Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: San Antonio

Region: Texas

Country: United States

Internet Service Provider: Microsoft Corporation

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:
Type Details Datetime
attackspam
Dear user,
 
The IP address [13.85.152.27] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Mon Sep 14 00:04:10 2020.
 
From AstroParrotsNAS
2020-09-18 20:28:56
attackbots
Dear user,
 
The IP address [13.85.152.27] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Mon Sep 14 00:04:10 2020.
 
From AstroParrotsNAS
2020-09-18 12:47:48
attackbotsspam
Dear user,
 
The IP address [13.85.152.27] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Mon Sep 14 00:04:10 2020.
 
From AstroParrotsNAS
2020-09-18 03:03:04
attackspam
Invalid user ansible from 13.85.152.27 port 34664
2020-09-17 00:02:47
attackspam
Invalid user ansible from 13.85.152.27 port 34664
2020-09-16 16:19:12
attackspambots
Sep 15 16:58:39 gitlab-ci sshd\[25715\]: Invalid user ec2-user from 13.85.152.27Sep 15 16:58:40 gitlab-ci sshd\[25717\]: Invalid user ansible from 13.85.152.27
...
2020-09-16 01:21:32
attackspambots
<6 unauthorized SSH connections
2020-09-15 17:13:08
attackbotsspam
$f2bV_matches
2020-09-14 00:58:26
attackspam
Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-13T07:34:04Z and 2020-09-13T07:34:11Z
2020-09-13 16:48:24
attackbotsspam
Sep 12 11:42:30 XXXXXX sshd[37506]: Invalid user ec2-user from 13.85.152.27 port 38212
2020-09-12 20:57:25
attack
Invalid user ansible from 13.85.152.27 port 49806
2020-09-12 12:59:15
attack
Sep 11 21:26:20 dev0-dcde-rnet sshd[3893]: Failed password for root from 13.85.152.27 port 56074 ssh2
Sep 11 21:26:20 dev0-dcde-rnet sshd[3895]: Failed password for root from 13.85.152.27 port 34230 ssh2
2020-09-12 04:48:52
attackbotsspam
[ssh] SSH attack
2020-09-10 02:29:23
attack
leo_www
2020-09-03 12:17:05
attackspam
$lgm
2020-09-03 04:35:36
attackspambots
Sep  1 19:31:01 dcd-gentoo sshd[20633]: User root from 13.85.152.27 not allowed because none of user's groups are listed in AllowGroups
Sep  1 19:31:03 dcd-gentoo sshd[20636]: User root from 13.85.152.27 not allowed because none of user's groups are listed in AllowGroups
Sep  1 19:32:58 dcd-gentoo sshd[20693]: Invalid user ec2-user from 13.85.152.27 port 50800
...
2020-09-02 02:12:37
attackbotsspam
2020-09-01T00:03:37.102868abusebot-6.cloudsearch.cf sshd[15260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.85.152.27  user=root
2020-09-01T00:03:39.713571abusebot-6.cloudsearch.cf sshd[15260]: Failed password for root from 13.85.152.27 port 34268 ssh2
2020-09-01T00:03:39.015858abusebot-6.cloudsearch.cf sshd[15262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.85.152.27  user=root
2020-09-01T00:03:41.430833abusebot-6.cloudsearch.cf sshd[15262]: Failed password for root from 13.85.152.27 port 50536 ssh2
2020-09-01T00:03:41.623155abusebot-6.cloudsearch.cf sshd[15264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.85.152.27  user=root
2020-09-01T00:03:43.782424abusebot-6.cloudsearch.cf sshd[15264]: Failed password for root from 13.85.152.27 port 38624 ssh2
2020-09-01T00:03:47.077724abusebot-6.cloudsearch.cf sshd[15266]: pam_unix(sshd:auth): authenticat
...
2020-09-01 08:13:42
attack
Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-08-30T23:02:17Z
2020-08-31 07:52:53
attackspambots
 TCP (SYN) 13.85.152.27:54920 -> port 22, len 48
2020-08-30 07:48:25
attack
Aug 27 02:11:41 master sshd[28500]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28501]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28502]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28503]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28504]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:59 master sshd[28505]: Failed password for root from 13.85.152.27 port 57900 ssh2
Aug 27 02:11:59 master sshd[28509]: Failed password for root from 13.85.152.27 port 33332 ssh2
Aug 27 02:11:59 master sshd[28506]: Failed password for root from 13.85.152.27 port 58418 ssh2
Aug 27 02:12:01 master sshd[28511]: Failed password for root from 13.85.152.27 port 45814 ssh2
Aug 27 02:12:01 master sshd[28513]: Failed password for root from 13.85.152.27 port 49060 ssh2
2020-08-27 07:57:05
Comments on same subnet:
No discussion about this subnet yet..
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 13.85.152.27
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51566
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;13.85.152.27.			IN	A

