94.74.130.93 - IPInfo

基本信息:

城市(city): unknown

省份(region): unknown

国家(country): Iran, Islamic Republic of

运营商(isp): Farahoosh Dena

主机名(hostname): unknown

机构(organization): unknown

使用类型(Usage Type): Fixed Line ISP

用户上报:

点此参与IP信息讨论

类型	评论内容	时间
attackspambots	Jul 17 07:44:39 tamoto postfix/smtpd[6409]: connect from unknown[94.74.130.93] Jul 17 07:44:42 tamoto postfix/smtpd[6409]: warning: unknown[94.74.130.93]: SASL CRAM-MD5 authentication failed: authentication failure Jul 17 07:44:42 tamoto postfix/smtpd[6409]: warning: unknown[94.74.130.93]: SASL PLAIN authentication failed: authentication failure Jul 17 07:44:43 tamoto postfix/smtpd[6409]: warning: unknown[94.74.130.93]: SASL LOGIN authentication failed: authentication failure Jul 17 07:44:43 tamoto postfix/smtpd[6409]: disconnect from unknown[94.74.130.93] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=94.74.130.93	2019-07-17 17:37:58

类型

评论内容

时间

attackspambots

Jul 17 07:44:39 tamoto postfix/smtpd[6409]: connect from unknown[94.74.130.93]
Jul 17 07:44:42 tamoto postfix/smtpd[6409]: warning: unknown[94.74.130.93]: SASL CRAM-MD5 authentication failed: authentication failure
Jul 17 07:44:42 tamoto postfix/smtpd[6409]: warning: unknown[94.74.130.93]: SASL PLAIN authentication failed: authentication failure
Jul 17 07:44:43 tamoto postfix/smtpd[6409]: warning: unknown[94.74.130.93]: SASL LOGIN authentication failed: authentication failure
Jul 17 07:44:43 tamoto postfix/smtpd[6409]: disconnect from unknown[94.74.130.93]


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=94.74.130.93

2019-07-17 17:37:58

相同子网IP讨论:

IP	类型	评论内容	时间
94.74.130.254	attackbotsspam	(smtpauth) Failed SMTP AUTH login from 94.74.130.254 (IR/Iran/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-30 16:39:31 plain authenticator failed for ([94.74.130.254]) [94.74.130.254]: 535 Incorrect authentication data (set_id=a.nasiri)	2020-07-30 20:41:40
94.74.130.104	attackspam	Jul 24 13:02:18 mail.srvfarm.net postfix/smtpd[2237961]: warning: unknown[94.74.130.104]: SASL PLAIN authentication failed: Jul 24 13:02:18 mail.srvfarm.net postfix/smtpd[2237961]: lost connection after AUTH from unknown[94.74.130.104] Jul 24 13:08:37 mail.srvfarm.net postfix/smtpd[2236042]: warning: unknown[94.74.130.104]: SASL PLAIN authentication failed: Jul 24 13:08:37 mail.srvfarm.net postfix/smtpd[2236042]: lost connection after AUTH from unknown[94.74.130.104] Jul 24 13:11:38 mail.srvfarm.net postfix/smtps/smtpd[2240708]: warning: unknown[94.74.130.104]: SASL PLAIN authentication failed:	2020-07-25 01:29:11

类型

评论内容

时间

94.74.130.254

attackbotsspam

(smtpauth) Failed SMTP AUTH login from 94.74.130.254 (IR/Iran/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2020-07-30 16:39:31 plain authenticator failed for ([94.74.130.254]) [94.74.130.254]: 535 Incorrect authentication data (set_id=a.nasiri)

2020-07-30 20:41:40

94.74.130.104

attackspam

Jul 24 13:02:18 mail.srvfarm.net postfix/smtpd[2237961]: warning: unknown[94.74.130.104]: SASL PLAIN authentication failed: 
Jul 24 13:02:18 mail.srvfarm.net postfix/smtpd[2237961]: lost connection after AUTH from unknown[94.74.130.104]
Jul 24 13:08:37 mail.srvfarm.net postfix/smtpd[2236042]: warning: unknown[94.74.130.104]: SASL PLAIN authentication failed: 
Jul 24 13:08:37 mail.srvfarm.net postfix/smtpd[2236042]: lost connection after AUTH from unknown[94.74.130.104]
Jul 24 13:11:38 mail.srvfarm.net postfix/smtps/smtpd[2240708]: warning: unknown[94.74.130.104]: SASL PLAIN authentication failed:

2020-07-25 01:29:11

WHOIS信息:

DIG信息:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 94.74.130.93
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9077
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;94.74.130.93.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071700 1800 900 604800 86400

;; Query time: 106 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Wed Jul 17 17:37:42 CST 2019
;; MSG SIZE  rcvd: 116

HOST信息:

Host 93.130.74.94.in-addr.arpa. not found: 3(NXDOMAIN)

