Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: San Antonio

Region: Texas

Country: United States

Internet Service Provider: Microsoft Corporation

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:
Type Details Datetime
attackspam
Dear user,
 
The IP address [13.85.152.27] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Mon Sep 14 00:04:10 2020.
 
From AstroParrotsNAS
2020-09-18 20:28:56
attackbots
Dear user,
 
The IP address [13.85.152.27] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Mon Sep 14 00:04:10 2020.
 
From AstroParrotsNAS
2020-09-18 12:47:48
attackbotsspam
Dear user,
 
The IP address [13.85.152.27] experienced 2 failed attempts when attempting to log into SSH running on AstroParrotsNAS within 5 minutes, and was blocked at Mon Sep 14 00:04:10 2020.
 
From AstroParrotsNAS
2020-09-18 03:03:04
attackspam
Invalid user ansible from 13.85.152.27 port 34664
2020-09-17 00:02:47
attackspam
Invalid user ansible from 13.85.152.27 port 34664
2020-09-16 16:19:12
attackspambots
Sep 15 16:58:39 gitlab-ci sshd\[25715\]: Invalid user ec2-user from 13.85.152.27Sep 15 16:58:40 gitlab-ci sshd\[25717\]: Invalid user ansible from 13.85.152.27
...
2020-09-16 01:21:32
attackspambots
<6 unauthorized SSH connections
2020-09-15 17:13:08
attackbotsspam
$f2bV_matches
2020-09-14 00:58:26
attackspam
Cowrie Honeypot: 3 unauthorised SSH/Telnet login attempts between 2020-09-13T07:34:04Z and 2020-09-13T07:34:11Z
2020-09-13 16:48:24
attackbotsspam
Sep 12 11:42:30 XXXXXX sshd[37506]: Invalid user ec2-user from 13.85.152.27 port 38212
2020-09-12 20:57:25
attack
Invalid user ansible from 13.85.152.27 port 49806
2020-09-12 12:59:15
attack
Sep 11 21:26:20 dev0-dcde-rnet sshd[3893]: Failed password for root from 13.85.152.27 port 56074 ssh2
Sep 11 21:26:20 dev0-dcde-rnet sshd[3895]: Failed password for root from 13.85.152.27 port 34230 ssh2
2020-09-12 04:48:52
attackbotsspam
[ssh] SSH attack
2020-09-10 02:29:23
attack
leo_www
2020-09-03 12:17:05
attackspam
$lgm
2020-09-03 04:35:36
attackspambots
Sep  1 19:31:01 dcd-gentoo sshd[20633]: User root from 13.85.152.27 not allowed because none of user's groups are listed in AllowGroups
Sep  1 19:31:03 dcd-gentoo sshd[20636]: User root from 13.85.152.27 not allowed because none of user's groups are listed in AllowGroups
Sep  1 19:32:58 dcd-gentoo sshd[20693]: Invalid user ec2-user from 13.85.152.27 port 50800
...
2020-09-02 02:12:37
attackbotsspam
2020-09-01T00:03:37.102868abusebot-6.cloudsearch.cf sshd[15260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.85.152.27  user=root
2020-09-01T00:03:39.713571abusebot-6.cloudsearch.cf sshd[15260]: Failed password for root from 13.85.152.27 port 34268 ssh2
2020-09-01T00:03:39.015858abusebot-6.cloudsearch.cf sshd[15262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.85.152.27  user=root
2020-09-01T00:03:41.430833abusebot-6.cloudsearch.cf sshd[15262]: Failed password for root from 13.85.152.27 port 50536 ssh2
2020-09-01T00:03:41.623155abusebot-6.cloudsearch.cf sshd[15264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.85.152.27  user=root
2020-09-01T00:03:43.782424abusebot-6.cloudsearch.cf sshd[15264]: Failed password for root from 13.85.152.27 port 38624 ssh2
2020-09-01T00:03:47.077724abusebot-6.cloudsearch.cf sshd[15266]: pam_unix(sshd:auth): authenticat
...
2020-09-01 08:13:42
attack
Cowrie Honeypot: Unauthorised SSH/Telnet login attempt with user "root" at 2020-08-30T23:02:17Z
2020-08-31 07:52:53
attackspambots
 TCP (SYN) 13.85.152.27:54920 -> port 22, len 48
2020-08-30 07:48:25
attack
Aug 27 02:11:41 master sshd[28500]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28501]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28502]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28503]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:41 master sshd[28504]: Did not receive identification string from 13.85.152.27
Aug 27 02:11:59 master sshd[28505]: Failed password for root from 13.85.152.27 port 57900 ssh2
Aug 27 02:11:59 master sshd[28509]: Failed password for root from 13.85.152.27 port 33332 ssh2
Aug 27 02:11:59 master sshd[28506]: Failed password for root from 13.85.152.27 port 58418 ssh2
Aug 27 02:12:01 master sshd[28511]: Failed password for root from 13.85.152.27 port 45814 ssh2
Aug 27 02:12:01 master sshd[28513]: Failed password for root from 13.85.152.27 port 49060 ssh2
2020-08-27 07:57:05
Comments on same subnet:
No discussion about this subnet yet..
Whois info:
b
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 13.85.152.27
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51566
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;13.85.152.27.			IN	A

;; AUTHORITY SECTION:
.			373	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020082602 1800 900 604800 86400