;; AUTHORITY SECTION:
.			373	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020082602 1800 900 604800 86400

;; Query time: 67 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Aug 27 07:57:01 CST 2020
;; MSG SIZE  rcvd: 116
Host info
Host 27.152.85.13.in-addr.arpa. not found: 3(NXDOMAIN)
Nslookup info:
Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 27.152.85.13.in-addr.arpa: NXDOMAIN
Related IP info:
Related comments:
IP Type Details Datetime
139.199.29.114 attack
Oct 16 13:36:50 localhost sshd\[31391\]: Invalid user 4321 from 139.199.29.114 port 40434
Oct 16 13:36:50 localhost sshd\[31391\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.29.114
Oct 16 13:36:52 localhost sshd\[31391\]: Failed password for invalid user 4321 from 139.199.29.114 port 40434 ssh2
Oct 16 13:43:21 localhost sshd\[31601\]: Invalid user ono from 139.199.29.114 port 50904
Oct 16 13:43:21 localhost sshd\[31601\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.199.29.114
...
2019-10-16 21:59:25
178.254.197.242 attackbots
Automatic report - Port Scan Attack
2019-10-16 21:54:56
151.80.144.255 attackspam
Oct 16 13:21:51 dedicated sshd[2825]: Invalid user database from 151.80.144.255 port 55188
2019-10-16 22:08:59
50.227.195.3 attackbots
Oct 16 15:41:37 eventyay sshd[21844]: Failed password for root from 50.227.195.3 port 58502 ssh2
Oct 16 15:45:17 eventyay sshd[21901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.227.195.3
Oct 16 15:45:19 eventyay sshd[21901]: Failed password for invalid user tftp from 50.227.195.3 port 37942 ssh2
...
2019-10-16 22:03:25
77.234.255.9 attack
$f2bV_matches
2019-10-16 21:35:54
186.10.17.84 attackspam
Oct 16 15:54:38 markkoudstaal sshd[15519]: Failed password for root from 186.10.17.84 port 38784 ssh2
Oct 16 15:59:06 markkoudstaal sshd[15926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=186.10.17.84
Oct 16 15:59:07 markkoudstaal sshd[15926]: Failed password for invalid user net from 186.10.17.84 port 49658 ssh2
2019-10-16 22:01:08
150.223.0.8 attackspambots
Oct 16 13:50:38 localhost sshd\[2015\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.223.0.8  user=root
Oct 16 13:50:41 localhost sshd\[2015\]: Failed password for root from 150.223.0.8 port 43244 ssh2
Oct 16 13:54:48 localhost sshd\[2111\]: Invalid user public from 150.223.0.8
Oct 16 13:54:48 localhost sshd\[2111\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=150.223.0.8
Oct 16 13:54:51 localhost sshd\[2111\]: Failed password for invalid user public from 150.223.0.8 port 57920 ssh2
...
2019-10-16 21:39:30
51.68.134.43 attackspam
TCP Port: 25 _    invalid blocked  barracudacentral also rbldns-ru _  _  _ _ (741)
2019-10-16 21:57:20
124.74.248.218 attack
Oct 16 09:37:48 xtremcommunity sshd\[576283\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.74.248.218  user=root
Oct 16 09:37:51 xtremcommunity sshd\[576283\]: Failed password for root from 124.74.248.218 port 40430 ssh2
