This IP address has been reported a total of
57
times from
53 distinct
sources.
13.140.80.140 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 16
reports;
Germany
with 11
reports;
Netherlands
with 5
reports.
The most common categories in these recent reports were:
Brute-Force
25
times;
Web App Attack
22
times;
SSH
22
times;
Port Scan
19
times;
Hacking
15
times;
Other
14
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Honeypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 10 request eve ...
show moreHoneypot Finding: repeated HTTP/web-application probing captured by Tanner on TCP/80; 10 request event(s), 10 distinct path(s), 5 request(s) to suspicious path(s). Examples: /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%6, /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh, /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php, /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php, /vendor/phpunit/src/Util/PHP/eval-stdin.php.
show less
Hacking
Bad Web Bot
Web App Attack
Anonymous
Scenarios: http-cve-2021-41773, http-cve-2021-42013
Total requests: 5
Oct 19 12:25:32 13.140.80.140 TCP SPT=50805 DPT=2222 SYN
Oct 19 12:25:32 13.140.80.140 TCP SPT=50805 ...
show moreOct 19 12:25:32 13.140.80.140 TCP SPT=50805 DPT=2222 SYN
Oct 19 12:25:32 13.140.80.140 TCP SPT=50805 DPT=2222 SYN
...
show less
Automated scan detection against redacted protected targets. Hits=1; port 2375 proto 6 detection dar ...
show moreAutomated scan detection against redacted protected targets. Hits=1; port 2375 proto 6 detection dark_ip
show less
You are now banned for 10 years by Schiffdorf-West Patrol. Trigger: crowdsecurity/http-cve-2021-4177 ...
show moreYou are now banned for 10 years by Schiffdorf-West Patrol. Trigger: crowdsecurity/http-cve-2021-41773
show less
TSEC Honeypot Network report. Threat score: 78/100. Categories: DDoS Attack, Port Scan, Hacking, Bru ...
show moreTSEC Honeypot Network report. Threat score: 78/100. Categories: DDoS Attack, Port Scan, Hacking, Brute-Force, Web App Attack, SSH, IoT Targeted. Honeypot: cowrie. Context: 13.140.80.140 classified as botnet node participating in coordinated attack campaigns (high confidence).
show less
DDoS Attack
Port Scan
Hacking
Brute-Force
Web App Attack
SSH
IoT Targeted
Anonymous
Oct 19 13:32:06 community sshd[810057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ...
show moreOct 19 13:32:06 community sshd[810057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.140.80.140
Oct 19 13:32:08 community sshd[810057]: Failed password for invalid user admin from 13.140.80.140 port 44254 ssh2
...
show less