;; Query time: 67 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Aug 27 07:57:01 CST 2020
;; MSG SIZE  rcvd: 116
Host info
Host 27.152.85.13.in-addr.arpa. not found: 3(NXDOMAIN)
Nslookup info:
Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 27.152.85.13.in-addr.arpa: NXDOMAIN
Related IP info:
Related comments:
IP Type Details Datetime
71.62.129.30 attackbotsspam
DATE:2020-03-23 19:40:34, IP:71.62.129.30, PORT:ssh SSH brute force auth (docker-dc)
2020-03-24 04:09:49
14.160.104.84 attack
20/3/23@11:45:20: FAIL: Alarm-Network address from=14.160.104.84
20/3/23@11:45:20: FAIL: Alarm-Network address from=14.160.104.84
...
2020-03-24 03:48:54
117.131.60.38 attack
Fail2Ban Ban Triggered
2020-03-24 04:12:02
77.82.90.234 attackbots
2020-03-23T06:52:06.760661homeassistant sshd[383]: Invalid user hoandy from 77.82.90.234 port 50276
2020-03-23T06:52:06.772811homeassistant sshd[383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.82.90.234
2020-03-23T06:52:09.179569homeassistant sshd[383]: Failed password for invalid user hoandy from 77.82.90.234 port 50276 ssh2
...
2020-03-24 04:09:20
61.246.33.106 attackspam
Mar 23 19:40:15 game-panel sshd[27949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.246.33.106
Mar 23 19:40:18 game-panel sshd[27949]: Failed password for invalid user www from 61.246.33.106 port 60328 ssh2
Mar 23 19:42:34 game-panel sshd[28019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.246.33.106
2020-03-24 04:03:51
180.250.247.45 attackspam
(sshd) Failed SSH login from 180.250.247.45 (ID/Indonesia/-): 5 in the last 3600 secs
2020-03-24 04:02:48
222.120.14.166 attack
20/3/23@11:45:11: FAIL: IoT-Telnet address from=222.120.14.166
...
2020-03-24 03:57:13
113.168.175.37 attackbotsspam
Unauthorized connection attempt from IP address 113.168.175.37 on Port 445(SMB)
2020-03-24 03:48:31
152.67.67.89 attackspambots
Mar 23 13:44:48 askasleikir sshd[358083]: Failed password for invalid user stavang from 152.67.67.89 port 40900 ssh2
Mar 23 13:39:53 askasleikir sshd[357862]: Failed password for invalid user merle from 152.67.67.89 port 38028 ssh2
Mar 23 13:25:19 askasleikir sshd[357063]: Failed password for invalid user jmail from 152.67.67.89 port 57698 ssh2
2020-03-24 04:13:10
180.76.249.74 attack
(sshd) Failed SSH login from 180.76.249.74 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Mar 23 20:01:43 elude sshd[11534]: Invalid user sabeurbh from 180.76.249.74 port 48398
Mar 23 20:01:45 elude sshd[11534]: Failed password for invalid user sabeurbh from 180.76.249.74 port 48398 ssh2
Mar 23 20:06:18 elude sshd[11773]: Invalid user bree from 180.76.249.74 port 56548
Mar 23 20:06:20 elude sshd[11773]: Failed password for invalid user bree from 180.76.249.74 port 56548 ssh2
Mar 23 20:09:39 elude sshd[11988]: Invalid user dixie from 180.76.249.74 port 50520
2020-03-24 04:26:19
141.8.183.90 attack
[Mon Mar 23 22:45:10.601907 2020] [:error] [pid 25293:tid 140519768332032] [client 141.8.183.90:39169] [client 141.8.183.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XnjZhrdSec56q6n39A6CPwAAAqM"]
...
2020-03-24 03:58:58
196.52.55.200 attackspam
Lines containing failures of 196.52.55.200
Mar 23 16:31:26 shared12 sshd[8509]: Did not receive identification string from 196.52.55.200 port 33744
Mar 23 16:31:26 shared12 sshd[8510]: Did not receive identification string from 196.52.55.200 port 41464
Mar 23 16:32:39 shared12 sshd[9464]: Did not receive identification string from 196.52.55.200 port 53608
Mar 23 16:32:39 shared12 sshd[9465]: Did not receive identification string from 196.52.55.200 port 60926
Mar 23 16:32:52 shared12 sshd[9467]: Invalid user nologin from 196.52.55.200 port 32828
Mar 23 16:32:52 shared12 sshd[9467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.52.55.200
Mar 23 16:32:52 shared12 sshd[9466]: Invalid user nologin from 196.52.55.200 port 40132
Mar 23 16:32:52 shared12 sshd[9466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=196.52.55.200


........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=196.52.
2020-03-24 04:25:35
103.89.176.74 attackbotsspam
Invalid user evolution from 103.89.176.74 port 55690
2020-03-24 04:11:21
193.56.28.230 attackbots
Brute forcing email accounts
2020-03-24 03:52:41
24.142.36.105 attackbots
2020-03-23T17:32:48.956416v22018076590370373 sshd[15154]: Invalid user tz from 24.142.36.105 port 33576
2020-03-23T17:32:48.962820v22018076590370373 sshd[15154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.142.36.105
2020-03-23T17:32:48.956416v22018076590370373 sshd[15154]: Invalid user tz from 24.142.36.105 port 33576
2020-03-23T17:32:51.234912v22018076590370373 sshd[15154]: Failed password for invalid user tz from 24.142.36.105 port 33576 ssh2
2020-03-23T17:35:50.209189v22018076590370373 sshd[4433]: Invalid user musicbot from 24.142.36.105 port 46726
...
2020-03-24 04:26:06

Recently Reported IPs

41.116.96.104 24.169.230.14 78.123.108.173 221.187.142.120
159.72.196.237 97.212.18.220 80.6.203.28 188.131.142.46
187.184.128.246 14.145.245.228 24.169.70.85 80.155.173.207
187.17.54.80 74.62.252.57 63.112.14.90 178.34.240.137
96.3.163.89 106.223.135.213 83.226.68.136 151.21.4.146