必须是合法有效的IP地址, 可以是IPv4或者是IPv6, 例如127.0.0.1或者2001:DB8:0:0:8:800:200C:417A
基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Zimbabwe

运营商(isp): Telone Pvt Ltd

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): unknown

用户上报:
类型 评论内容 时间
attack
Unauthorized connection attempt detected from IP address 197.221.254.63 to port 445
2019-12-11 21:32:25
相同子网IP讨论:
IP 类型 评论内容 时间
197.221.254.22 attack
Port Scan detected!
...
2020-07-14 08:05:45
197.221.254.235 attack
Logged onto my email
2020-07-05 03:55:10
197.221.254.235 attackspam
"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:
2020-05-29 06:30:57
197.221.254.79 attack
Fail2Ban - HTTP Auth Bruteforce Attempt
2020-05-12 05:24:46
197.221.254.176 attackbotsspam
2019-03-12 20:37:49 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25129 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-03-12 20:38:40 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25137 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
2019-03-12 20:39:11 H=\(16.176.telone.co.zw\) \[197.221.254.176\]:25138 I=\[193.107.88.166\]:25 F=\ rejected RCPT \: Sender verify failed
...
2020-01-30 04:45:43
197.221.254.96 attack
2019-11-20 14:13:49 H=(16.96.telone.co.zw) [197.221.254.96]:6050 I=[10.100.18.22]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.96)
2019-11-20 14:13:49 unexpected disconnection while reading SMTP command from (16.96.telone.co.zw) [197.221.254.96]:6050 I=[10.100.18.22]:25 (error: Connection reset by peer)
2019-11-20 15:33:34 H=(16.96.telone.co.zw) [197.221.254.96]:6523 I=[10.100.18.22]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.96)


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.96
2019-11-21 00:42:21
197.221.254.6 attackspambots
2019-11-20 15:12:24 H=(16.6.telone.co.zw) [197.221.254.6]:31578 I=[10.100.18.25]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.6)
2019-11-20 15:12:25 unexpected disconnection while reading SMTP command from (16.6.telone.co.zw) [197.221.254.6]:31578 I=[10.100.18.25]:25 (error: Connection reset by peer)
2019-11-20 15:29:34 H=(16.6.telone.co.zw) [197.221.254.6]:31622 I=[10.100.18.25]:25 F=: Host/domain is listed in RBL cbl.abuseat.org (Blocked - see hxxp://www.abuseat.org/lookup.cgi?ip=197.221.254.6)

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.6
2019-11-20 22:54:01
197.221.254.40 attack
firewall-block, port(s): 1433/tcp
2019-11-20 00:40:13
197.221.254.172 attackspambots
Hello!

As you may have noticed, I sent you an email from your account.
This means that I have full access to your device.

I've been watching you for a few months now.
The fact is that you were infected with malware through an adult site that you visited.

If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.

I also have access to all your contacts and all your correspondence.

Why your antivirus did not detect malware?
Answer: My malware uses the driver, I update its signatures every 4 hours so that your antivirus is silent.

I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks...
2019-10-13 06:30:27
197.221.254.157 attack
Spam
2019-08-14 23:36:14
197.221.254.2 attackspambots
Lines containing failures of 197.221.254.2
Jul 13 16:57:36 mellenthin postfix/smtpd[5323]: connect from unknown[197.221.254.2]
Jul x@x
Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: lost connection after DATA from unknown[197.221.254.2]
Jul 13 16:57:45 mellenthin postfix/smtpd[5323]: disconnect from unknown[197.221.254.2] ehlo=1 mail=1 rcpt=0/1 data=0/1 commands=2/4


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=197.221.254.2
2019-07-14 08:02:14
WHOIS信息:
b
DIG信息:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 197.221.254.63
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 762
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;197.221.254.63.			IN	A

;; AUTHORITY SECTION:
.			278	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121100 1800 900 604800 86400

;; Query time: 159 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Dec 11 21:32:20 CST 2019
;; MSG SIZE  rcvd: 118
HOST信息:
63.254.221.197.in-addr.arpa domain name pointer 16.63.telone.co.zw.
NSLOOKUP信息:
Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
63.254.221.197.in-addr.arpa	name = 16.63.telone.co.zw.

