94.102.13.34 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: Turkey

Internet Service Provider: NetInternet Bilisim Teknolojileri AS

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbots	94.102.13.34 - - [08/Jul/2019:00:56:39 +0200] "GET /wp-login.php HTTP/1.1" 200 1256 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 94.102.13.34 - - [08/Jul/2019:00:56:39 +0200] "POST /wp-login.php HTTP/1.1" 200 1651 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 94.102.13.34 - - [08/Jul/2019:00:56:40 +0200] "GET /wp-login.php HTTP/1.1" 200 1256 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 94.102.13.34 - - [08/Jul/2019:00:56:40 +0200] "POST /wp-login.php HTTP/1.1" 200 1629 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 94.102.13.34 - - [08/Jul/2019:00:56:41 +0200] "GET /wp-login.php HTTP/1.1" 200 1256 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" 94.102.13.34 - - [08/Jul/2019:00:56:41 +0200] "POST /wp-login.php HTTP/1.1" 200 1626 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" ...	2019-07-08 14:31:16
attackspam	WordPress login Brute force / Web App Attack on client site.	2019-06-22 16:41:30

Type

Details

Datetime

attackbots

94.102.13.34 - - [08/Jul/2019:00:56:39 +0200] "GET /wp-login.php HTTP/1.1" 200 1256 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.102.13.34 - - [08/Jul/2019:00:56:39 +0200] "POST /wp-login.php HTTP/1.1" 200 1651 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.102.13.34 - - [08/Jul/2019:00:56:40 +0200] "GET /wp-login.php HTTP/1.1" 200 1256 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.102.13.34 - - [08/Jul/2019:00:56:40 +0200] "POST /wp-login.php HTTP/1.1" 200 1629 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.102.13.34 - - [08/Jul/2019:00:56:41 +0200] "GET /wp-login.php HTTP/1.1" 200 1256 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
94.102.13.34 - - [08/Jul/2019:00:56:41 +0200] "POST /wp-login.php HTTP/1.1" 200 1626 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
...

2019-07-08 14:31:16

attackspam

WordPress login Brute force / Web App Attack on client site.

2019-06-22 16:41:30

Comments on same subnet:

IP	Type	Details	Datetime
94.102.13.100	attackspambots	Automatic report - XMLRPC Attack	2020-03-03 17:59:03
94.102.130.198	attackbots	SMB Server BruteForce Attack	2019-06-29 03:20:00

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 94.102.13.34
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 40723
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;94.102.13.34.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019050900 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Thu May 09 17:03:19 +08 2019
;; MSG SIZE  rcvd: 116

Host info

34.13.102.94.in-addr.arpa domain name pointer srv01.bartinnetwork.com.