Oct 16 09:42:55 xtremcommunity sshd\[576425\]: Invalid user bb from 124.74.248.218 port 49834
Oct 16 09:42:55 xtremcommunity sshd\[576425\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.74.248.218
Oct 16 09:42:58 xtremcommunity sshd\[576425\]: Failed password for invalid user bb from 124.74.248.218 port 49834 ssh2
...
2019-10-16 22:11:03
14.140.46.35 attackbots
Oct 16 13:21:50 MK-Soft-VM6 sshd[17087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.140.46.35 
Oct 16 13:21:52 MK-Soft-VM6 sshd[17087]: Failed password for invalid user admin2 from 14.140.46.35 port 60498 ssh2
...
2019-10-16 22:08:28
193.32.163.9 attackspam
Port scan: Attack repeated for 24 hours
2019-10-16 21:33:06
88.214.26.17 attackbotsspam
191016 15:26:22 \[Warning\] Access denied for user 'root'@'88.214.26.17' \(using password: YES\)
191016 16:06:03 \[Warning\] Access denied for user 'root'@'88.214.26.17' \(using password: YES\)
191016 16:24:09 \[Warning\] Access denied for user 'root'@'88.214.26.17' \(using password: YES\)
...
2019-10-16 21:40:30
177.37.164.255 attackspambots
MultiHost/MultiPort Probe, Scan, Hack -
2019-10-16 21:42:35
1.47.47.29 attack
Oct 16 06:22:01 mailman postfix/smtpd[31572]: NOQUEUE: reject: RCPT from unknown[1.47.47.29]: 554 5.7.1 Service unavailable; Client host [1.47.47.29] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/1.47.47.29; from= to= proto=ESMTP helo=<[1.47.47.29]>
Oct 16 06:22:01 mailman postfix/smtpd[31577]: NOQUEUE: reject: RCPT from unknown[1.47.47.29]: 554 5.7.1 Service unavailable; Client host [1.47.47.29] blocked using sbl-xbl.spamhaus.org; https://www.spamhaus.org/query/ip/1.47.47.29; from= to= proto=ESMTP helo=<[1.47.47.29]>
2019-10-16 21:59:01
45.34.147.162 attack
Oct 15 00:54:32 carla sshd[27170]: Address 45.34.147.162 maps to unassigned.psychz.net, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Oct 15 00:54:33 carla sshd[27170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.34.147.162  user=r.r
Oct 15 00:54:35 carla sshd[27170]: Failed password for r.r from 45.34.147.162 port 59806 ssh2
Oct 15 00:54:35 carla sshd[27171]: Received disconnect from 45.34.147.162: 11: Bye Bye
Oct 15 01:15:57 carla sshd[27333]: Address 45.34.147.162 maps to unassigned.psychz.net, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Oct 15 01:15:57 carla sshd[27333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.34.147.162  user=r.r
Oct 15 01:15:59 carla sshd[27333]: Failed password for r.r from 45.34.147.162 port 39319 ssh2
Oct 15 01:15:59 carla sshd[27334]: Received disconnect from 45.34.147.162: 11: Bye Bye
Oct 15 01:........
-------------------------------
2019-10-16 21:53:29

Recently Reported IPs

41.116.96.104 24.169.230.14 78.123.108.173 221.187.142.120
159.72.196.237 97.212.18.220 80.6.203.28 188.131.142.46
187.184.128.246 14.145.245.228 24.169.70.85 80.155.173.207
187.17.54.80 74.62.252.57 63.112.14.90 178.34.240.137
96.3.163.89 106.223.135.213 83.226.68.136 151.21.4.146