148.70.195.242

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): China

运营商(isp): Tencent Cloud Computing (Beijing) Co. Ltd

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Data Center/Web Hosting/Transit

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attack	Unauthorised connection attempt detected at AUO MAIN. System is sshd. Protected by AUO Stack Web Application Firewall (WAF)	2020-10-06 04:20:45
attackbots	Oct 5 09:41:58 haigwepa sshd[11877]: Failed password for root from 148.70.195.242 port 46034 ssh2 ...	2020-10-05 20:21:17
attackspambots	2020-10-05T05:17:32.709953billing sshd[28846]: Failed password for root from 148.70.195.242 port 60804 ssh2 2020-10-05T05:21:03.151556billing sshd[4309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 user=root 2020-10-05T05:21:05.243073billing sshd[4309]: Failed password for root from 148.70.195.242 port 60006 ssh2 ...	2020-10-05 12:12:21
attackspambots	148.70.195.242 (CN/China/-), 6 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Sep 18 04:08:09 jbs1 sshd[9437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.116.131.206 user=root Sep 18 04:08:11 jbs1 sshd[9437]: Failed password for root from 128.116.131.206 port 39270 ssh2 Sep 18 04:08:21 jbs1 sshd[9602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 user=root Sep 18 04:06:12 jbs1 sshd[8756]: Failed password for root from 77.27.168.117 port 42906 ssh2 Sep 18 04:06:03 jbs1 sshd[8703]: Failed password for root from 103.20.188.18 port 34532 ssh2 Sep 18 04:06:01 jbs1 sshd[8703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.20.188.18 user=root IP Addresses Blocked: 128.116.131.206 (IT/Italy/-)	2020-09-18 20:06:12
attackbots	Sep 18 05:33:51 hidden sshd[21839]: Failed password for hidden from 148.70.195.242 port 47348 ssh2 Sep 18 05:38:50 hidden sshd[22914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 user=root Sep 18 05:38:52 hidden sshd[22914]: Failed password for hidden from 148.70.195.242 port 56520 ssh2	2020-09-18 12:23:56
attackbotsspam	2020-08-06T17:20:55.674032amanda2.illicoweb.com sshd\[42403\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 user=root 2020-08-06T17:20:57.442968amanda2.illicoweb.com sshd\[42403\]: Failed password for root from 148.70.195.242 port 59918 ssh2 2020-08-06T17:24:29.829910amanda2.illicoweb.com sshd\[43392\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 user=root 2020-08-06T17:24:32.313093amanda2.illicoweb.com sshd\[43392\]: Failed password for root from 148.70.195.242 port 51366 ssh2 2020-08-06T17:28:01.099203amanda2.illicoweb.com sshd\[44207\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 user=root ...	2020-08-06 23:37:50
attackspambots	Jul 25 10:04:58 server1 sshd\[14446\]: Invalid user joe from 148.70.195.242 Jul 25 10:04:58 server1 sshd\[14446\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 Jul 25 10:04:59 server1 sshd\[14446\]: Failed password for invalid user joe from 148.70.195.242 port 59558 ssh2 Jul 25 10:07:44 server1 sshd\[15227\]: Invalid user lr from 148.70.195.242 Jul 25 10:07:44 server1 sshd\[15227\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 ...	2020-07-26 02:16:30
attackspam	Jul 23 19:18:02 tdfoods sshd\[19434\]: Invalid user minecraft from 148.70.195.242 Jul 23 19:18:02 tdfoods sshd\[19434\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 Jul 23 19:18:05 tdfoods sshd\[19434\]: Failed password for invalid user minecraft from 148.70.195.242 port 38150 ssh2 Jul 23 19:19:55 tdfoods sshd\[19585\]: Invalid user testmail from 148.70.195.242 Jul 23 19:19:55 tdfoods sshd\[19585\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242	2020-07-24 14:55:35
attack	Jul 23 09:28:48 NPSTNNYC01T sshd[6982]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 Jul 23 09:28:50 NPSTNNYC01T sshd[6982]: Failed password for invalid user team from 148.70.195.242 port 60996 ssh2 Jul 23 09:31:40 NPSTNNYC01T sshd[7273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.242 ...	2020-07-24 02:06:15
attackbotsspam	Fail2Ban - SSH Bruteforce Attempt	2020-07-23 17:17:39
attack	$f2bV_matches	2020-07-18 06:20:09

