197.221.254.2 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Zimbabwe

运营商(isp): Telone Pvt Ltd

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): unknown

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackspambots	Lines containing failures of 197.221.254.2 Jul 13 16:57:36 mellenthin postfix/smtpd[5323]: connect from unknown[197.221.254.2] Jul x@x Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: lost connection after DATA from unknown[197.221.254.2] Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: disconnect from unknown[197.221.254.2] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=197.221.254.2	2019-07-14 08:02:14

类型

评论内容

时间

attackspambots

Lines containing failures of 197.221.254.2
Jul 13 16:57:36 mellenthin postfix/smtpd[5323]: connect from unknown[197.221.254.2]
Jul x@x
Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: lost connection after DATA from unknown[197.221.254.2]
Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: disconnect from unknown[197.221.254.2] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.2

2019-07-14 08:02:14

相同子网IP讨论:

IP	类型	评论内容	时间
197.221.254.22	attack	Port Scan detected! ...	2020-07-14 08:05:45
197.221.254.235	attack	Logged onto my email	2020-07-05 03:55:10
197.221.254.235	attackspam	"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:	2020-05-29 06:30:57
197.221.254.79	attack	Fail2Ban - HTTP Auth Bruteforce Attempt	2020-05-12 05:24:46
197.221.254.176	attackbotsspam	2019-03-12 20:37:49 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25129 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed 2019-03-12 20:38:40 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25137 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed 2019-03-12 20:39:11 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25138 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed ...	2020-01-30 04:45:43
197.221.254.63	attack	Unauthorized connection attempt detected from IP address 197.221.254.63 to port 445	2019-12-11 21:32:25
197.221.254.96	attack	2019-11-20 14:13:49 H=(16.96.telone.co.zw) [197.221.254.96]:6050 I=[10.100.18.22]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.96) 2019-11-20 14:13:49 unexpected disconnection while reading SMTP command from (16.96.telone.co.zw) [197.221.254.96]:6050 I=[10.100.18.22]:25 (error: Connection reset by peer) 2019-11-20 15:33:34 H=(16.96.telone.co.zw) [197.221.254.96]:6523 I=[10.100.18.22]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.96) ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=197.221.254.96	2019-11-21 00:42:21
197.221.254.6	attackspambots	2019-11-20 15:12:24 H=(16.6.telone.co.zw) [197.221.254.6]:31578 I=[10.100.18.25]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.6) 2019-11-20 15:12:25 unexpected disconnection while reading SMTP command from (16.6.telone.co.zw) [197.221.254.6]:31578 I=[10.100.18.25]:25 (error: Connection reset by peer) 2019-11-20 15:29:34 H=(16.6.telone.co.zw) [197.221.254.6]:31622 I=[10.100.18.25]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.6) ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=197.221.254.6	2019-11-20 22:54:01
197.221.254.40	attack	firewall-block, port(s): 1433/tcp	2019-11-20 00:40:13
197.221.254.172	attackspambots	Hello! As you may have noticed, I sent you an email from your account. This means that I have full access to your device. I've been watching you for a few months now. The fact is that you were infected with malware through an adult site that you visited. If you are not familiar with this, I will explain. Trojan Virus gives me full access and control over a computer or other device. This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it. I also have access to all your contacts and all your correspondence. Why your antivirus did not detect malware? Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent. I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched. With one click of the mouse, I can send this video to all your emails and contacts on social networks...	2019-10-13 06:30:27
197.221.254.157	attack	Spam	2019-08-14 23:36:14

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 197.221.254.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18659
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;197.221.254.2.			IN	A

;; AUTHORITY SECTION:
.			2356	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071301 1800 900 604800 86400

;; Query time: 1 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sun Jul 14 08:02:07 CST 2019
;; MSG SIZE  rcvd: 117

HOST信息:

2.254.221.197.in-addr.arpa domain name pointer 16.2.telone.co.zw.

NSLOOKUP信息:

Server:		67.207.67.2
Address:	67.207.67.2#53

Non-authoritative answer:
2.254.221.197.in-addr.arpa	name = 16.2.telone.co.zw.

Authoritative answers can be found from:

最新评论:

