[SOLVED] strange source address in the list of ssh logins

ardabro · 11-20-2016, 04:59 PM

Hi all
What does mean the address in the second line?
Looks like a host in "São Tomé and Príncipe" (http://tinyurl.com/ppzfrt7).
On the other hand it is encoded IP of the location I often log into:
95.121.17.02 (not real IP - I changed it).
And indeed: I logged into system from that location that time (more or less).
So, how to interpret this result?

Code:

xyz       pts/1        192.168.200.100  Mon Nov  7 19:49 - 19:52  (00:02)    
xyz       pts/1        host951211702.st Fri Nov  4 13:02 - 13:47  (00:44)

smallpond · 11-21-2016, 06:07 AM

That's a typical name in an ISP reverse lookup database.

Code:

dig 2.17.121.95.in-addr.arpa