138.197.73.215

Basic Info

City: unknown

Region: unknown

Country: United States

Internet Service Provider: DigitalOcean LLC

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	SSH Authentication Attempts Exceeded	2020-03-13 05:03:18
attackspambots	Jan 31 20:34:35 MK-Soft-VM8 sshd[5740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 Jan 31 20:34:37 MK-Soft-VM8 sshd[5740]: Failed password for invalid user weblogic from 138.197.73.215 port 58952 ssh2 ...	2020-02-01 03:50:30
attackspam	Unauthorized connection attempt detected from IP address 138.197.73.215 to port 2220 [J]	2020-01-28 07:02:07
attackbotsspam	Unauthorized connection attempt detected from IP address 138.197.73.215 to port 2220 [J]	2020-01-26 13:43:42
attack	$f2bV_matches	2020-01-12 00:39:16
attackbots	Jan 4 07:23:06 ms-srv sshd[4410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 Jan 4 07:23:08 ms-srv sshd[4410]: Failed password for invalid user teste2 from 138.197.73.215 port 40850 ssh2	2020-01-04 20:31:04
attack	Dec 22 10:20:29 vibhu-HP-Z238-Microtower-Workstation sshd\[10704\]: Invalid user samhaber from 138.197.73.215 Dec 22 10:20:29 vibhu-HP-Z238-Microtower-Workstation sshd\[10704\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 Dec 22 10:20:31 vibhu-HP-Z238-Microtower-Workstation sshd\[10704\]: Failed password for invalid user samhaber from 138.197.73.215 port 45092 ssh2 Dec 22 10:25:32 vibhu-HP-Z238-Microtower-Workstation sshd\[11024\]: Invalid user guest from 138.197.73.215 Dec 22 10:25:32 vibhu-HP-Z238-Microtower-Workstation sshd\[11024\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 ...	2019-12-22 13:09:03
attack	$f2bV_matches	2019-12-21 05:58:52
attackspam	Dec 15 18:13:36 mail sshd[21503]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 Dec 15 18:13:38 mail sshd[21503]: Failed password for invalid user ale from 138.197.73.215 port 45528 ssh2 Dec 15 18:19:09 mail sshd[23711]: Failed password for uucp from 138.197.73.215 port 53912 ssh2	2019-12-16 05:47:07
attackspam	Dec 5 09:21:11 sachi sshd\[728\]: Invalid user password12346 from 138.197.73.215 Dec 5 09:21:11 sachi sshd\[728\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 Dec 5 09:21:13 sachi sshd\[728\]: Failed password for invalid user password12346 from 138.197.73.215 port 36834 ssh2 Dec 5 09:26:46 sachi sshd\[1272\]: Invalid user thoennes from 138.197.73.215 Dec 5 09:26:46 sachi sshd\[1272\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215	2019-12-06 03:33:06
attackbotsspam	Dec 5 08:32:43 sauna sshd[89382]: Failed password for root from 138.197.73.215 port 38838 ssh2 ...	2019-12-05 14:54:27
attack	Dec 4 08:15:04 ns381471 sshd[16126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 Dec 4 08:15:07 ns381471 sshd[16126]: Failed password for invalid user coiote from 138.197.73.215 port 49682 ssh2	2019-12-04 15:47:57
attackspambots	Lines containing failures of 138.197.73.215 Nov 20 19:31:44 jarvis sshd[24257]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 user=mysql Nov 20 19:31:46 jarvis sshd[24257]: Failed password for mysql from 138.197.73.215 port 58422 ssh2 Nov 20 19:31:47 jarvis sshd[24257]: Received disconnect from 138.197.73.215 port 58422:11: Bye Bye [preauth] Nov 20 19:31:47 jarvis sshd[24257]: Disconnected from authenticating user mysql 138.197.73.215 port 58422 [preauth] Nov 20 19:52:32 jarvis sshd[27983]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.73.215 user=r.r Nov 20 19:52:35 jarvis sshd[27983]: Failed password for r.r from 138.197.73.215 port 59156 ssh2 Nov 20 19:52:36 jarvis sshd[27983]: Received disconnect from 138.197.73.215 port 59156:11: Bye Bye [preauth] Nov 20 19:52:36 jarvis sshd[27983]: Disconnected from authenticating user r.r 138.197.73.215 port 59156 [preauth]........ ------------------------------	2019-11-23 16:45:37

Comments on same subnet:

