49.142.238.52 - IPInfo

基本信息:

城市(city): Pohang

省份(region): Gyeongsangbuk-do

国家(country): South Korea

运营商(isp): unknown

主机名(hostname): unknown

机构(organization): Gyeongbuk Cable TV

使用类型(Usage Type): unknown

用户上报:

点此参与IP信息讨论

暂无关于此IP的讨论, 沙发请点上方按钮

相同子网IP讨论:

IP	类型	评论内容	时间
49.142.238.12	attack	IP Ban Report : https://help-dysk.pl/wordpress-firewall-plugins/ip/49.142.238.12/ KR - 1H : (69) Protection Against DDoS WordPress plugin : "odzyskiwanie danych help-dysk" IP Address Ranges by Country : KR NAME ASN : ASN7623 IP : 49.142.238.12 CIDR : 49.142.236.0/22 PREFIX COUNT : 75 UNIQUE IP COUNT : 77824 ATTACKS DETECTED ASN7623 : 1H - 1 3H - 1 6H - 1 12H - 1 24H - 1 DateTime : 2019-11-03 06:29:25 INFO : Port Scan TELNET Detected and Blocked by ADMIN - data recovery	2019-11-03 13:54:43
49.142.238.82	attackbotsspam	port scan and connect, tcp 23 (telnet)	2019-08-14 07:46:43

类型

评论内容

时间

49.142.238.12

attack

IP Ban Report :  
 https://help-dysk.pl/wordpress-firewall-plugins/ip/49.142.238.12/ 
 
 KR - 1H : (69)  
 Protection Against DDoS WordPress plugin :  
 "odzyskiwanie danych help-dysk" 
 IP Address Ranges by Country : KR 
 NAME ASN : ASN7623 
 
 IP : 49.142.238.12 
 
 CIDR : 49.142.236.0/22 
 
 PREFIX COUNT : 75 
 
 UNIQUE IP COUNT : 77824 
 
 
 ATTACKS DETECTED ASN7623 :  
  1H - 1 
  3H - 1 
  6H - 1 
 12H - 1 
 24H - 1 
 
 DateTime : 2019-11-03 06:29:25 
 
 INFO : Port Scan TELNET Detected and Blocked by ADMIN  - data recovery

2019-11-03 13:54:43

49.142.238.82

attackbotsspam

port scan and connect, tcp 23 (telnet)

2019-08-14 07:46:43

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 49.142.238.52
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48055
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;49.142.238.52.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019072901 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Tue Jul 30 02:05:56 CST 2019
;; MSG SIZE  rcvd: 117

HOST信息:

Host 52.238.142.49.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 52.238.142.49.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
177.67.166.190	attackbots	Oct 4 04:53:32 mail.srvfarm.net postfix/smtpd[713753]: warning: unknown[177.67.166.190]: SASL PLAIN authentication failed: Oct 4 04:53:32 mail.srvfarm.net postfix/smtpd[713753]: lost connection after AUTH from unknown[177.67.166.190] Oct 4 04:54:30 mail.srvfarm.net postfix/smtpd[713926]: warning: unknown[177.67.166.190]: SASL PLAIN authentication failed: Oct 4 04:54:31 mail.srvfarm.net postfix/smtpd[713926]: lost connection after AUTH from unknown[177.67.166.190] Oct 4 04:54:48 mail.srvfarm.net postfix/smtpd[726656]: warning: unknown[177.67.166.190]: SASL PLAIN authentication failed:	2020-10-04 21:14:27
185.132.53.145	attackbotsspam	2020-10-04T00:19:55.319686snf-827550 sshd[7118]: Invalid user oracle from 185.132.53.145 port 41440 2020-10-04T00:19:56.654396snf-827550 sshd[7118]: Failed password for invalid user oracle from 185.132.53.145 port 41440 ssh2 2020-10-04T00:19:58.686112snf-827550 sshd[7120]: Invalid user nagios from 185.132.53.145 port 48806 ...	2020-10-04 21:08:29
85.209.0.103	attackbotsspam	Oct 4 15:28:32 dcd-gentoo sshd[6953]: User root from 85.209.0.103 not allowed because none of user's groups are listed in AllowGroups Oct 4 15:28:32 dcd-gentoo sshd[6954]: User root from 85.209.0.103 not allowed because none of user's groups are listed in AllowGroups Oct 4 15:28:32 dcd-gentoo sshd[6949]: User root from 85.209.0.103 not allowed because none of user's groups are listed in AllowGroups ...	2020-10-04 21:30:29
186.216.70.167	attackbots	Oct 3 22:05:22 mail.srvfarm.net postfix/smtps/smtpd[655023]: warning: unknown[186.216.70.167]: SASL PLAIN authentication failed: Oct 3 22:05:22 mail.srvfarm.net postfix/smtps/smtpd[655023]: lost connection after AUTH from unknown[186.216.70.167] Oct 3 22:05:40 mail.srvfarm.net postfix/smtps/smtpd[657386]: warning: unknown[186.216.70.167]: SASL PLAIN authentication failed: Oct 3 22:05:40 mail.srvfarm.net postfix/smtps/smtpd[657386]: lost connection after AUTH from unknown[186.216.70.167] Oct 3 22:12:30 mail.srvfarm.net postfix/smtpd[661692]: warning: unknown[186.216.70.167]: SASL PLAIN authentication failed:	2020-10-04 21:23:18
190.103.220.76	attackbotsspam	Oct 3 22:05:43 mail.srvfarm.net postfix/smtpd[660369]: warning: unknown[190.103.220.76]: SASL PLAIN authentication failed: Oct 3 22:05:44 mail.srvfarm.net postfix/smtpd[660369]: lost connection after AUTH from unknown[190.103.220.76] Oct 3 22:07:54 mail.srvfarm.net postfix/smtpd[656138]: warning: unknown[190.103.220.76]: SASL PLAIN authentication failed: Oct 3 22:07:55 mail.srvfarm.net postfix/smtpd[656138]: lost connection after AUTH from unknown[190.103.220.76] Oct 3 22:15:22 mail.srvfarm.net postfix/smtps/smtpd[658122]: warning: unknown[190.103.220.76]: SASL PLAIN authentication failed:	2020-10-04 21:22:02
131.196.9.182	attackbots	trying to access non-authorized port	2020-10-04 21:09:47
129.226.138.179	attackbotsspam	2020-10-04 06:48:20.474028-0500 localhost sshd[55740]: Failed password for invalid user test1 from 129.226.138.179 port 59606 ssh2	2020-10-04 21:06:00
103.18.242.18	attack	Oct 3 22:10:06 mail.srvfarm.net postfix/smtpd[660372]: warning: unknown[103.18.242.18]: SASL PLAIN authentication failed: Oct 3 22:10:06 mail.srvfarm.net postfix/smtpd[660372]: lost connection after AUTH from unknown[103.18.242.18] Oct 3 22:15:36 mail.srvfarm.net postfix/smtps/smtpd[658711]: warning: unknown[103.18.242.18]: SASL PLAIN authentication failed: Oct 3 22:15:36 mail.srvfarm.net postfix/smtps/smtpd[658711]: lost connection after AUTH from unknown[103.18.242.18] Oct 3 22:16:51 mail.srvfarm.net postfix/smtps/smtpd[658711]: warning: unknown[103.18.242.18]: SASL PLAIN authentication failed:	2020-10-04 21:29:56
45.142.120.183	attackbots	2020-10-04 16:21:22 auth_plain authenticator failed for (localhost) [45.142.120.183]: 535 Incorrect authentication data (set_id=8u0t@lavrinenko.info) 2020-10-04 16:21:23 auth_plain authenticator failed for (localhost) [45.142.120.183]: 535 Incorrect authentication data (set_id=Ern}@lavrinenko.info) ...	2020-10-04 21:34:28
45.142.120.78	attackspambots	Brute forcing email accounts	2020-10-04 21:35:22
168.0.252.205	attackspam	Autoban 168.0.252.205 AUTH/CONNECT	2020-10-04 21:14:43
156.96.56.56	attackspam	2020-10-04 H=\(BXXOXyXO\) \[156.96.56.56\] F=\<REMOVEDREMOVEDREMOVED_perl@REMOVED.de\> rejected RCPT \: relay not permitted 2020-10-04 dovecot_login authenticator failed for \(6qYnLdL\) \[156.96.56.56\]: 535 Incorrect authentication data \(set_id=REMOVEDREMOVEDREMOVED_perl\) 2020-10-04 dovecot_login authenticator failed for \(srG4Gi82\) \[156.96.56.56\]: 535 Incorrect authentication data \(set_id=REMOVEDREMOVEDREMOVED_perl\)	2020-10-04 21:25:42
36.74.42.10	attack	SP-Scan 44459:445 detected 2020.10.03 07:54:28 blocked until 2020.11.21 23:57:15	2020-10-04 21:42:20
185.40.241.179	attack	Oct 3 22:36:10 mail.srvfarm.net postfix/smtps/smtpd[664799]: warning: unknown[185.40.241.179]: SASL PLAIN authentication failed: Oct 3 22:36:11 mail.srvfarm.net postfix/smtps/smtpd[664799]: lost connection after AUTH from unknown[185.40.241.179] Oct 3 22:38:01 mail.srvfarm.net postfix/smtpd[661686]: warning: unknown[185.40.241.179]: SASL PLAIN authentication failed: Oct 3 22:38:01 mail.srvfarm.net postfix/smtpd[661686]: lost connection after AUTH from unknown[185.40.241.179] Oct 3 22:40:21 mail.srvfarm.net postfix/smtpd[660363]: warning: unknown[185.40.241.179]: SASL PLAIN authentication failed:	2020-10-04 21:13:34
51.91.99.233	attackspam	51.91.99.233 - - [04/Oct/2020:14:22:50 +0100] "POST /wp-login.php HTTP/1.1" 200 2861 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 51.91.99.233 - - [04/Oct/2020:14:22:51 +0100] "POST /wp-login.php HTTP/1.1" 200 2830 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 51.91.99.233 - - [04/Oct/2020:14:22:51 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-10-04 21:38:01

最近上报的IP列表

172.2.221.107	119.99.34.213	20.15.181.29	88.170.130.196
190.1.59.116	134.140.101.24	221.69.236.179	206.201.206.238
73.7.169.224	40.73.212.59	131.49.136.166	157.122.192.183
40.101.196.227	193.146.185.56	221.199.130.116	82.112.134.159
197.51.203.13	165.124.220.105	177.89.24.240	101.145.225.24