相同子网IP讨论:

IP	类型	评论内容	时间
148.70.195.54	attackspam	Jul 7 09:18:29 nextcloud sshd\[2095\]: Invalid user scs from 148.70.195.54 Jul 7 09:18:29 nextcloud sshd\[2095\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 Jul 7 09:18:31 nextcloud sshd\[2095\]: Failed password for invalid user scs from 148.70.195.54 port 39150 ssh2	2020-07-07 15:20:25
148.70.195.54	attackspambots	SSH Honeypot -> SSH Bruteforce / Login	2020-06-30 03:55:12
148.70.195.54	attackspam	Jun 21 14:12:02 odroid64 sshd\[14816\]: Invalid user jo from 148.70.195.54 Jun 21 14:12:02 odroid64 sshd\[14816\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 ...	2020-06-22 01:42:59
148.70.195.54	attackbotsspam	Jun 15 23:44:06 hosting sshd[1516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 user=root Jun 15 23:44:08 hosting sshd[1516]: Failed password for root from 148.70.195.54 port 35664 ssh2 ...	2020-06-16 05:32:39
148.70.195.54	attackspambots	Jun 14 08:52:10 ourumov-web sshd\[30601\]: Invalid user lookingout from 148.70.195.54 port 40914 Jun 14 08:52:10 ourumov-web sshd\[30601\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 Jun 14 08:52:13 ourumov-web sshd\[30601\]: Failed password for invalid user lookingout from 148.70.195.54 port 40914 ssh2 ...	2020-06-14 16:02:31
148.70.195.54	attack	$f2bV_matches	2020-04-26 13:26:39
148.70.195.54	attack	Invalid user admin from 148.70.195.54 port 36312	2020-04-21 22:00:41
148.70.195.54	attack	prod6 ...	2020-04-19 13:24:53
148.70.195.54	attackbots	5x Failed Password	2020-04-15 21:13:56
148.70.195.54	attackspambots	Apr 12 11:42:41 pve sshd[24655]: Failed password for root from 148.70.195.54 port 55342 ssh2 Apr 12 11:44:02 pve sshd[25792]: Failed password for root from 148.70.195.54 port 37438 ssh2 Apr 12 11:45:26 pve sshd[26956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54	2020-04-12 19:12:43
148.70.195.54	attackspambots	Mar 31 15:29:22 lukav-desktop sshd\[486\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 user=root Mar 31 15:29:24 lukav-desktop sshd\[486\]: Failed password for root from 148.70.195.54 port 44894 ssh2 Mar 31 15:32:06 lukav-desktop sshd\[507\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 user=root Mar 31 15:32:08 lukav-desktop sshd\[507\]: Failed password for root from 148.70.195.54 port 45156 ssh2 Mar 31 15:34:58 lukav-desktop sshd\[523\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 user=root	2020-03-31 20:56:00
148.70.195.54	attack	Mar 28 23:37:01 nextcloud sshd\[13642\]: Invalid user hum from 148.70.195.54 Mar 28 23:37:01 nextcloud sshd\[13642\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 Mar 28 23:37:03 nextcloud sshd\[13642\]: Failed password for invalid user hum from 148.70.195.54 port 35274 ssh2	2020-03-29 09:28:36
148.70.195.54	attackbots	Mar 27 05:51:40 plex sshd[4734]: Invalid user ltg from 148.70.195.54 port 60212	2020-03-27 14:51:00
148.70.195.54	attackbotsspam	Mar 19 01:58:55 master sshd[27239]: Failed password for invalid user nexus from 148.70.195.54 port 39068 ssh2 Mar 19 02:04:28 master sshd[27292]: Failed password for invalid user yaoyiming from 148.70.195.54 port 58596 ssh2 Mar 19 02:06:52 master sshd[27328]: Failed password for invalid user rstudio from 148.70.195.54 port 54896 ssh2 Mar 19 02:09:11 master sshd[27343]: Failed password for invalid user web1 from 148.70.195.54 port 51224 ssh2 Mar 19 02:11:28 master sshd[27357]: Failed password for invalid user abdullah from 148.70.195.54 port 47520 ssh2 Mar 19 02:13:42 master sshd[27367]: Failed password for invalid user informix from 148.70.195.54 port 43804 ssh2 Mar 19 02:18:29 master sshd[27420]: Failed password for root from 148.70.195.54 port 36442 ssh2 Mar 19 02:20:43 master sshd[27438]: Failed password for root from 148.70.195.54 port 60982 ssh2 Mar 19 02:27:42 master sshd[27505]: Failed password for root from 148.70.195.54 port 49952 ssh2	2020-03-19 08:19:10
148.70.195.54	attackspambots	Mar 10 06:26:26 sd-53420 sshd\[24172\]: Invalid user P@ssw0rd123456 from 148.70.195.54 Mar 10 06:26:26 sd-53420 sshd\[24172\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 Mar 10 06:26:28 sd-53420 sshd\[24172\]: Failed password for invalid user P@ssw0rd123456 from 148.70.195.54 port 46226 ssh2 Mar 10 06:31:33 sd-53420 sshd\[24702\]: Invalid user 123456 from 148.70.195.54 Mar 10 06:31:33 sd-53420 sshd\[24702\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.70.195.54 ...	2020-03-10 14:29:32