IP	类型	评论内容	时间
51.91.177.246	attack	Scanned 311 unique addresses for 2 unique TCP ports in 24 hours (ports 24296,24902)	2020-06-25 00:43:52
183.134.89.199	attack	srv02 Mass scanning activity detected Target: 23182 ..	2020-06-25 00:43:03
71.6.232.4	attack	Unauthorized connection attempt detected from IP address 71.6.232.4 to port 80	2020-06-25 00:15:56
218.92.0.212	attackbotsspam	Jun 24 18:07:09 neko-world sshd[3179]: Failed none for invalid user root from 218.92.0.212 port 56100 ssh2 Jun 24 18:07:16 neko-world sshd[3179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212 user=root	2020-06-25 00:34:30
200.114.220.136	attackbots	Port probing on unauthorized port 2323	2020-06-25 00:11:11
36.27.30.149	attack	Jun 24 13:41:36 mail.srvfarm.net postfix/smtpd[1231808]: warning: unknown[36.27.30.149]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jun 24 13:41:41 mail.srvfarm.net postfix/smtpd[1231808]: lost connection after AUTH from unknown[36.27.30.149] Jun 24 13:41:52 mail.srvfarm.net postfix/smtpd[1231816]: warning: unknown[36.27.30.149]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Jun 24 13:41:52 mail.srvfarm.net postfix/smtpd[1231816]: lost connection after AUTH from unknown[36.27.30.149] Jun 24 13:42:07 mail.srvfarm.net postfix/smtpd[1231814]: warning: unknown[36.27.30.149]: SASL LOGIN authentication failed: UGFzc3dvcmQ6	2020-06-25 00:47:00
190.14.248.108	attack	Scanned 307 unique addresses for 2 unique TCP ports in 24 hours (ports 5596,12242)	2020-06-25 00:37:28
212.70.149.2	attackbotsspam	Repeated brute force against postfix-sasl	2020-06-25 00:45:57
161.35.15.136	attackspam	Lines containing failures of 161.35.15.136 Jun 24 13:39:13 shared09 sshd[25279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.15.136 user=r.r Jun 24 13:39:15 shared09 sshd[25279]: Failed password for r.r from 161.35.15.136 port 38730 ssh2 Jun 24 13:39:15 shared09 sshd[25279]: Received disconnect from 161.35.15.136 port 38730:11: Bye Bye [preauth] Jun 24 13:39:15 shared09 sshd[25279]: Disconnected from authenticating user r.r 161.35.15.136 port 38730 [preauth] Jun 24 13:43:07 shared09 sshd[26821]: Invalid user hudson from 161.35.15.136 port 40492 Jun 24 13:43:07 shared09 sshd[26821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.35.15.136 Jun 24 13:43:08 shared09 sshd[26821]: Failed password for invalid user hudson from 161.35.15.136 port 40492 ssh2 Jun 24 13:43:08 shared09 sshd[26821]: Received disconnect from 161.35.15.136 port 40492:11: Bye Bye [preauth] Jun 24 13:43:08 sha........ ------------------------------	2020-06-25 00:40:09
223.207.221.139	attackbotsspam	Automatic report - XMLRPC Attack	2020-06-25 00:27:33
91.236.116.38	attackbotsspam	SmallBizIT.US 28 packets to tcp(21,22,23,25,139,445,1443,2443,3380,3388,3389,3390,3391,3392,3443,4443,5000,5001,5443,6443,7443,8443,9443,13389,23389,33389,43389,53389)	2020-06-25 00:30:26
41.231.54.59	attackbots	41.231.54.59 - - [24/Jun/2020:15:57:28 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 41.231.54.59 - - [24/Jun/2020:15:57:29 +0200] "POST /wp-login.php HTTP/1.1" 200 2031 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 41.231.54.59 - - [24/Jun/2020:15:57:29 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 41.231.54.59 - - [24/Jun/2020:15:57:29 +0200] "POST /wp-login.php HTTP/1.1" 200 2030 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 41.231.54.59 - - [24/Jun/2020:15:57:29 +0200] "GET /wp-login.php HTTP/1.1" 200 1901 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 41.231.54.59 - - [24/Jun/2020:15:57:29 +0200] "POST /wp-login.php HTTP/1.1" 200 2030 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/6 ...	2020-06-25 00:48:02
36.89.163.178	attack	Jun 24 19:02:12 pkdns2 sshd\[1675\]: Invalid user cat from 36.89.163.178Jun 24 19:02:15 pkdns2 sshd\[1675\]: Failed password for invalid user cat from 36.89.163.178 port 57046 ssh2Jun 24 19:05:26 pkdns2 sshd\[1825\]: Invalid user nexus from 36.89.163.178Jun 24 19:05:27 pkdns2 sshd\[1825\]: Failed password for invalid user nexus from 36.89.163.178 port 49232 ssh2Jun 24 19:08:38 pkdns2 sshd\[1931\]: Invalid user wur from 36.89.163.178Jun 24 19:08:40 pkdns2 sshd\[1931\]: Failed password for invalid user wur from 36.89.163.178 port 41420 ssh2 ...	2020-06-25 00:18:28
46.101.31.128	attackbots	46.101.31.128 - - [24/Jun/2020:14:05:43 +0200] "POST /xmlrpc.php HTTP/1.1" 403 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" 46.101.31.128 - - [24/Jun/2020:14:05:43 +0200] "POST /xmlrpc.php HTTP/1.1" 403 795 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" ...	2020-06-25 00:21:33
209.17.97.50	attackbotsspam	Automatic report - Banned IP Access	2020-06-25 00:40:55

最近上报的IP列表

109.75.37.9	117.69.30.138	105.112.50.72	170.82.22.45
78.190.215.155	60.178.47.102	178.63.53.43	5.153.187.232
45.118.188.44	49.148.216.113	85.202.56.87	187.101.236.171
190.38.165.84	190.3.130.107	180.252.31.122	37.32.41.168
61.19.40.38	88.114.86.83	187.8.168.57	134.209.169.72