173.249.2.213 - IPInfo

Basic Info

City: Nuremberg

Region: Bavaria

Country: Germany

Internet Service Provider: Contabo GmbH

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	Detected by Maltrail	2020-01-19 07:19:19
attackbots	173.249.2.213 was recorded 5 times by 2 hosts attempting to connect to the following ports: 80. Incident counter (4h, 24h, all-time): 5, 10, 66	2019-11-21 03:06:40

Comments on same subnet:

IP	Type	Details	Datetime
173.249.28.43	attack	$f2bV_matches	2020-10-05 05:01:29
173.249.28.43	attackbotsspam	173.249.28.43 - - [04/Oct/2020:11:57:39 +0100] "POST /wp-login.php HTTP/1.1" 200 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [04/Oct/2020:11:57:40 +0100] "POST /wp-login.php HTTP/1.1" 200 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [04/Oct/2020:11:57:41 +0100] "POST /wp-login.php HTTP/1.1" 200 4425 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-10-04 20:55:57
173.249.28.43	attackspam	173.249.28.43 - - [04/Oct/2020:03:11:31 +0100] "POST /wp-login.php HTTP/1.1" 200 2540 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [04/Oct/2020:03:11:32 +0100] "POST /wp-login.php HTTP/1.1" 200 2521 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [04/Oct/2020:03:11:33 +0100] "POST /xmlrpc.php HTTP/1.1" 200 247 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2020-10-04 12:39:17
173.249.28.43	attackbots	173.249.28.43 - - [26/Sep/2020:07:09:35 +0200] "GET /wp-login.php HTTP/1.1" 200 9061 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [26/Sep/2020:07:09:35 +0200] "POST /wp-login.php HTTP/1.1" 200 9312 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [26/Sep/2020:07:09:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-27 00:37:32
173.249.28.43	attackbotsspam	173.249.28.43 - - [26/Sep/2020:07:09:35 +0200] "GET /wp-login.php HTTP/1.1" 200 9061 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [26/Sep/2020:07:09:35 +0200] "POST /wp-login.php HTTP/1.1" 200 9312 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 173.249.28.43 - - [26/Sep/2020:07:09:36 +0200] "POST /xmlrpc.php HTTP/1.1" 200 427 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"	2020-09-26 16:26:57
173.249.20.17	attack	Port Scan detected from 173.249.20.17 (DE/Germany/Bavaria/Munich (Ramersdorf-Perlach)/vmi429591.contaboserver.net). 4 hits in the last 261 seconds	2020-08-16 14:38:28
173.249.20.17	attackspambots	Port Scan detected from 173.249.20.17 (DE/Germany/Bavaria/Munich (Ramersdorf-Perlach)/vmi429591.contaboserver.net). 4 hits in the last 65 seconds	2020-08-15 07:13:57
173.249.29.113	attack	6000/tcp 6000/tcp [2020-08-04/05]2pkt	2020-08-06 15:59:53
173.249.2.13	attackspam	20 attempts against mh-misbehave-ban on plane	2020-07-06 06:37:28
173.249.20.57	attackbots	Invalid user pbsdata from 173.249.20.57 port 43556	2020-06-26 05:11:34
173.249.28.54	attackspambots	2020-06-21T17:49:45.145765mail.csmailer.org sshd[11719]: Failed password for invalid user user1 from 173.249.28.54 port 33054 ssh2 2020-06-21T17:52:50.846019mail.csmailer.org sshd[12156]: Invalid user hotline from 173.249.28.54 port 60858 2020-06-21T17:52:50.854734mail.csmailer.org sshd[12156]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=vmi398515.contaboserver.net 2020-06-21T17:52:50.846019mail.csmailer.org sshd[12156]: Invalid user hotline from 173.249.28.54 port 60858 2020-06-21T17:52:52.727992mail.csmailer.org sshd[12156]: Failed password for invalid user hotline from 173.249.28.54 port 60858 ssh2 ...	2020-06-22 04:22:30
173.249.20.57	attackspam	Jun 21 16:03:03 sso sshd[13678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.249.20.57 Jun 21 16:03:05 sso sshd[13678]: Failed password for invalid user kitty from 173.249.20.57 port 57344 ssh2 ...	2020-06-22 00:14:32
173.249.28.54	attackbotsspam	2020-06-21T11:25:41.601779amanda2.illicoweb.com sshd\[4400\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=vmi398515.contaboserver.net user=nagios 2020-06-21T11:25:43.766910amanda2.illicoweb.com sshd\[4400\]: Failed password for nagios from 173.249.28.54 port 58752 ssh2 2020-06-21T11:28:53.967244amanda2.illicoweb.com sshd\[4782\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=vmi398515.contaboserver.net user=root 2020-06-21T11:28:55.825894amanda2.illicoweb.com sshd\[4782\]: Failed password for root from 173.249.28.54 port 59052 ssh2 2020-06-21T11:31:54.366143amanda2.illicoweb.com sshd\[4994\]: Invalid user padeoe from 173.249.28.54 port 59360 2020-06-21T11:31:54.368369amanda2.illicoweb.com sshd\[4994\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=vmi398515.contaboserver.net ...	2020-06-21 18:45:22
173.249.28.54	attackspambots	web-1 [ssh_2] SSH Attack	2020-06-20 18:20:21
173.249.24.3	attackbots	20 attempts against mh-misbehave-ban on storm	2020-06-10 14:26:46