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 148.70.195.242
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48525
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;148.70.195.242.			IN	A

;; AUTHORITY SECTION:
.			202	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020071702 1800 900 604800 86400

;; Query time: 130 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Jul 18 06:20:06 CST 2020
;; MSG SIZE  rcvd: 118

HOST信息:

Host 242.195.70.148.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 242.195.70.148.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
14.185.226.49	attackspambots	2019-03-15 13:52:40 1h4mKF-0002Dt-Vc SMTP connection from $static.vnpt.vn$ \[14.185.226.49\]:16325 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-03-15 13:53:14 1h4mKo-0002Es-1C SMTP connection from $static.vnpt.vn$ \[14.185.226.49\]:16548 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-03-15 13:53:32 1h4mL5-0002F9-PB SMTP connection from $static.vnpt.vn$ \[14.185.226.49\]:16661 I=\[193.107.88.166\]:25 closed by DROP in ACL ...	2020-02-04 22:28:32
103.84.229.146	attackbotsspam	Feb 4 05:52:14 grey postfix/smtpd\[14724\]: NOQUEUE: reject: RCPT from unknown\[103.84.229.146\]: 554 5.7.1 Service unavailable\; Client host \[103.84.229.146\] blocked using cbl.abuseat.org\; Blocked - see http://www.abuseat.org/lookup.cgi\?ip=103.84.229.146\; from=\ to=\ proto=ESMTP helo=\<\[103.84.229.146\]\> ...	2020-02-04 21:43:48
149.129.145.64	attackbotsspam	Feb 4 14:53:03 vmanager6029 sshd\[2356\]: Invalid user ftp_user from 149.129.145.64 port 55262 Feb 4 14:53:03 vmanager6029 sshd\[2356\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=149.129.145.64 Feb 4 14:53:04 vmanager6029 sshd\[2356\]: Failed password for invalid user ftp_user from 149.129.145.64 port 55262 ssh2	2020-02-04 22:11:21
129.204.202.89	attackbotsspam	Feb 4 15:18:56 dedicated sshd[8010]: Invalid user hlw from 129.204.202.89 port 40076	2020-02-04 22:28:17
14.187.221.10	attackbotsspam	2019-06-22 15:11:51 1hefo3-00062S-7R SMTP connection from $static.vnpt.vn$ \[14.187.221.10\]:13152 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-06-22 15:12:26 1hefoe-00063E-J2 SMTP connection from $static.vnpt.vn$ \[14.187.221.10\]:13359 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-06-22 15:12:41 1hefou-00063U-70 SMTP connection from $static.vnpt.vn$ \[14.187.221.10\]:13455 I=\[193.107.88.166\]:25 closed by DROP in ACL ...	2020-02-04 22:15:47
14.205.133.249	attackbots	2019-03-11 19:07:24 1h3PKd-0003xe-6F SMTP connection from $\[14.205.131.78\]$ \[14.205.133.249\]:4105 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-03-11 19:07:30 1h3PKi-0003xl-JM SMTP connection from $\[14.205.131.78\]$ \[14.205.133.249\]:4109 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-03-11 19:07:34 1h3PKn-0003xp-6O SMTP connection from $\[14.205.131.78\]$ \[14.205.133.249\]:4363 I=\[193.107.88.166\]:25 closed by DROP in ACL ...	2020-02-04 22:03:54
