194.39.196.42 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Poland

运营商(isp): Zibed

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Commercial

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackspam	Sep 7 11:20:13 mail.srvfarm.net postfix/smtpd[1028351]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: Sep 7 11:20:14 mail.srvfarm.net postfix/smtpd[1028351]: lost connection after AUTH from unknown[194.39.196.42] Sep 7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: Sep 7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: lost connection after AUTH from unknown[194.39.196.42] Sep 7 11:29:45 mail.srvfarm.net postfix/smtpd[1028343]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed:	2020-09-12 03:00:59
attackbots	Sep 7 11:20:13 mail.srvfarm.net postfix/smtpd[1028351]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: Sep 7 11:20:14 mail.srvfarm.net postfix/smtpd[1028351]: lost connection after AUTH from unknown[194.39.196.42] Sep 7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: Sep 7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: lost connection after AUTH from unknown[194.39.196.42] Sep 7 11:29:45 mail.srvfarm.net postfix/smtpd[1028343]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed:	2020-09-11 18:59:50
attack	Aug 16 05:34:17 mail.srvfarm.net postfix/smtpd[1888509]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: Aug 16 05:34:17 mail.srvfarm.net postfix/smtpd[1888509]: lost connection after AUTH from unknown[194.39.196.42] Aug 16 05:39:10 mail.srvfarm.net postfix/smtpd[1907805]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: Aug 16 05:39:10 mail.srvfarm.net postfix/smtpd[1907805]: lost connection after AUTH from unknown[194.39.196.42] Aug 16 05:42:47 mail.srvfarm.net postfix/smtps/smtpd[1906553]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed:	2020-08-16 12:17:35

类型

评论内容

时间

attackspam

Sep  7 11:20:13 mail.srvfarm.net postfix/smtpd[1028351]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: 
Sep  7 11:20:14 mail.srvfarm.net postfix/smtpd[1028351]: lost connection after AUTH from unknown[194.39.196.42]
Sep  7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: 
Sep  7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: lost connection after AUTH from unknown[194.39.196.42]
Sep  7 11:29:45 mail.srvfarm.net postfix/smtpd[1028343]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed:

2020-09-12 03:00:59

attackbots

Sep  7 11:20:13 mail.srvfarm.net postfix/smtpd[1028351]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: 
Sep  7 11:20:14 mail.srvfarm.net postfix/smtpd[1028351]: lost connection after AUTH from unknown[194.39.196.42]
Sep  7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: 
Sep  7 11:23:44 mail.srvfarm.net postfix/smtps/smtpd[1026476]: lost connection after AUTH from unknown[194.39.196.42]
Sep  7 11:29:45 mail.srvfarm.net postfix/smtpd[1028343]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed:

2020-09-11 18:59:50

attack

Aug 16 05:34:17 mail.srvfarm.net postfix/smtpd[1888509]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: 
Aug 16 05:34:17 mail.srvfarm.net postfix/smtpd[1888509]: lost connection after AUTH from unknown[194.39.196.42]
Aug 16 05:39:10 mail.srvfarm.net postfix/smtpd[1907805]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed: 
Aug 16 05:39:10 mail.srvfarm.net postfix/smtpd[1907805]: lost connection after AUTH from unknown[194.39.196.42]
Aug 16 05:42:47 mail.srvfarm.net postfix/smtps/smtpd[1906553]: warning: unknown[194.39.196.42]: SASL PLAIN authentication failed:

2020-08-16 12:17:35

相同子网IP讨论:

IP	类型	评论内容	时间
194.39.196.27	attackspam	SASL PLAIN auth failed: ruser=...	2020-09-10 01:18:42

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 194.39.196.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 56410
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;194.39.196.42.			IN	A

;; AUTHORITY SECTION:
.			152	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020081501 1800 900 604800 86400

;; Query time: 47 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Aug 16 12:17:28 CST 2020
;; MSG SIZE  rcvd: 117

HOST信息:

42.196.39.194.in-addr.arpa domain name pointer 194-39-196-42.ipv4.krusz-lan.pl.

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
42.196.39.194.in-addr.arpa	name = 194-39-196-42.ipv4.krusz-lan.pl.

