139.180.216.190

基本信息:

城市(city): Singapore

省份(region): unknown

国家(country): Singapore

运营商(isp): Choopa LLC

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Data Center/Web Hosting/Transit

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attack	[Wed Nov 06 13:27:53.600569 2019] [:error] [pid 682:tid 140114221315840] [client 139.180.216.190:39314] [client 139.180.216.190] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XcJn6R0WPDkEpcCzdXYvVQAAAAI"] ...	2019-11-06 16:32:25

类型

评论内容

时间

attack

[Wed Nov 06 13:27:53.600569 2019] [:error] [pid 682:tid 140114221315840] [client 139.180.216.190:39314] [client 139.180.216.190] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XcJn6R0WPDkEpcCzdXYvVQAAAAI"]
...

2019-11-06 16:32:25

相同子网IP讨论:

IP	类型	评论内容	时间
139.180.216.224	attackbotsspam	xmlrpc attack	2020-07-18 19:43:14
139.180.216.224	attackspambots	Wordpress login scanning	2020-07-13 01:45:50
139.180.216.224	attackbotsspam	HTTP DDOS	2020-06-20 13:13:15
139.180.216.224	attackbots	10 attempts against mh-misc-ban on heat	2020-06-14 00:12:38
139.180.216.224	attackbots	Automatic report - XMLRPC Attack	2020-06-06 22:58:38

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 139.180.216.190
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 34820
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;139.180.216.190.		IN	A

;; AUTHORITY SECTION:
.			426	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019110600 1800 900 604800 86400

;; Query time: 62 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Nov 06 16:32:22 CST 2019
;; MSG SIZE  rcvd: 119

HOST信息:

190.216.180.139.in-addr.arpa domain name pointer 139.180.216.190.vultr.com.

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
190.216.180.139.in-addr.arpa	name = 139.180.216.190.vultr.com.

Authoritative answers can be found from:

最新评论:

IP	类型	评论内容	时间
112.10.231.170	attackbots	[Wed Aug 28 23:00:25 2019 GMT] 裘贤雯 [RDNS_NONE], Subject: 《全能型车间主任实战技能训练》——制造管	2019-08-29 16:14:56
46.101.39.199	attackspambots	[ssh] SSH attack	2019-08-29 16:04:00
188.166.149.3	attack	2019-08-29T08:02:18.002438abusebot-7.cloudsearch.cf sshd\[24110\]: Invalid user nao from 188.166.149.3 port 34656	2019-08-29 16:24:25
128.199.253.133	attack	Invalid user xmodem from 128.199.253.133 port 42110	2019-08-29 15:55:18
175.21.109.165	attackspam	Unauthorised access (Aug 29) SRC=175.21.109.165 LEN=40 TTL=49 ID=2308 TCP DPT=8080 WINDOW=54791 SYN	2019-08-29 15:46:24
54.39.148.233	attackbots	Aug 29 11:43:43 webhost01 sshd[23711]: Failed password for root from 54.39.148.233 port 52574 ssh2 Aug 29 11:43:57 webhost01 sshd[23711]: error: maximum authentication attempts exceeded for root from 54.39.148.233 port 52574 ssh2 [preauth] ...	2019-08-29 16:28:29
187.58.65.21	attack	Aug 28 16:56:59 tdfoods sshd\[6957\]: Invalid user bots from 187.58.65.21 Aug 28 16:56:59 tdfoods sshd\[6957\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21 Aug 28 16:57:01 tdfoods sshd\[6957\]: Failed password for invalid user bots from 187.58.65.21 port 23587 ssh2 Aug 28 17:01:56 tdfoods sshd\[7420\]: Invalid user export from 187.58.65.21 Aug 28 17:01:56 tdfoods sshd\[7420\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.58.65.21	2019-08-29 16:26:33
139.59.26.115	attackbotsspam	Aug 29 09:01:34 rotator sshd\[21126\]: Invalid user ejames from 139.59.26.115Aug 29 09:01:37 rotator sshd\[21126\]: Failed password for invalid user ejames from 139.59.26.115 port 44228 ssh2Aug 29 09:06:19 rotator sshd\[21899\]: Invalid user r from 139.59.26.115Aug 29 09:06:21 rotator sshd\[21899\]: Failed password for invalid user r from 139.59.26.115 port 34072 ssh2Aug 29 09:11:12 rotator sshd\[22688\]: Invalid user snow from 139.59.26.115Aug 29 09:11:14 rotator sshd\[22688\]: Failed password for invalid user snow from 139.59.26.115 port 52142 ssh2 ...	2019-08-29 15:54:39
45.115.178.195	attack	Aug 29 09:02:55 MK-Soft-Root2 sshd\[3100\]: Invalid user lori from 45.115.178.195 port 45610 Aug 29 09:02:55 MK-Soft-Root2 sshd\[3100\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.115.178.195 Aug 29 09:02:57 MK-Soft-Root2 sshd\[3100\]: Failed password for invalid user lori from 45.115.178.195 port 45610 ssh2 ...	2019-08-29 15:56:56
85.37.38.195	attackbotsspam	$f2bV_matches_ltvn	2019-08-29 15:54:11
190.210.42.209	attackspam	Aug 28 21:50:18 php2 sshd\[20582\]: Invalid user tabris from 190.210.42.209 Aug 28 21:50:18 php2 sshd\[20582\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.210.42.209 Aug 28 21:50:19 php2 sshd\[20582\]: Failed password for invalid user tabris from 190.210.42.209 port 29982 ssh2 Aug 28 21:55:49 php2 sshd\[21378\]: Invalid user rk from 190.210.42.209 Aug 28 21:55:49 php2 sshd\[21378\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.210.42.209	2019-08-29 16:29:50
85.206.165.15	attackspam	(From zubair_ffc@yahoo.com) Look at an astonishingoffering for you. http://zanmissmetear.tk/et06	2019-08-29 15:56:35
201.54.31.14	attackspambots	email spam	2019-08-29 16:14:18
193.124.186.111	attackspam	Aug 29 08:57:21 debian sshd\[8988\]: Invalid user guest from 193.124.186.111 port 47798 Aug 29 08:57:21 debian sshd\[8988\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.124.186.111 ...	2019-08-29 16:11:25
185.175.93.104	attack	08/29/2019-03:02:27.296197 185.175.93.104 Protocol: 6 ET SCAN NMAP -sS window 1024	2019-08-29 16:25:11

最近上报的IP列表

14.0.155.30	217.198.124.106	46.38.155.119	211.232.41.58
45.136.109.174	195.154.179.110	185.117.120.26	209.97.188.148
54.236.1.18	139.219.5.139	45.143.220.34	66.249.66.206
45.14.49.211	79.118.55.116	157.52.255.116	36.22.108.44
106.12.84.209	175.142.220.232	129.204.36.144	104.244.76.230