Authoritative answers can be found from:
相关IP信息:
最新评论:
IP 类型 评论内容 时间
106.12.28.152 attack
May 24 23:16:26 ms-srv sshd[43208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.28.152
May 24 23:16:28 ms-srv sshd[43208]: Failed password for invalid user dwdevnet from 106.12.28.152 port 39762 ssh2
2020-09-02 19:04:34
179.214.1.64 attackspambots
"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:
2020-09-02 18:57:16
45.171.162.85 attackbots
Website Spam
2020-09-02 19:11:51
106.54.63.49 attackspambots
Invalid user ts3bot from 106.54.63.49 port 48110
2020-09-02 19:15:06
110.141.230.214 attackspambots
Automatic report - Banned IP Access
2020-09-02 19:14:52
106.12.148.170 attack
Jul  2 19:32:56 ms-srv sshd[6759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.148.170
Jul  2 19:32:58 ms-srv sshd[6759]: Failed password for invalid user akhan from 106.12.148.170 port 49004 ssh2
2020-09-02 18:38:34
180.250.108.133 attackbots
Failed password for root from 180.250.108.133 port 45898 ssh2
2020-09-02 19:02:59
165.227.15.223 attackspambots
165.227.15.223 - - [02/Sep/2020:11:43:08 +0100] "POST /wp-login.php HTTP/1.1" 200 2255 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
165.227.15.223 - - [02/Sep/2020:11:43:10 +0100] "POST /wp-login.php HTTP/1.1" 200 2230 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
165.227.15.223 - - [02/Sep/2020:11:43:11 +0100] "POST /wp-login.php HTTP/1.1" 200 2235 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...
2020-09-02 18:43:41
123.207.142.208 attackbotsspam
(sshd) Failed SSH login from 123.207.142.208 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep  2 02:47:05 server4 sshd[11663]: Invalid user test1 from 123.207.142.208
Sep  2 02:47:05 server4 sshd[11663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.142.208 
Sep  2 02:47:07 server4 sshd[11663]: Failed password for invalid user test1 from 123.207.142.208 port 37214 ssh2
Sep  2 02:57:39 server4 sshd[17934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.142.208  user=root
Sep  2 02:57:41 server4 sshd[17934]: Failed password for root from 123.207.142.208 port 53758 ssh2
2020-09-02 19:17:57
122.152.195.84 attackspam
Sep  2 06:25:43 meumeu sshd[900288]: Invalid user yyh from 122.152.195.84 port 39022
Sep  2 06:25:43 meumeu sshd[900288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.195.84 
Sep  2 06:25:43 meumeu sshd[900288]: Invalid user yyh from 122.152.195.84 port 39022
Sep  2 06:25:45 meumeu sshd[900288]: Failed password for invalid user yyh from 122.152.195.84 port 39022 ssh2
Sep  2 06:30:06 meumeu sshd[900495]: Invalid user pp from 122.152.195.84 port 34060
Sep  2 06:30:06 meumeu sshd[900495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.152.195.84 
Sep  2 06:30:06 meumeu sshd[900495]: Invalid user pp from 122.152.195.84 port 34060
Sep  2 06:30:07 meumeu sshd[900495]: Failed password for invalid user pp from 122.152.195.84 port 34060 ssh2
Sep  2 06:34:31 meumeu sshd[900652]: Invalid user erik from 122.152.195.84 port 57592
...
2020-09-02 19:09:00
51.38.37.89 attackspambots
Sep  1 23:43:42 dignus sshd[4541]: Failed password for invalid user rajesh from 51.38.37.89 port 56114 ssh2
Sep  1 23:47:10 dignus sshd[4952]: Invalid user vector from 51.38.37.89 port 60142
Sep  1 23:47:10 dignus sshd[4952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.38.37.89
Sep  1 23:47:12 dignus sshd[4952]: Failed password for invalid user vector from 51.38.37.89 port 60142 ssh2
Sep  1 23:50:32 dignus sshd[5456]: Invalid user oracle from 51.38.37.89 port 35928
...
2020-09-02 18:47:51
213.231.173.117 attackspambots
"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:
2020-09-02 18:39:43
156.203.221.183 attackbots
"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:
2020-09-02 18:38:57
139.198.17.31 attackbots
Invalid user katie from 139.198.17.31 port 54868
2020-09-02 18:51:19
180.231.119.89 attack
"XSS Attack Detected via libinjection - Matched Data: XSS data found within ARGS_NAMES:
2020-09-02 19:08:07

最近上报的IP列表

203.190.154.83 114.33.250.151 103.192.76.16 101.28.29.116
155.192.125.29 167.160.65.45 50.200.170.92 92.108.44.249
66.57.107.210 77.97.6.176 23.254.55.94 187.4.158.172
82.50.105.100 109.226.213.125 66.73.153.165 106.66.48.2
8.223.202.217 207.130.99.90 234.93.132.5 72.178.179.177