85.214.200.74 - IPInfo

Basic Info

City: Berlin

Region: Land Berlin

Country: Germany

Internet Service Provider: Strato AG

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Dec 16 10:49:38 sauna sshd[172507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.214.200.74 Dec 16 10:49:40 sauna sshd[172507]: Failed password for invalid user webmaster from 85.214.200.74 port 55032 ssh2 ...	2019-12-16 18:39:07
attack	2019-12-14T19:29:52.906246vps751288.ovh.net sshd\[2353\]: Invalid user idc from 85.214.200.74 port 36394 2019-12-14T19:29:52.914859vps751288.ovh.net sshd\[2353\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=h2824152.stratoserver.net 2019-12-14T19:29:54.607898vps751288.ovh.net sshd\[2353\]: Failed password for invalid user idc from 85.214.200.74 port 36394 ssh2 2019-12-14T19:35:34.565105vps751288.ovh.net sshd\[2391\]: Invalid user cn from 85.214.200.74 port 33052 2019-12-14T19:35:34.572584vps751288.ovh.net sshd\[2391\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=h2824152.stratoserver.net	2019-12-15 03:28:21

Type

Details

Datetime

attack

Dec 16 10:49:38 sauna sshd[172507]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.214.200.74
Dec 16 10:49:40 sauna sshd[172507]: Failed password for invalid user webmaster from 85.214.200.74 port 55032 ssh2
...

2019-12-16 18:39:07

attack

2019-12-14T19:29:52.906246vps751288.ovh.net sshd\[2353\]: Invalid user idc from 85.214.200.74 port 36394
2019-12-14T19:29:52.914859vps751288.ovh.net sshd\[2353\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=h2824152.stratoserver.net
2019-12-14T19:29:54.607898vps751288.ovh.net sshd\[2353\]: Failed password for invalid user idc from 85.214.200.74 port 36394 ssh2
2019-12-14T19:35:34.565105vps751288.ovh.net sshd\[2391\]: Invalid user cn from 85.214.200.74 port 33052
2019-12-14T19:35:34.572584vps751288.ovh.net sshd\[2391\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=h2824152.stratoserver.net

2019-12-15 03:28:21

Comments on same subnet:

No discussion about this subnet yet..

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 85.214.200.74
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2257
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;85.214.200.74.			IN	A

;; AUTHORITY SECTION:
.			197	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121401 1800 900 604800 86400

;; Query time: 99 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Dec 15 03:28:16 CST 2019
;; MSG SIZE  rcvd: 117

Host info

74.200.214.85.in-addr.arpa domain name pointer h2824152.stratoserver.net.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
74.200.214.85.in-addr.arpa	name = h2824152.stratoserver.net.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
1.85.82.251	attackspambots	Honeypot attack, port: 23, PTR: PTR record not found	2019-07-02 01:24:51
115.236.54.2	attackbots	\[2019-07-01 12:35:54\] NOTICE\[2019\] chan_sip.c: Registration from '"2066" \' failed for '115.236.54.2:5098' - Wrong password \[2019-07-01 12:35:54\] SECURITY\[2055\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-01T12:35:54.322-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2066",SessionID="0x7f49a80ab958",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/115.236.54.2/5098",Challenge="4ed2eda3",ReceivedChallenge="4ed2eda3",ReceivedHash="cdc682773d40949a2b9fd940383b9169" \[2019-07-01 12:35:54\] NOTICE\[2019\] chan_sip.c: Registration from '"2066" \' failed for '115.236.54.2:5098' - Wrong password \[2019-07-01 12:35:54\] SECURITY\[2055\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-07-01T12:35:54.693-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="2066",SessionID="0x7f49a857b6c8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/1	2019-07-02 00:57:15
1.26.148.194	attackspam	Honeypot attack, port: 23, PTR: PTR record not found	2019-07-02 01:18:35
27.215.65.205	attack	Honeypot attack, port: 23, PTR: PTR record not found	2019-07-02 01:08:08
27.194.94.134	attackbotsspam	MultiHost/MultiPort Probe, Scan, Hack -	2019-07-02 01:47:51
125.71.132.78	attackbotsspam	ssh failed login	2019-07-02 01:20:05
112.93.227.132	attack	Honeypot attack, port: 23, PTR: PTR record not found	2019-07-02 01:28:47
180.76.115.251	attackbots	SSH Brute-Forcing (ownc)	2019-07-02 01:21:00
181.52.251.209	attackspambots	Jul 1 15:33:33 apollo sshd\[9482\]: Invalid user dev from 181.52.251.209Jul 1 15:33:35 apollo sshd\[9482\]: Failed password for invalid user dev from 181.52.251.209 port 45694 ssh2Jul 1 15:37:23 apollo sshd\[9488\]: Invalid user fleur from 181.52.251.209 ...	2019-07-02 01:25:59
103.78.181.27	attack	[Mon Jul 01 20:37:02.413901 2019] [:error] [pid 19548:tid 140098469357312] [client 103.78.181.27:50821] [client 103.78.181.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.1.1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "792"] [id "920350"] [msg "Host header is a numeric IP address"] [data "103.27.207.197:80"] [severity "WARNING"] [ver "OWASP_CRS/3.1.1"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "103.27.207.197"] [uri "/"] [unique_id "XRoMfsCSe@Nv83UrI885fQAAAAQ"] ...	2019-07-02 01:45:27
77.242.21.228	attack	Honeypot attack, port: 445, PTR: ip-77-242-21-228.net.abissnet.al.	2019-07-02 01:22:13
123.23.204.102	attackbotsspam	Honeypot attack, port: 23, PTR: PTR record not found	2019-07-02 00:53:58
92.118.160.5	attackbotsspam	port scan and connect, tcp 1025 (NFS-or-IIS)	2019-07-02 01:42:49
40.77.167.64	attackbots	ignoring robots.txt file	2019-07-02 01:39:10
27.115.124.68	attackspambots	MultiHost/MultiPort Probe, Scan, Hack -	2019-07-02 01:05:17

Recently Reported IPs

210.231.84.156	79.229.210.85	189.38.83.145	117.1.91.249
197.177.6.59	5.76.31.82	203.112.62.129	75.47.97.22
83.160.207.41	213.248.241.201	27.197.159.207	189.34.235.184
171.95.75.132	139.214.236.71	97.20.139.236	92.23.61.204
118.206.226.231	52.25.162.91	222.76.51.160	163.206.34.234