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 173.249.2.213
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13750
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;173.249.2.213.			IN	A

;; AUTHORITY SECTION:
.			240	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019112002 1800 900 604800 86400

;; Query time: 957 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Nov 21 03:06:38 CST 2019
;; MSG SIZE  rcvd: 117

Host info

213.2.249.173.in-addr.arpa domain name pointer vmi196945.contaboserver.net.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
213.2.249.173.in-addr.arpa	name = vmi196945.contaboserver.net.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
45.79.106.170	attackbotsspam	Unauthorised access (Nov 30) SRC=45.79.106.170 LEN=40 TTL=239 ID=54321 TCP DPT=8080 WINDOW=65535 SYN	2019-11-30 23:22:31
185.238.237.98	attackbotsspam	Automatic report - Port Scan Attack	2019-11-30 23:04:07
138.68.93.14	attackbots	Nov 30 16:14:14 mout sshd[22381]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.93.14 user=root Nov 30 16:14:16 mout sshd[22381]: Failed password for root from 138.68.93.14 port 41870 ssh2	2019-11-30 23:24:19
37.49.230.63	attackbotsspam	\[2019-11-30 10:24:58\] NOTICE\[2754\] chan_sip.c: Registration from '"1018" \' failed for '37.49.230.63:5679' - Wrong password \[2019-11-30 10:24:58\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T10:24:58.219-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1018",SessionID="0x7f26c4a90648",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/37.49.230.63/5679",Challenge="5c9390d6",ReceivedChallenge="5c9390d6",ReceivedHash="75b33e302abd2431f595017a58684120" \[2019-11-30 10:24:58\] NOTICE\[2754\] chan_sip.c: Registration from '"1018" \' failed for '37.49.230.63:5679' - Wrong password \[2019-11-30 10:24:58\] SECURITY\[2765\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-11-30T10:24:58.329-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1018",SessionID="0x7f26c4ab1d88",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/3	2019-11-30 23:31:15
64.102.242.154	attackbots	3389BruteforceFW21	2019-11-30 23:36:56
219.148.37.34	attackspam	Nov 30 15:34:19 sd-53420 sshd\[17512\]: Invalid user happy from 219.148.37.34 Nov 30 15:34:19 sd-53420 sshd\[17512\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.148.37.34 Nov 30 15:34:20 sd-53420 sshd\[17512\]: Failed password for invalid user happy from 219.148.37.34 port 49681 ssh2 Nov 30 15:38:21 sd-53420 sshd\[18104\]: User root from 219.148.37.34 not allowed because none of user's groups are listed in AllowGroups Nov 30 15:38:21 sd-53420 sshd\[18104\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.148.37.34 user=root ...	2019-11-30 23:01:42
14.98.4.82	attack	fail2ban	2019-11-30 23:26:09
