134.209.20.2 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: United Kingdom

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	DATE:2019-07-20_03:37:16, IP:134.209.20.2, PORT:telnet Telnet brute force auth on honeypot server (honey-neo-dc)	2019-07-20 10:44:59

Comments on same subnet:

IP	Type	Details	Datetime
134.209.207.188	spambotsattack	ET DROP Dshield Block Listed Source group 1 - port: 8080 proto: tcp cat: Misc Attackbytes: 60	2023-02-18 16:14:41
134.209.204.124	attackbots	SSH Bruteforce attack	2020-08-23 07:56:22
134.209.208.159	attackbots	Port scan: Attack repeated for 24 hours	2020-06-21 00:54:32
134.209.201.23	attack	3423/tcp 2974/tcp 726/tcp... [2020-06-01/19]44pkt,15pt.(tcp)	2020-06-20 05:41:48
134.209.208.159	attackspambots	TCP (SYN) 134.209.208.159:46179 -> port 7425, len 44	2020-06-15 15:37:35
134.209.208.159	attackbotsspam	firewall-block, port(s): 25804/tcp	2020-06-13 15:11:57
134.209.208.159	attackspam	May 29 22:50:47 debian-2gb-nbg1-2 kernel: \[13044230.816351\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=134.209.208.159 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=6339 PROTO=TCP SPT=58161 DPT=3540 WINDOW=1024 RES=0x00 SYN URGP=0	2020-05-30 05:16:17
134.209.208.159	attack	Port scan: Attack repeated for 24 hours	2020-05-03 01:12:31
134.209.208.159	attackbotsspam	firewall-block, port(s): 22225/tcp	2020-04-25 05:33:25
134.209.208.159	attack	Port scan(s) denied	2020-04-20 16:28:29
134.209.208.159	attackbotsspam	firewall-block, port(s): 15661/tcp	2020-04-13 06:33:44
134.209.203.34	attack	SSH/22 MH Probe, BF, Hack -	2020-02-12 23:47:18
134.209.203.238	attackbotsspam	WordPress wp-login brute force :: 134.209.203.238 0.112 BYPASS [17/Jan/2020:13:00:55 0000] [censored_2] "POST /wp-login.php HTTP/1.1" 200 2287 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-01-18 01:05:40
134.209.208.91	attack	IP: 134.209.208.91 Ports affected Simple Mail Transfer (25) Abuse Confidence rating 16% Found in DNSBL('s) ASN Details AS14061 DigitalOcean LLC United States (US) CIDR 134.209.0.0/16 Log Date: 16/01/2020 11:43:21 AM UTC	2020-01-16 20:09:58
134.209.205.254	attack	Jan 13 22:56:46 ArkNodeAT sshd\[12332\]: Invalid user dev from 134.209.205.254 Jan 13 22:56:46 ArkNodeAT sshd\[12332\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.205.254 Jan 13 22:56:47 ArkNodeAT sshd\[12332\]: Failed password for invalid user dev from 134.209.205.254 port 50846 ssh2	2020-01-14 06:03:56

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 134.209.20.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 8122
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;134.209.20.2.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019071902 1800 900 604800 86400

;; Query time: 4 msec
;; SERVER: 67.207.67.2#53(67.207.67.2)
;; WHEN: Sat Jul 20 10:44:53 CST 2019
;; MSG SIZE  rcvd: 116

Host info

Host 2.20.209.134.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.2
Address:	67.207.67.2#53