14.200.176.176	attackspam	2019-06-21 16:10:05 1heKEt-0007Oi-NS SMTP connection from 14-200-176-176.static.tpgi.com.au \[14.200.176.176\]:23957 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-06-21 16:10:20 1heKF8-0007P6-Et SMTP connection from 14-200-176-176.static.tpgi.com.au \[14.200.176.176\]:24052 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-06-21 16:10:34 1heKFL-0007PF-VF SMTP connection from 14-200-176-176.static.tpgi.com.au \[14.200.176.176\]:24145 I=\[193.107.88.166\]:25 closed by DROP in ACL ...	2020-02-04 22:08:20
185.184.24.33	attackbots	Feb 4 03:49:03 web1 sshd\[29164\]: Invalid user marty from 185.184.24.33 Feb 4 03:49:03 web1 sshd\[29164\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.184.24.33 Feb 4 03:49:04 web1 sshd\[29164\]: Failed password for invalid user marty from 185.184.24.33 port 48062 ssh2 Feb 4 03:53:06 web1 sshd\[29520\]: Invalid user aquarius from 185.184.24.33 Feb 4 03:53:06 web1 sshd\[29520\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.184.24.33	2020-02-04 22:03:07
172.69.70.221	attackbotsspam	SQL injection:/newsites/free/pierre/search/searchSVI.php?continentName=EU+%27-6863+union+all+select+1,1,1,CONCAT(0x3a6f79753a,0x4244764877697569706b,0x3a70687a3a)1,1,1,1%23&country=276+&prj_typ=all&startdate=&enddate=&from=&page=1&searchSubmission=Recherche	2020-02-04 22:25:04
42.112.149.40	attackbotsspam	1580791926 - 02/04/2020 05:52:06 Host: 42.112.149.40/42.112.149.40 Port: 445 TCP Blocked	2020-02-04 21:51:15
112.85.42.188	attack	02/04/2020-09:25:00.408003 112.85.42.188 Protocol: 6 ET SCAN Potential SSH Scan	2020-02-04 22:26:24
14.187.148.134	attackbotsspam	2019-07-08 17:59:04 1hkW2g-00053y-GM SMTP connection from $static.vnpt.vn$ \[14.187.148.134\]:35656 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-07-08 17:59:26 1hkW32-00054I-AT SMTP connection from $static.vnpt.vn$ \[14.187.148.134\]:35783 I=\[193.107.88.166\]:25 closed by DROP in ACL 2019-07-08 17:59:37 1hkW3E-00054Y-FE SMTP connection from $static.vnpt.vn$ \[14.187.148.134\]:35855 I=\[193.107.88.166\]:25 closed by DROP in ACL ...	2020-02-04 22:17:42
189.252.17.146	attack	" "	2020-02-04 21:56:58
103.26.43.202	attack	Feb 4 15:15:26 dedicated sshd[7307]: Invalid user zabbix from 103.26.43.202 port 57934	2020-02-04 22:18:21
185.156.73.57	attackbotsspam	" "	2020-02-04 22:23:37

最近上报的IP列表

51.254.237.77	3.121.223.144	5.140.120.150	167.62.168.52
154.238.113.211	32.5.127.52	119.186.140.165	122.104.58.221
13.113.38.71	90.188.18.72	32.216.63.8	108.120.254.66
39.110.224.71	68.3.26.144	181.211.77.229	59.90.8.125
160.169.158.38	88.249.233.151	184.19.13.142	1.62.201.212