Authoritative answers can be found from:

最新评论:

IP	类型	评论内容	时间
52.251.39.67	attackspambots	\[Oct 5 06:34:55\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed for '52.251.39.67:5346' - Wrong password \[Oct 5 06:34:56\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed for '52.251.39.67:5346' - Wrong password \[Oct 5 06:34:56\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed for '52.251.39.67:5346' - Wrong password \[Oct 5 06:34:56\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed for '52.251.39.67:5346' - Wrong password \[Oct 5 06:34:56\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed for '52.251.39.67:5346' - Wrong password \[Oct 5 06:34:56\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed for '52.251.39.67:5346' - Wrong password \[Oct 5 06:34:56\] NOTICE\[31025\] chan_sip.c: Registration from '"3" \' failed ...	2020-10-05 03:48:09
37.193.25.147	attackbotsspam	Oct 4 15:24:29 vpn01 sshd[7807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.193.25.147 Oct 4 15:24:30 vpn01 sshd[7807]: Failed password for invalid user nitin from 37.193.25.147 port 48396 ssh2 ...	2020-10-05 04:08:21
185.202.1.104	attack	Repeated RDP login failures. Last user: Administrator	2020-10-05 04:01:58
123.127.198.100	attackbotsspam	Oct 4 21:36:28 DAAP sshd[1154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.127.198.100 user=root Oct 4 21:36:30 DAAP sshd[1154]: Failed password for root from 123.127.198.100 port 39420 ssh2 Oct 4 21:38:58 DAAP sshd[1196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.127.198.100 user=root Oct 4 21:39:00 DAAP sshd[1196]: Failed password for root from 123.127.198.100 port 30459 ssh2 Oct 4 21:41:31 DAAP sshd[1298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.127.198.100 user=root Oct 4 21:41:33 DAAP sshd[1298]: Failed password for root from 123.127.198.100 port 41443 ssh2 ...	2020-10-05 04:22:31
172.104.108.109	attack	srvr1: (mod_security) mod_security (id:920350) triggered by 172.104.108.109 (US/-/scan-92.security.ipip.net): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/10/04 19:47:33 [error] 246777#0: 198802 [client 172.104.108.109] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "160183365376.869714"] [ref "o0,13v21,13"], client: 172.104.108.109, [redacted] request: "GET / HTTP/1.1" [redacted]	2020-10-05 03:53:39
104.248.123.197	attack	Sep 30 08:32:58 roki-contabo sshd\[2298\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.123.197 user=root Sep 30 08:33:00 roki-contabo sshd\[2298\]: Failed password for root from 104.248.123.197 port 47318 ssh2 Sep 30 08:42:37 roki-contabo sshd\[2394\]: Invalid user ian from 104.248.123.197 Sep 30 08:42:37 roki-contabo sshd\[2394\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.123.197 Sep 30 08:42:39 roki-contabo sshd\[2394\]: Failed password for invalid user ian from 104.248.123.197 port 56104 ssh2 ...	2020-10-05 04:10:54
193.169.254.38	attack	2020-10-04T13:39:23Z - RDP login failed multiple times. (193.169.254.38)	2020-10-05 04:00:58
59.27.124.26	attack	SSH brute-force attack detected from [59.27.124.26]	2020-10-05 03:52:20
117.62.175.61	attack	Total attacks: 2	2020-10-05 04:10:41
192.35.168.32	attack	ZGrab Application Layer Scanner Detection	2020-10-05 04:23:48
191.5.102.102	attackbots	Oct 4 09:02:09 lnxweb62 sshd[11066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.5.102.102 Oct 4 09:02:11 lnxweb62 sshd[11066]: Failed password for invalid user admin from 191.5.102.102 port 58906 ssh2 Oct 4 09:02:15 lnxweb62 sshd[11110]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.5.102.102	2020-10-05 04:24:04
69.39.239.21	attackspambots	Automatic report - Banned IP Access	2020-10-05 04:08:02
199.227.138.238	attackspambots	"Unauthorized connection attempt on SSHD detected"	2020-10-05 03:49:09
91.231.83.67	attackbots	Bruteforce detected by fail2ban	2020-10-05 03:51:22
218.92.0.133	attack	Oct 4 20:50:03 mavik sshd[24241]: Failed password for root from 218.92.0.133 port 27832 ssh2 Oct 4 20:50:06 mavik sshd[24241]: Failed password for root from 218.92.0.133 port 27832 ssh2 Oct 4 20:50:10 mavik sshd[24241]: Failed password for root from 218.92.0.133 port 27832 ssh2 Oct 4 20:50:13 mavik sshd[24241]: Failed password for root from 218.92.0.133 port 27832 ssh2 Oct 4 20:50:16 mavik sshd[24241]: Failed password for root from 218.92.0.133 port 27832 ssh2 ...	2020-10-05 03:50:35

最近上报的IP列表

82.177.202.99	81.163.14.44	81.161.67.131	80.82.155.100
80.48.33.246	46.231.79.178	45.239.143.100	45.227.98.228
45.181.164.116	45.179.189.26	45.176.215.108	45.172.99.197
45.160.130.42	2002:c1a9:fd89::c1a9:fd89	2002:c1a9:fd88::c1a9:fd88	2002:c1a9:fd80::c1a9:fd80
2002:b9ea:db0d::b9ea:db0d	158.63.253.215	2002:b9ea:d997::b9ea:d997	5.190.187.190