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

Non-authoritative answer:
34.13.102.94.in-addr.arpa	name = srv01.bartinnetwork.com.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
54.39.51.31	attackspambots	Automatic report - Banned IP Access	2019-10-13 18:43:59
104.42.158.117	attack	Excessive Port-Scanning	2019-10-13 18:35:02
139.199.59.235	attack	Oct 13 00:45:09 firewall sshd[13184]: Invalid user gitolite3 from 139.199.59.235 Oct 13 00:45:12 firewall sshd[13184]: Failed password for invalid user gitolite3 from 139.199.59.235 port 42446 ssh2 Oct 13 00:45:41 firewall sshd[13192]: Invalid user akari from 139.199.59.235 ...	2019-10-13 18:44:28
45.82.153.37	attack	Oct 13 09:41:25 mail postfix/smtpd\[21531\]: warning: unknown\[45.82.153.37\]: SASL PLAIN authentication failed: \ Oct 13 11:05:38 mail postfix/smtpd\[25764\]: warning: unknown\[45.82.153.37\]: SASL PLAIN authentication failed: \ Oct 13 11:05:47 mail postfix/smtpd\[22476\]: warning: unknown\[45.82.153.37\]: SASL PLAIN authentication failed: \ Oct 13 11:24:13 mail postfix/smtpd\[26572\]: warning: unknown\[45.82.153.37\]: SASL PLAIN authentication failed: \	2019-10-13 18:23:34
200.11.240.237	attackbotsspam	Oct 13 11:42:05 MK-Soft-VM3 sshd[25873]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.11.240.237 Oct 13 11:42:08 MK-Soft-VM3 sshd[25873]: Failed password for invalid user 123Mark from 200.11.240.237 port 37770 ssh2 ...	2019-10-13 18:08:14
101.89.147.85	attackspam	Invalid user Toxic123 from 101.89.147.85 port 38203	2019-10-13 18:19:15
51.254.114.105	attack	Oct 13 09:01:27 SilenceServices sshd[28050]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.114.105 Oct 13 09:01:29 SilenceServices sshd[28050]: Failed password for invalid user 123 from 51.254.114.105 port 58285 ssh2 Oct 13 09:08:01 SilenceServices sshd[29771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.114.105	2019-10-13 18:14:52
192.42.116.28	attackspambots	Oct 13 12:09:23 km20725 sshd\[6190\]: Invalid user abba from 192.42.116.28Oct 13 12:09:26 km20725 sshd\[6190\]: Failed password for invalid user abba from 192.42.116.28 port 40706 ssh2Oct 13 12:09:28 km20725 sshd\[6190\]: Failed password for invalid user abba from 192.42.116.28 port 40706 ssh2Oct 13 12:09:30 km20725 sshd\[6190\]: Failed password for invalid user abba from 192.42.116.28 port 40706 ssh2 ...	2019-10-13 18:09:42
212.129.2.12	attack	\[2019-10-13 05:17:45\] NOTICE\[1887\] chan_sip.c: Registration from '"250"\' failed for '212.129.2.12:24432' - Wrong password \[2019-10-13 05:17:45\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-13T05:17:45.210-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="250",SessionID="0x7fc3ac85f3d8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.129.2.12/24432",Challenge="25383b7f",ReceivedChallenge="25383b7f",ReceivedHash="a1c193425db093162b2e54a3e30ddd67" \[2019-10-13 05:24:40\] NOTICE\[1887\] chan_sip.c: Registration from '"700"\' failed for '212.129.2.12:24441' - Wrong password \[2019-10-13 05:24:40\] SECURITY\[1898\] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2019-10-13T05:24:40.782-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="700",SessionID="0x7fc3ac226ee8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/212.12	2019-10-13 18:07:23
145.239.10.217	attackbotsspam	Oct 13 05:46:27 ns41 sshd[5121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=145.239.10.217	2019-10-13 18:26:16
170.239.220.70	attackbots	SSH bruteforce	2019-10-13 18:40:17
45.237.140.120	attackbots	Oct 13 11:26:33 root sshd[8924]: Failed password for root from 45.237.140.120 port 57620 ssh2 Oct 13 11:31:41 root sshd[8990]: Failed password for root from 45.237.140.120 port 40632 ssh2 ...	2019-10-13 18:20:14
201.140.111.58	attackbotsspam	Oct 13 06:27:20 vps01 sshd[22741]: Failed password for root from 201.140.111.58 port 25364 ssh2	2019-10-13 18:49:36
120.52.121.86	attack	Oct 13 06:50:08 h2177944 sshd\[18961\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.52.121.86 user=root Oct 13 06:50:10 h2177944 sshd\[18961\]: Failed password for root from 120.52.121.86 port 52969 ssh2 Oct 13 06:55:47 h2177944 sshd\[19147\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.52.121.86 user=root Oct 13 06:55:50 h2177944 sshd\[19147\]: Failed password for root from 120.52.121.86 port 42392 ssh2 ...	2019-10-13 18:42:02
80.211.116.102	attack	Oct 13 11:57:05 icinga sshd[2454]: Failed password for root from 80.211.116.102 port 35553 ssh2 ...	2019-10-13 18:23:14

Recently Reported IPs

59.48.244.148	180.245.255.27	84.22.2.26	212.250.152.68
164.77.201.218	207.148.6.236	212.32.199.214	1.53.137.92
199.47.125.68	220.245.209.77	122.254.91.68	184.112.10.65
119.160.197.61	57.213.249.104	14.63.80.53	77.222.114.79
197.82.3.116	103.102.47.125	104.83.135.88	88.98.103.126