IP Address Inspector

A.Anon8 commented...

Trying to hack into wordpress website 16th May 2014
HOSTNAME: ip-static-94-242-214-102.as5577.net
based just north of Luxemburg
Server Location info:
Continent Lat/Lon: 48.69083 / 9.1405
Country Lat/Lon: 49.75 / 6.17
City Lat/Lon: (49.75) / (6.1667)

% Information related to '94.242.192.0 - 94.242.223.255'

inetnum: 94.242.192.0 - 94.242.223.255
netname: ROOT-NETWORK
descr: root SA
country: LU
admin-c: AB99-RIPE
tech-c: RE655-RIPE
status: ASSIGNED PA
mnt-by: ROOT-MNT
source: RIPE # Filtered

role: root eSolutions
address: 35, rue John F. Kennedy
address: 7327 Steinsel
address: Luxembourg
phone: +352 20.500
fax-no: +352 20.500.500
abuse-mailbox: abuse@as5577.net
remarks:
remarks: +------------------------------------+
remarks: | Operational Issues: |
remarks: | noc@as5577.net |
remarks: +------------------------------------+
remarks: | Abuse and Spam: |
remarks: | abuse@as5577.net |
remarks: +------------------------------------+
remarks:
admin-c: RE655-RIPE
tech-c: AB99-RIPE
nic-hdl: RE655-RIPE
mnt-by: ROOT-MNT
source: RIPE # Filtered

person: Andy BIERLAIR
address: root SA
address: 35, rue John F. Kennedy
address: 7327 Steinsel
address: Luxembourg
phone: +352 20.500
fax-no: +352 20.500.500
nic-hdl: AB99-RIPE
mnt-by: ROOT-MNT
remarks:
remarks: +------------------------------------+
remarks: | I did *NOT* spam your mailbox! |
remarks: | I will *NOT* reply to abuse mails! |
remarks: | |
remarks: | Please contact abuse@as5577.net ! |
remarks: +------------------------------------+
remarks:
source: RIPE # Filtered

% Information related to '94.242.192.0/18AS5577'

route: 94.242.192.0/18
descr: root SA
origin: AS5577
mnt-by: ROOT-MNT
source: RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.47 (WHOIS4)
May 16 2014 06:26 AM

L.Jong commented...

tried to retrieve my wordpress password
May 15 2014 05:53 PM

H.Lobineau commented...

Country: LUXEMBOURG (LU)
City: Steinsel
IP: 94.242.214.102

maggio 6, 2014 14:21:27 /administrator/index.php
maggio 6, 2014 14:21:32 /administrator/
maggio 6, 2014 14:21:35 /admin.php

IP Address 94.242.214.102 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.

It was last detected at 2014-05-01 02:00 GMT (+/- 30 minutes), approximately 5 days, 15 hours, 29 minutes ago.

This IP address is infected with, or is NATting for a machine infected with the ZeuS trojan, also known as "Zbot" and "WSNPoem".
May 06 2014 01:50 PM