NSLOOKUP信息:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 93.130.74.94.in-addr.arpa: NXDOMAIN

最新评论:

IP	类型	评论内容	时间
128.199.240.120	attackspam	$f2bV_matches	2019-12-09 21:23:46
51.91.56.133	attackspam	SSH brute-force: detected 6 distinct usernames within a 24-hour window.	2019-12-09 21:50:55
46.218.7.227	attackbotsspam	2019-12-09T06:52:39.032052ns547587 sshd\[15952\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.218.7.227 user=root 2019-12-09T06:52:40.790344ns547587 sshd\[15952\]: Failed password for root from 46.218.7.227 port 56088 ssh2 2019-12-09T07:02:09.919944ns547587 sshd\[31011\]: Invalid user squid from 46.218.7.227 port 58636 2019-12-09T07:02:09.925466ns547587 sshd\[31011\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.218.7.227 ...	2019-12-09 21:34:21
205.211.166.7	attackbots	SSH bruteforce	2019-12-09 21:52:10
104.243.41.97	attack	SSH bruteforce (Triggered fail2ban)	2019-12-09 21:46:17
138.68.245.137	attackbotsspam	138.68.245.137 - - \[09/Dec/2019:13:29:50 +0100\] "POST /wp-login.php HTTP/1.0" 200 7538 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 138.68.245.137 - - \[09/Dec/2019:13:29:52 +0100\] "POST /wp-login.php HTTP/1.0" 200 7363 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" 138.68.245.137 - - \[09/Dec/2019:13:29:55 +0100\] "POST /wp-login.php HTTP/1.0" 200 7358 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2019-12-09 21:59:57
206.189.165.94	attackspam	Dec 9 13:58:52 MK-Soft-VM6 sshd[26333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.165.94 Dec 9 13:58:54 MK-Soft-VM6 sshd[26333]: Failed password for invalid user versolenko from 206.189.165.94 port 44884 ssh2 ...	2019-12-09 21:32:28
90.3.189.58	attack	Dec 9 08:15:33 web8 sshd\[1437\]: Invalid user murrill from 90.3.189.58 Dec 9 08:15:33 web8 sshd\[1437\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.3.189.58 Dec 9 08:15:35 web8 sshd\[1437\]: Failed password for invalid user murrill from 90.3.189.58 port 37094 ssh2 Dec 9 08:20:47 web8 sshd\[3954\]: Invalid user cecon from 90.3.189.58 Dec 9 08:20:47 web8 sshd\[3954\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=90.3.189.58	2019-12-09 21:26:08
110.80.142.84	attackbotsspam	detected by Fail2Ban	2019-12-09 21:22:19
60.190.114.82	attackspambots	Dec 9 13:50:42 h2177944 sshd\[32018\]: Invalid user chiho from 60.190.114.82 port 18430 Dec 9 13:50:42 h2177944 sshd\[32018\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.190.114.82 Dec 9 13:50:43 h2177944 sshd\[32018\]: Failed password for invalid user chiho from 60.190.114.82 port 18430 ssh2 Dec 9 13:58:45 h2177944 sshd\[32174\]: Invalid user mailnull from 60.190.114.82 port 10808 Dec 9 13:58:45 h2177944 sshd\[32174\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.190.114.82 ...	2019-12-09 21:37:59
103.6.198.77	attackbotsspam	xmlrpc attack	2019-12-09 21:25:32
114.237.140.153	attack	Dec 9 07:26:10 grey postfix/smtpd\[3356\]: NOQUEUE: reject: RCPT from unknown\[114.237.140.153\]: 554 5.7.1 Service unavailable\; Client host \[114.237.140.153\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[114.237.140.153\]\; from=\ to=\ proto=SMTP helo=\ ...	2019-12-09 21:19:40
68.183.219.43	attackspambots	Dec 9 10:47:06 server sshd\[31504\]: Invalid user http from 68.183.219.43 Dec 9 10:47:06 server sshd\[31504\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.219.43 Dec 9 10:47:08 server sshd\[31504\]: Failed password for invalid user http from 68.183.219.43 port 40262 ssh2 Dec 9 10:55:46 server sshd\[1526\]: Invalid user server from 68.183.219.43 Dec 9 10:55:46 server sshd\[1526\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.219.43 ...	2019-12-09 21:54:52
200.13.195.70	attackspam	SSH brute-force: detected 7 distinct usernames within a 24-hour window.	2019-12-09 21:40:55
218.89.60.23	attackspambots	Host Scan	2019-12-09 21:59:10

最近上报的IP列表

85.211.24.228	67.209.121.36	140.175.144.186	23.167.140.188
103.119.230.253	63.69.39.64	94.39.198.17	200.191.77.43
134.73.76.109	223.41.56.46	64.8.224.73	15.211.205.77
193.207.179.157	176.137.182.42	223.204.246.134	80.95.103.241
36.77.62.161	201.62.113.159	123.16.13.240	63.247.139.242