202.52.14.74 - IPInfo

Basic Info

City: Bandung

Region: West Java

Country: Indonesia

Internet Service Provider: PT Skyline Semesta

Hostname: unknown

Organization: unknown

Usage Type: Fixed Line ISP

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	SS5,DEF GET /MyAdmin/scripts/setup.php	2019-11-28 01:15:32
attack	REQUESTED PAGE: /scripts/setup.php	2019-11-25 02:42:08

Comments on same subnet:

IP	Type	Details	Datetime
202.52.147.83	attack	IP blocked	2020-04-02 06:01:03
202.52.146.45	attackspam	202.52.146.45 - - [28/Aug/2019:16:10:48 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 202.52.146.45 - - [28/Aug/2019:16:10:49 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 202.52.146.45 - - [28/Aug/2019:16:10:50 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 202.52.146.45 - - [28/Aug/2019:16:10:51 +0200] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 202.52.146.45 - - [28/Aug/2019:16:10:52 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 202.52.146.45 - - [28/Aug/2019:16:10:53 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-08-29 06:58:14

Type

Details

Datetime

202.52.147.83

attack

IP blocked

2020-04-02 06:01:03

202.52.146.45

attackspam

202.52.146.45 - - [28/Aug/2019:16:10:48 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
202.52.146.45 - - [28/Aug/2019:16:10:49 +0200] "POST /wp-login.php HTTP/1.1" 200 1503 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
202.52.146.45 - - [28/Aug/2019:16:10:50 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
202.52.146.45 - - [28/Aug/2019:16:10:51 +0200] "POST /wp-login.php HTTP/1.1" 200 1489 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
202.52.146.45 - - [28/Aug/2019:16:10:52 +0200] "GET /wp-login.php HTTP/1.1" 200 1122 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
202.52.146.45 - - [28/Aug/2019:16:10:53 +0200] "POST /wp-login.php HTTP/1.1" 200 1491 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

2019-08-29 06:58:14

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 202.52.14.74
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18154
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;202.52.14.74.			IN	A

;; AUTHORITY SECTION:
.			588	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019112401 1800 900 604800 86400

;; Query time: 526 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Nov 25 02:42:06 CST 2019
;; MSG SIZE  rcvd: 116

Host info

74.14.52.202.in-addr.arpa domain name pointer smkn1-krw.skyline.net.id.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
74.14.52.202.in-addr.arpa	name = smkn1-krw.skyline.net.id.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
120.24.97.204	attackbots	Port scan on 1 port(s): 2222	2020-01-20 04:56:21
156.67.211.177	attackspambots	Web Server Attack	2020-01-20 04:55:48
81.171.75.178	attackbots	[2020-01-19 16:08:40] NOTICE[2175] chan_sip.c: Registration from '' failed for '81.171.75.178:58116' - Wrong password [2020-01-19 16:08:40] SECURITY[2212] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-01-19T16:08:40.486-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="1388",SessionID="0x7f5ac4c6fb48",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.75.178/58116",Challenge="20d2e40e",ReceivedChallenge="20d2e40e",ReceivedHash="ca7c53f13e3285fdeb83bd282185bba4" [2020-01-19 16:09:05] NOTICE[2175] chan_sip.c: Registration from '' failed for '81.171.75.178:49219' - Wrong password [2020-01-19 16:09:05] SECURITY[2212] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-01-19T16:09:05.367-0500",Severity="Error",Service="SIP",EventVersion="2",AccountID="3443",SessionID="0x7f5ac48ee978",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/81.171.75.178 ...	2020-01-20 05:24:54
103.77.76.197	attack	Port 22 Scan, PTR: None	2020-01-20 05:04:20
222.186.180.17	attackspam	Jan 19 10:58:41 hanapaa sshd\[21348\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17 user=root Jan 19 10:58:43 hanapaa sshd\[21348\]: Failed password for root from 222.186.180.17 port 21522 ssh2 Jan 19 10:59:00 hanapaa sshd\[21389\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17 user=root Jan 19 10:59:02 hanapaa sshd\[21389\]: Failed password for root from 222.186.180.17 port 42890 ssh2 Jan 19 10:59:27 hanapaa sshd\[21414\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17 user=root	2020-01-20 05:03:17
94.59.100.113	attackbots	Unauthorized connection attempt detected from IP address 94.59.100.113 to port 80 [J]	2020-01-20 04:54:32
49.233.170.155	attack	Invalid user user from 49.233.170.155 port 58214	2020-01-20 04:54:17
148.66.134.12	attackspam	Jan 19 22:06:08 minden010 sshd[1081]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.134.12 Jan 19 22:06:10 minden010 sshd[1081]: Failed password for invalid user jenkins from 148.66.134.12 port 37682 ssh2 Jan 19 22:09:12 minden010 sshd[5008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.66.134.12 ...	2020-01-20 05:20:27
195.181.166.142	attackspam	spam via contact-form 19.01.2020 / 21:00	2020-01-20 05:08:50
175.16.162.23	attack	Unauthorised access (Jan 19) SRC=175.16.162.23 LEN=40 TTL=49 ID=51088 TCP DPT=8080 WINDOW=14847 SYN	2020-01-20 04:55:28
71.6.199.23	attackspambots	Unauthorized connection attempt detected from IP address 71.6.199.23 to port 79 [J]	2020-01-20 05:20:54
177.200.41.78	attack	Jan 19 23:50:33 server sshd\[31506\]: Invalid user gitlab from 177.200.41.78 Jan 19 23:50:33 server sshd\[31506\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.200.41.78 Jan 19 23:50:35 server sshd\[31506\]: Failed password for invalid user gitlab from 177.200.41.78 port 39510 ssh2 Jan 20 00:09:28 server sshd\[3662\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.200.41.78 user=root Jan 20 00:09:31 server sshd\[3662\]: Failed password for root from 177.200.41.78 port 59765 ssh2 ...	2020-01-20 05:09:57
179.127.59.220	attackspambots	Lines containing failures of 179.127.59.220 Jan 19 20:13:29 dns01 sshd[17926]: Invalid user nas from 179.127.59.220 port 55254 Jan 19 20:13:29 dns01 sshd[17926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.127.59.220 Jan 19 20:13:31 dns01 sshd[17926]: Failed password for invalid user nas from 179.127.59.220 port 55254 ssh2 Jan 19 20:13:31 dns01 sshd[17926]: Received disconnect from 179.127.59.220 port 55254:11: Bye Bye [preauth] Jan 19 20:13:31 dns01 sshd[17926]: Disconnected from invalid user nas 179.127.59.220 port 55254 [preauth] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=179.127.59.220	2020-01-20 05:02:33
78.192.6.4	attackspambots	Unauthorized connection attempt detected from IP address 78.192.6.4 to port 2220 [J]	2020-01-20 05:04:39
85.148.45.124	attackbots	2020-01-19 22:09:21,339 fail2ban.actions: WARNING [ssh] Ban 85.148.45.124	2020-01-20 05:16:09

Recently Reported IPs

36.16.19.93	71.64.31.248	27.106.17.106	209.222.212.20
121.130.140.13	139.59.91.215	72.69.84.233	76.15.127.132
120.149.241.27	62.157.253.188	70.190.200.164	99.83.112.149
162.190.106.207	65.82.59.46	58.251.34.220	111.14.248.242
76.210.69.199	23.95.214.188	164.41.155.230	174.126.60.203