postfix/smtpd[11779]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: authentication failure Jun 27 21:08:08 blackbee postfix/smtpd[11779]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: authentication failure Jun 27 21:08:50 blackbee postfix/smtpd[11779]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: authentication failure Jun 27 21:09:33 blackbee postfix/smtpd[11766]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: authentication failure Jun 27 21:10:59 blackbee postfix/smtpd[11800]: warning: unknown[46.38.150.132]: SASL LOGIN authentication failed: authentication failure ...	2020-06-28 04:16:31
188.220.124.165	attack	Automatic report - XMLRPC Attack	2020-06-28 04:26:56
129.204.231.225	attackspam	Jun 26 16:07:07 myhostname sshd[3792]: Invalid user sk from 129.204.231.225 Jun 26 16:07:07 myhostname sshd[3792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.204.231.225 Jun 26 16:07:09 myhostname sshd[3792]: Failed password for invalid user sk from 129.204.231.225 port 55990 ssh2 Jun 26 16:07:09 myhostname sshd[3792]: Received disconnect from 129.204.231.225 port 55990:11: Bye Bye [preauth] Jun 26 16:07:09 myhostname sshd[3792]: Disconnected from 129.204.231.225 port 55990 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=129.204.231.225	2020-06-28 04:40:50
165.56.7.94	attackspam	Jun 27 22:38:09 server sshd[42464]: Failed password for invalid user transfer from 165.56.7.94 port 58256 ssh2 Jun 27 22:42:22 server sshd[46080]: Failed password for invalid user kouki from 165.56.7.94 port 57002 ssh2 Jun 27 22:46:29 server sshd[49450]: Failed password for invalid user alejandro from 165.56.7.94 port 55740 ssh2	2020-06-28 04:49:10
51.195.136.190	attack	srv02 SSH BruteForce Attacks 22 ..	2020-06-28 04:20:29
92.62.131.106	attackspam	(sshd) Failed SSH login from 92.62.131.106 (LT/Lithuania/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Jun 27 20:15:21 grace sshd[24270]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.62.131.106 user=root Jun 27 20:15:23 grace sshd[24270]: Failed password for root from 92.62.131.106 port 59691 ssh2 Jun 27 20:24:18 grace sshd[25135]: Invalid user tt from 92.62.131.106 port 59351 Jun 27 20:24:19 grace sshd[25135]: Failed password for invalid user tt from 92.62.131.106 port 59351 ssh2 Jun 27 20:27:19 grace sshd[25754]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.62.131.106 user=root	2020-06-28 04:32:55

最近上报的IP列表

104.215.188.101	20.253.163.145	13.117.113.252	97.168.153.114
208.129.212.111	34.82.14.142	175.173.74.39	64.227.61.176
186.125.171.245	52.169.18.169	138.59.146.242	14.115.29.0
87.116.191.175	220.134.90.138	195.150.48.46	188.173.39.3
187.162.44.90	78.131.119.79	178.46.215.20	170.244.135.86