202.125.145.148

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Pakistan

运营商(isp): ITI

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Commercial

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackspam	suspicious action Fri, 06 Mar 2020 10:31:35 -0300	2020-03-07 00:30:58

相同子网IP讨论:

IP	类型	评论内容	时间
202.125.145.50	attackspambots	Unauthorized connection attempt from IP address 202.125.145.50 on Port 445(SMB)	2019-12-06 02:50:21
202.125.145.55	attackspambots	Unauthorized connection attempt from IP address 202.125.145.55 on Port 445(SMB)	2019-11-08 01:14:11
202.125.145.55	attackspam	TCP port 445 (SMB) attempt blocked by firewall. [2019-06-25 19:07:16]	2019-06-26 09:51:30

类型

评论内容

时间

202.125.145.50

attackspambots

Unauthorized connection attempt from IP address 202.125.145.50 on Port 445(SMB)

2019-12-06 02:50:21

202.125.145.55

attackspambots

Unauthorized connection attempt from IP address 202.125.145.55 on Port 445(SMB)

2019-11-08 01:14:11

202.125.145.55

attackspam

TCP port 445 (SMB) attempt blocked by firewall. [2019-06-25 19:07:16]

2019-06-26 09:51:30

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 202.125.145.148
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64397
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;202.125.145.148.		IN	A

;; AUTHORITY SECTION:
.			392	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020030600 1800 900 604800 86400

;; Query time: 52 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Mar 07 00:30:49 CST 2020
;; MSG SIZE  rcvd: 119

HOST信息:

148.145.125.202.in-addr.arpa domain name pointer lhr63.pie.net.pk.

NSLOOKUP信息:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
148.145.125.202.in-addr.arpa	name = lhr63.pie.net.pk.

Authoritative answers can be found from:

最新评论:

IP	类型	评论内容	时间
157.230.2.208	attack	Sep 6 07:01:33 root sshd[24129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.2.208 ...	2020-09-06 13:11:51
165.90.3.122	attack	[Sun Sep 06 03:13:25.153543 2020] [:error] [pid 2754:tid 140397330274048] [client 165.90.3.122:65500] [client 165.90.3.122] ModSecurity: Access denied with code 403 (phase 1). Match of "within %{tx.allowed_http_versions}" against "REQUEST_PROTOCOL" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "972"] [id "920430"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/1.0"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "X1PxZdlmuncnyx65RuMHlQAAAGU"] ...	2020-09-06 13:06:58
222.186.15.62	attackspam	Sep 6 15:02:40 localhost sshd[10987]: Disconnected from 222.186.15.62 port 58979 [preauth] ...	2020-09-06 13:12:35
200.233.231.104	attackbotsspam	trying to access non-authorized port	2020-09-06 13:33:37
45.129.33.151	attack	[H1.VM4] Blocked by UFW	2020-09-06 13:26:44
164.163.25.207	attackbotsspam	Automatic report - Banned IP Access	2020-09-06 13:39:24
67.205.162.223	attackbotsspam	TCP (SYN) 67.205.162.223:58529 -> port 26091, len 44	2020-09-06 13:16:07
113.184.255.20	attackbots	Port probing on unauthorized port 445	2020-09-06 13:40:35
45.182.156.5	attackbotsspam	Automatic report - Port Scan Attack	2020-09-06 13:02:25
193.169.255.40	attackbots	Sep 6 05:16:36 localhost postfix/smtpd\[7688\]: warning: unknown\[193.169.255.40\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 05:16:42 localhost postfix/smtpd\[7688\]: warning: unknown\[193.169.255.40\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 05:16:52 localhost postfix/smtpd\[7688\]: warning: unknown\[193.169.255.40\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 05:17:15 localhost postfix/smtpd\[7688\]: warning: unknown\[193.169.255.40\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 05:17:21 localhost postfix/smtpd\[7688\]: warning: unknown\[193.169.255.40\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ...	2020-09-06 13:07:16
222.186.169.194	attackbots	$f2bV_matches	2020-09-06 13:23:09
176.236.42.218	attackbots	SMB Server BruteForce Attack	2020-09-06 13:27:04
45.82.68.203	attackspam	20 attempts against mh_ha-misbehave-ban on bolt	2020-09-06 13:45:27
5.188.206.194	attackspam	Sep 6 07:07:30 relay postfix/smtpd\[31425\]: warning: unknown\[5.188.206.194\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 07:07:52 relay postfix/smtpd\[31425\]: warning: unknown\[5.188.206.194\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 07:09:59 relay postfix/smtpd\[31424\]: warning: unknown\[5.188.206.194\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 07:10:21 relay postfix/smtpd\[31423\]: warning: unknown\[5.188.206.194\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Sep 6 07:16:10 relay postfix/smtpd\[13250\]: warning: unknown\[5.188.206.194\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ...	2020-09-06 13:19:09
103.145.12.217	attackspam	[2020-09-06 00:20:44] NOTICE[1194] chan_sip.c: Registration from '"508" ' failed for '103.145.12.217:6003' - Wrong password [2020-09-06 00:20:44] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-06T00:20:44.705-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="508",SessionID="0x7f2ddc0f4e48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.145.12.217/6003",Challenge="7d35c7dd",ReceivedChallenge="7d35c7dd",ReceivedHash="31fbb0c05ab02743e8ab6900dd754f71" [2020-09-06 00:20:44] NOTICE[1194] chan_sip.c: Registration from '"508" ' failed for '103.145.12.217:6003' - Wrong password [2020-09-06 00:20:44] SECURITY[1233] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-09-06T00:20:44.836-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="508",SessionID="0x7f2ddc12c6d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/103.1 ...	2020-09-06 13:35:27

最近上报的IP列表

37.19.41.51	236.248.85.134	19.188.125.250	162.227.45.185
46.75.100.144	163.26.151.149	156.39.178.13	37.29.5.210
15.35.149.29	104.182.44.180	68.248.144.50	1.55.142.212
67.202.202.202	167.71.115.245	183.82.42.178	46.3.1.162
94.25.233.158	103.60.136.2	43.226.35.161	197.51.163.241