** server can't find 2.20.209.134.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
45.129.33.5	attackbotsspam	ET DROP Dshield Block Listed Source group 1 - port: 26900 proto: tcp cat: Misc Attackbytes: 60	2020-10-09 12:05:32
220.186.158.100	attackspam	Oct 9 01:50:51 sso sshd[4910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.186.158.100 Oct 9 01:50:53 sso sshd[4910]: Failed password for invalid user qcp from 220.186.158.100 port 59042 ssh2 ...	2020-10-09 08:04:37
202.191.132.211	attackbots	Unauthorised access (Oct 8) SRC=202.191.132.211 LEN=40 TTL=241 ID=42790 TCP DPT=1433 WINDOW=1024 SYN	2020-10-09 12:13:09
212.70.149.52	attackbotsspam	Oct 9 06:10:54 galaxy event: galaxy/lswi: smtp: alhagi@uni-potsdam.de [212.70.149.52] authentication failure using internet password Oct 9 06:11:19 galaxy event: galaxy/lswi: smtp: alhambresque@uni-potsdam.de [212.70.149.52] authentication failure using internet password Oct 9 06:11:45 galaxy event: galaxy/lswi: smtp: ali@uni-potsdam.de [212.70.149.52] authentication failure using internet password Oct 9 06:12:10 galaxy event: galaxy/lswi: smtp: ali@uni-potsdam.de [212.70.149.52] authentication failure using internet password Oct 9 06:12:35 galaxy event: galaxy/lswi: smtp: aliakcay@uni-potsdam.de [212.70.149.52] authentication failure using internet password ...	2020-10-09 12:14:19
116.252.208.48	attackbots	IP 116.252.208.48 attacked honeypot on port: 5555 at 10/7/2020 1:43:12 PM	2020-10-09 08:01:45
125.117.168.14	attackspam	Oct 8 22:47:55 srv01 postfix/smtpd\[23398\]: warning: unknown\[125.117.168.14\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Oct 8 22:48:07 srv01 postfix/smtpd\[23398\]: warning: unknown\[125.117.168.14\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Oct 8 22:48:23 srv01 postfix/smtpd\[23398\]: warning: unknown\[125.117.168.14\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Oct 8 22:48:42 srv01 postfix/smtpd\[23398\]: warning: unknown\[125.117.168.14\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 Oct 8 22:48:54 srv01 postfix/smtpd\[23398\]: warning: unknown\[125.117.168.14\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6 ...	2020-10-09 12:23:22
51.75.18.215	attack	Oct 9 06:02:42 srv-ubuntu-dev3 sshd[91647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.18.215 user=root Oct 9 06:02:45 srv-ubuntu-dev3 sshd[91647]: Failed password for root from 51.75.18.215 port 42962 ssh2 Oct 9 06:06:21 srv-ubuntu-dev3 sshd[92078]: Invalid user fred from 51.75.18.215 Oct 9 06:06:21 srv-ubuntu-dev3 sshd[92078]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.18.215 Oct 9 06:06:21 srv-ubuntu-dev3 sshd[92078]: Invalid user fred from 51.75.18.215 Oct 9 06:06:24 srv-ubuntu-dev3 sshd[92078]: Failed password for invalid user fred from 51.75.18.215 port 49512 ssh2 Oct 9 06:09:59 srv-ubuntu-dev3 sshd[92530]: Invalid user ftpuser from 51.75.18.215 Oct 9 06:09:59 srv-ubuntu-dev3 sshd[92530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.75.18.215 Oct 9 06:09:59 srv-ubuntu-dev3 sshd[92530]: Invalid user ftpuser from 51.75.18.215 ...	2020-10-09 12:13:23
32.117.164.214	attackbotsspam	Oct 9 08:58:11 mx sshd[1279887]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=32.117.164.214 Oct 9 08:58:11 mx sshd[1279887]: Invalid user postgres from 32.117.164.214 port 50296 Oct 9 08:58:13 mx sshd[1279887]: Failed password for invalid user postgres from 32.117.164.214 port 50296 ssh2 Oct 9 09:01:56 mx sshd[1279922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=32.117.164.214 user=root Oct 9 09:01:58 mx sshd[1279922]: Failed password for root from 32.117.164.214 port 55794 ssh2 ...	2020-10-09 12:13:58
2.206.214.120	attackspambots	Unauthorized connection attempt detected Error 401	2020-10-09 12:22:52
120.92.94.95	attack	Oct 9 04:50:47 ajax sshd[20051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.92.94.95 Oct 9 04:50:50 ajax sshd[20051]: Failed password for invalid user clamav from 120.92.94.95 port 5874 ssh2	2020-10-09 12:21:10
43.226.38.214	attack	$f2bV_matches	2020-10-09 12:12:38
182.61.49.107	attackbots	Oct 9 04:45:05 ns382633 sshd\[8179\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.49.107 user=root Oct 9 04:45:07 ns382633 sshd\[8179\]: Failed password for root from 182.61.49.107 port 59850 ssh2 Oct 9 04:52:23 ns382633 sshd\[9145\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.49.107 user=root Oct 9 04:52:24 ns382633 sshd\[9145\]: Failed password for root from 182.61.49.107 port 51430 ssh2 Oct 9 04:56:45 ns382633 sshd\[9784\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.49.107 user=root	2020-10-09 12:24:20
217.116.26.90	attack	Suspicious access to SMTP/POP/IMAP services.	2020-10-09 12:25:54
180.69.27.217	attackspam	repeated SSH login attempts	2020-10-09 12:12:09
27.77.197.132	attack	TCP (SYN) 27.77.197.132:1066 -> port 23, len 44	2020-10-09 08:03:50

Recently Reported IPs

171.101.241.142	117.240.211.122	138.197.73.156	134.73.161.163
186.202.136.245	209.235.35.125	151.54.165.182	52.15.52.143
138.197.213.180	77.35.3.74	52.172.40.62	177.37.199.46
154.117.159.218	46.21.198.180	103.205.68.2	99.255.149.190
15.230.182.145	174.89.107.73	206.189.208.157	193.31.119.174