174.62.92.148	attackspam	2019-11-28T20:25:52.450012ldap.arvenenaske.de sshd[24461]: Connection from 174.62.92.148 port 51502 on 5.199.128.55 port 22 2019-11-28T20:25:53.445804ldap.arvenenaske.de sshd[24461]: Invalid user brose from 174.62.92.148 port 51502 2019-11-28T20:25:53.453572ldap.arvenenaske.de sshd[24461]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.62.92.148 user=brose 2019-11-28T20:25:53.454684ldap.arvenenaske.de sshd[24461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.62.92.148 2019-11-28T20:25:52.450012ldap.arvenenaske.de sshd[24461]: Connection from 174.62.92.148 port 51502 on 5.199.128.55 port 22 2019-11-28T20:25:53.445804ldap.arvenenaske.de sshd[24461]: Invalid user brose from 174.62.92.148 port 51502 2019-11-28T20:25:55.442817ldap.arvenenaske.de sshd[24461]: Failed password for invalid user brose from 174.62.92.148 port 51502 ssh2 2019-11-28T20:29:28.374446ldap.arvenenaske.de sshd[24464........ ------------------------------	2019-11-30 23:19:33
82.76.142.238	attackbotsspam	Automatic report - Port Scan Attack	2019-11-30 23:36:25
45.82.153.35	attack	11/30/2019-10:35:47.895742 45.82.153.35 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 42	2019-11-30 23:38:45
45.82.139.72	attackbotsspam	SSH/22 MH Probe, BF, Hack -	2019-11-30 23:29:37
92.50.249.166	attackbotsspam	Nov 30 15:06:54 web8 sshd\[5947\]: Invalid user www from 92.50.249.166 Nov 30 15:06:54 web8 sshd\[5947\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.166 Nov 30 15:06:55 web8 sshd\[5947\]: Failed password for invalid user www from 92.50.249.166 port 42854 ssh2 Nov 30 15:10:17 web8 sshd\[7522\]: Invalid user nejdborn from 92.50.249.166 Nov 30 15:10:17 web8 sshd\[7522\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.50.249.166	2019-11-30 23:24:40
203.193.173.179	attackbots	3389BruteforceFW21	2019-11-30 23:44:58
166.62.120.114	attackspam	Joomla Backend Login Attempt (probe)	2019-11-30 23:22:50
218.92.0.191	attack	Nov 30 16:38:24 dcd-gentoo sshd[6270]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups Nov 30 16:38:26 dcd-gentoo sshd[6270]: error: PAM: Authentication failure for illegal user root from 218.92.0.191 Nov 30 16:38:24 dcd-gentoo sshd[6270]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups Nov 30 16:38:26 dcd-gentoo sshd[6270]: error: PAM: Authentication failure for illegal user root from 218.92.0.191 Nov 30 16:38:24 dcd-gentoo sshd[6270]: User root from 218.92.0.191 not allowed because none of user's groups are listed in AllowGroups Nov 30 16:38:26 dcd-gentoo sshd[6270]: error: PAM: Authentication failure for illegal user root from 218.92.0.191 Nov 30 16:38:26 dcd-gentoo sshd[6270]: Failed keyboard-interactive/pam for invalid user root from 218.92.0.191 port 63958 ssh2 ...	2019-11-30 23:40:24

Recently Reported IPs

99.237.196.196	173.75.17.39	1.31.177.26	75.20.138.84
142.4.196.33	132.157.212.230	196.85.27.82	35.40.114.202
188.38.47.199	92.146.199.207	104.148.188.77	220.130.247.118
173.235.188.115	60.251.43.28	37.192.93.98	102.60.90.95
124.44.177.199	181.129.130.226	124.26.156.204	211.60.0.0