196.0.113.214 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Uganda

运营商(isp): Uganda Telecom Ltd

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Mobile ISP

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackbots	Aug 27 11:46:39 mail.srvfarm.net postfix/smtpd[1519780]: warning: unknown[196.0.113.214]: SASL PLAIN authentication failed: Aug 27 11:46:40 mail.srvfarm.net postfix/smtpd[1519780]: lost connection after AUTH from unknown[196.0.113.214] Aug 27 11:49:24 mail.srvfarm.net postfix/smtpd[1519775]: warning: unknown[196.0.113.214]: SASL PLAIN authentication failed: Aug 27 11:49:25 mail.srvfarm.net postfix/smtpd[1519775]: lost connection after AUTH from unknown[196.0.113.214] Aug 27 11:55:49 mail.srvfarm.net postfix/smtpd[1519776]: warning: unknown[196.0.113.214]: SASL PLAIN authentication failed:	2020-08-28 07:06:13

类型

评论内容

时间

attackbots

Aug 27 11:46:39 mail.srvfarm.net postfix/smtpd[1519780]: warning: unknown[196.0.113.214]: SASL PLAIN authentication failed: 
Aug 27 11:46:40 mail.srvfarm.net postfix/smtpd[1519780]: lost connection after AUTH from unknown[196.0.113.214]
Aug 27 11:49:24 mail.srvfarm.net postfix/smtpd[1519775]: warning: unknown[196.0.113.214]: SASL PLAIN authentication failed: 
Aug 27 11:49:25 mail.srvfarm.net postfix/smtpd[1519775]: lost connection after AUTH from unknown[196.0.113.214]
Aug 27 11:55:49 mail.srvfarm.net postfix/smtpd[1519776]: warning: unknown[196.0.113.214]: SASL PLAIN authentication failed:

2020-08-28 07:06:13

相同子网IP讨论:

IP	类型	评论内容	时间
196.0.113.246	attack	(smtpauth) Failed SMTP AUTH login from 196.0.113.246 (UG/Uganda/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-09-08 21:19:38 plain authenticator failed for ([196.0.113.246]) [196.0.113.246]: 535 Incorrect authentication data (set_id=md)	2020-09-10 01:19:32
196.0.113.10	attack	spam	2020-08-25 19:25:05
196.0.113.10	attackspam	spam	2020-08-17 18:47:02
196.0.113.10	attack	Dovecot Invalid User Login Attempt.	2020-08-10 04:37:13
196.0.113.182	attackbots	Jul 24 09:33:39 mail.srvfarm.net postfix/smtps/smtpd[2158500]: warning: unknown[196.0.113.182]: SASL PLAIN authentication failed: Jul 24 09:33:39 mail.srvfarm.net postfix/smtps/smtpd[2158500]: lost connection after AUTH from unknown[196.0.113.182] Jul 24 09:34:32 mail.srvfarm.net postfix/smtps/smtpd[2158141]: warning: unknown[196.0.113.182]: SASL PLAIN authentication failed: Jul 24 09:34:32 mail.srvfarm.net postfix/smtps/smtpd[2158141]: lost connection after AUTH from unknown[196.0.113.182] Jul 24 09:35:23 mail.srvfarm.net postfix/smtps/smtpd[2158141]: warning: unknown[196.0.113.182]: SASL PLAIN authentication failed:	2020-07-25 03:43:03
196.0.113.10	attack	bruteforce detected	2020-07-11 17:23:54
196.0.113.230	attackspam	Brute force attempt	2020-06-16 13:59:01
196.0.113.230	attackbots	(UG/Uganda/-) SMTP Bruteforcing attempts	2020-06-05 18:46:27
196.0.113.110	attack	Brute force attempt	2020-06-04 01:14:28
196.0.113.10	attackbotsspam	[ER hit] Tried to deliver spam. Already well known.	2019-12-19 19:18:32
196.0.113.10	attack	Brute force attack stopped by firewall	2019-12-12 09:14:29
196.0.113.10	attackspambots	proto=tcp . spt=35888 . dpt=25 . (Found on Dark List de Nov 08) (253)	2019-11-08 22:39:41
196.0.113.10	attack	proto=tcp . spt=49097 . dpt=25 . (listed on Blocklist de Aug 04) (698)	2019-08-05 14:34:31
196.0.113.90	attack	[SMB remote code execution attempt: port tcp/445] *(RWIN=1024)(08041230)	2019-08-05 01:40:01
196.0.113.10	attackspam	proto=tcp . spt=56084 . dpt=25 . (listed on Github Combined on 3 lists ) (588)	2019-07-18 08:35:40

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 196.0.113.214
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28407
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;196.0.113.214.			IN	A

;; AUTHORITY SECTION:
.			422	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020082702 1800 900 604800 86400

;; Query time: 66 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Aug 28 07:06:09 CST 2020
;; MSG SIZE  rcvd: 117

HOST信息:

Host 214.113.0.196.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 214.113.0.196.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
183.99.77.161	attackbotsspam	Dec 16 13:18:31 MK-Soft-Root2 sshd[25293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.99.77.161 Dec 16 13:18:33 MK-Soft-Root2 sshd[25293]: Failed password for invalid user suoh from 183.99.77.161 port 29350 ssh2 ...	2019-12-16 21:14:55
196.43.171.28	attackbotsspam	SMB Server BruteForce Attack	2019-12-16 21:11:05
74.141.132.233	attackbotsspam	--- report --- Dec 16 07:51:27 sshd: Connection from 74.141.132.233 port 49440 Dec 16 07:51:27 sshd: Invalid user telos from 74.141.132.233 Dec 16 07:51:30 sshd: Failed password for invalid user telos from 74.141.132.233 port 49440 ssh2 Dec 16 07:51:30 sshd: Received disconnect from 74.141.132.233: 11: Bye Bye [preauth]	2019-12-16 21:08:29
202.230.143.53	attackbotsspam	Dec 16 02:18:53 plusreed sshd[775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.230.143.53 user=mysql Dec 16 02:18:55 plusreed sshd[775]: Failed password for mysql from 202.230.143.53 port 35552 ssh2 ...	2019-12-16 20:59:59
77.81.106.247	attackbots	2019-12-16 x@x 2019-12-16 x@x 2019-12-16 x@x ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=77.81.106.247	2019-12-16 20:58:39
125.160.204.190	attack	1576477420 - 12/16/2019 07:23:40 Host: 125.160.204.190/125.160.204.190 Port: 445 TCP Blocked	2019-12-16 21:24:29
157.33.16.244	attack	1576477452 - 12/16/2019 07:24:12 Host: 157.33.16.244/157.33.16.244 Port: 445 TCP Blocked	2019-12-16 20:57:16
54.38.136.87	attack	2019-12-16 07:23:55 H=contato03.juridicorenovacob.be [54.38.136.87] sender verify fail for : all relevant MX records point to non-existent hosts 2019-12-16 07:23:55 H=contato03.juridicorenovacob.be [54.38.136.87] F= rejected RCPT : Sender verify failed ...	2019-12-16 21:09:41
95.78.171.17	attackspam	Unauthorized access or intrusion attempt detected from Bifur banned IP	2019-12-16 20:56:21
97.68.225.36	attackbotsspam	Dec 16 13:45:37 loxhost sshd\[30191\]: Invalid user dybdal from 97.68.225.36 port 53924 Dec 16 13:45:37 loxhost sshd\[30191\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.68.225.36 Dec 16 13:45:39 loxhost sshd\[30191\]: Failed password for invalid user dybdal from 97.68.225.36 port 53924 ssh2 Dec 16 13:51:53 loxhost sshd\[30309\]: Invalid user tredal from 97.68.225.36 port 34210 Dec 16 13:51:53 loxhost sshd\[30309\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=97.68.225.36 ...	2019-12-16 21:14:28
165.22.58.247	attack	Dec 16 11:50:33 tux-35-217 sshd\[6158\]: Invalid user admin from 165.22.58.247 port 44864 Dec 16 11:50:33 tux-35-217 sshd\[6158\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.58.247 Dec 16 11:50:35 tux-35-217 sshd\[6158\]: Failed password for invalid user admin from 165.22.58.247 port 44864 ssh2 Dec 16 11:57:00 tux-35-217 sshd\[6222\]: Invalid user os from 165.22.58.247 port 51350 Dec 16 11:57:00 tux-35-217 sshd\[6222\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.58.247 ...	2019-12-16 21:26:32
138.68.82.220	attack	Dec 16 11:51:52 herz-der-gamer sshd[6517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.82.220 user=mysql Dec 16 11:51:54 herz-der-gamer sshd[6517]: Failed password for mysql from 138.68.82.220 port 41888 ssh2 ...	2019-12-16 21:35:50
117.216.143.18	attackspambots	Unauthorized connection attempt detected from IP address 117.216.143.18 to port 445	2019-12-16 21:08:16
40.92.70.64	attackbotsspam	Dec 16 09:55:26 debian-2gb-vpn-nbg1-1 kernel: [857696.150781] [UFW BLOCK] IN=eth0 OUT= MAC=96:00:00:38:96:44:d2:74:7f:6e:37:e3:08:00 SRC=40.92.70.64 DST=78.46.192.101 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=64665 DF PROTO=TCP SPT=5073 DPT=25 WINDOW=0 RES=0x00 ACK RST URGP=0	2019-12-16 21:01:41
106.12.217.180	attackbots	Invalid user vasintha from 106.12.217.180 port 59426	2019-12-16 21:08:57

最近上报的IP列表

91.83.161.107	89.203.142.10	100.228.60.245	45.239.143.31
45.230.231.71	45.227.98.230	45.176.214.15	45.176.213.170
45.123.0.240	45.6.27.165	41.139.28.165	217.98.79.148
207.202.21.10	207.248.113.105	203.100.77.117	195.245.204.31
191.241.160.153	191.53.194.112	191.53.105.225	181.114.208.185