IP	Type	Details	Datetime
138.197.73.177	attack	firewall-block, port(s): 19326/tcp	2020-07-14 03:48:29
138.197.73.177	attack	SIP/5060 Probe, BF, Hack -	2020-07-06 16:43:10
138.197.73.177	attackspam	" "	2020-07-01 06:22:32
138.197.73.177	attack	TCP ports : 1333 / 6333 / 7265 / 15100 / 18504 / 18990 / 20059 / 21802 / 22167 / 25912	2020-06-21 17:16:56
138.197.73.177	attack	TCP (SYN) 138.197.73.177:57671 -> port 15424, len 44	2020-06-11 17:41:22
138.197.73.177	attack	TCP (SYN) 138.197.73.177:44562 -> port 29625, len 44	2020-06-09 01:30:50
138.197.73.187	attackbots	Fail2Ban Ban Triggered	2019-11-30 18:17:33
138.197.73.156	attackbotsspam	www.pfaffenroth-photographie.de 138.197.73.156 \[20/Jul/2019:03:35:36 +0200\] "POST /wp-login.php HTTP/1.1" 200 8450 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0" www.pfaffenroth-photographie.de 138.197.73.156 \[20/Jul/2019:03:35:41 +0200\] "POST /wp-login.php HTTP/1.1" 200 8450 "-" "Mozilla/5.0 $X11\; Ubuntu\; Linux x86_64\; rv:62.0$ Gecko/20100101 Firefox/62.0"	2019-07-20 11:29:57
138.197.73.65	attackspam	fail2ban honeypot	2019-07-01 10:52:24
138.197.73.65	attack	WordPress login Brute force / Web App Attack on client site.	2019-06-26 18:35:22
138.197.73.65	attack	WP Authentication failure	2019-06-22 22:47:04

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 138.197.73.215
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 63873
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;138.197.73.215.			IN	A

;; AUTHORITY SECTION:
.			569	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019112300 1800 900 604800 86400

;; Query time: 82 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Nov 23 16:45:32 CST 2019
;; MSG SIZE  rcvd: 118

Host info

Host 215.73.197.138.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 215.73.197.138.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
211.227.70.56	attackbots	Sep 22 14:00:13 scw-focused-cartwright sshd[21146]: Failed password for root from 211.227.70.56 port 60680 ssh2	2020-09-23 15:28:53
222.138.16.151	attack	Telnet Honeypot -> Telnet Bruteforce / Login	2020-09-23 15:22:54
103.134.9.249	attackbots	Unauthorized connection attempt from IP address 103.134.9.249 on Port 445(SMB)	2020-09-23 15:42:40
31.220.40.239	attackspambots	Lines containing failures of 31.220.40.239 Sep 22 18:50:12 install sshd[17223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.40.239 user=admin Sep 22 18:50:14 install sshd[17223]: Failed password for admin from 31.220.40.239 port 55190 ssh2 Sep 22 18:50:14 install sshd[17223]: Connection closed by authenticating user admin 31.220.40.239 port 55190 [preauth] Sep 22 18:59:35 install sshd[21225]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.220.40.239 user=admin ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=31.220.40.239	2020-09-23 15:32:15
78.187.15.121	attack	Unauthorized connection attempt from IP address 78.187.15.121 on Port 445(SMB)	2020-09-23 15:57:25
27.74.242.251	attackbots	Unauthorized connection attempt from IP address 27.74.242.251 on Port 445(SMB)	2020-09-23 15:21:43
220.133.244.216	attack	TCP (SYN) 220.133.244.216:11573 -> port 23, len 44	2020-09-23 15:32:53
123.59.62.57	attackspambots	$f2bV_matches	2020-09-23 15:55:41
141.136.35.207	attack	Sep 23 03:21:37 www sshd\[60333\]: Invalid user admin from 141.136.35.207Sep 23 03:21:39 www sshd\[60333\]: Failed password for invalid user admin from 141.136.35.207 port 42018 ssh2Sep 23 03:25:25 www sshd\[60456\]: Failed password for root from 141.136.35.207 port 57076 ssh2 ...	2020-09-23 15:48:04
18.230.134.121	attackbots	Fail2Ban Ban Triggered	2020-09-23 15:21:58
150.109.100.65	attackbots	Invalid user jun from 150.109.100.65 port 40112	2020-09-23 15:46:57
178.16.150.138	attack	Unauthorized connection attempt from IP address 178.16.150.138 on Port 445(SMB)	2020-09-23 15:45:25
27.2.240.248	attackbots	Connection to SSH Honeypot - Detected by HoneypotDB	2020-09-23 15:26:59
155.159.252.25	attackbots	Sep 23 02:09:28 r.ca sshd[14759]: Failed password for invalid user demo2 from 155.159.252.25 port 37652 ssh2	2020-09-23 15:24:31
31.204.177.224	attack	Sep 22 17:01:54 ssh2 sshd[20590]: Invalid user pi from 31.204.177.224 port 48648 Sep 22 17:01:55 ssh2 sshd[20590]: Failed password for invalid user pi from 31.204.177.224 port 48648 ssh2 Sep 22 17:01:55 ssh2 sshd[20590]: Connection closed by invalid user pi 31.204.177.224 port 48648 [preauth] ...	2020-09-23 15:37:40

Recently Reported IPs

134.209.50.169	5.59.133.133	216.245.204.34	130.162.102.37
138.94.112.14	85.143.216.212	59.197.229.77	104.248.145.71
45.224.251.242	37.151.181.154	37.15.19.34	109.74.73.186
116.49.79.36	175.182.185.197	69.250.156.161	177.11.57.43
121.46.4.222	139.180.138.231	137.83.79.163	86.178.164.69