1.202.113.1 - IPInfo

Basic Info

City: Beijing

Region: Beijing

Country: China

Internet Service Provider: unknown

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
1.202.113.153	attack	Unauthorized connection attempt detected from IP address 1.202.113.153 to port 999 [J]	2020-03-02 21:15:02
1.202.113.209	attack	Unauthorized connection attempt detected from IP address 1.202.113.209 to port 8888 [J]	2020-01-29 09:52:21
1.202.113.136	attack	Unauthorized connection attempt detected from IP address 1.202.113.136 to port 80 [J]	2020-01-19 15:48:32
1.202.113.117	attack	Unauthorized connection attempt detected from IP address 1.202.113.117 to port 80 [J]	2020-01-19 14:54:30
1.202.113.41	attackspam	Unauthorized connection attempt detected from IP address 1.202.113.41 to port 1080 [T]	2020-01-17 07:41:29
1.202.113.125	attack	[Mon Jan 13 11:52:43.672851 2020] [:error] [pid 12233:tid 140557863069440] [client 1.202.113.125:6527] [client 1.202.113.125] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "696"] [id "920350"] [msg "Host header is a numeric IP address"] [data "123.125.114.144"] [severity "WARNING"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "123.125.114.144"] [uri "/"] [unique_id "Xhv3m4keQz8ufaNcleYtuQAAAAc"] ...	2020-01-13 14:19:24
1.202.113.120	attackbotsspam	Unauthorized connection attempt detected from IP address 1.202.113.120 to port 802 [T]	2020-01-10 09:29:54
1.202.113.203	attack	Unauthorized connection attempt detected from IP address 1.202.113.203 to port 80 [T]	2020-01-10 09:05:32
1.202.113.113	attackspambots	Unauthorized connection attempt detected from IP address 1.202.113.113 to port 9991 [T]	2020-01-10 08:35:11
1.202.113.211	attackbots	Unauthorized connection attempt detected from IP address 1.202.113.211 to port 8118	2020-01-04 08:16:41
1.202.113.25	attackbotsspam	Unauthorized connection attempt detected from IP address 1.202.113.25 to port 9991	2020-01-04 07:49:15
1.202.113.137	attackbotsspam	Unauthorized connection attempt detected from IP address 1.202.113.137 to port 2086	2019-12-31 09:29:27
1.202.113.85	attackbotsspam	The IP has triggered Cloudflare WAF. CF-Ray: 54369fe29871e7d5 \| WAF_Rule_ID: 53b8357af6d244d3a132bcf913c3a388 \| WAF_Kind: firewall \| CF_Action: drop \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: ip.skk.moe \| User-Agent: Mozilla/4.074482891 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 07:49:29
1.202.113.163	attack	The IP has triggered Cloudflare WAF. CF-Ray: 54343a31fa65ebdd \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: drop \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: disqus.skk.moe \| User-Agent: Mozilla/5.066704189 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 04:09:44
1.202.113.221	attackbots	The IP has triggered Cloudflare WAF. CF-Ray: 54145ba16c8aeef2 \| WAF_Rule_ID: 1112824 \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: disqus.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 4.3; en-us; SM-N900T Build/JSS15J) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 07:24:49

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 1.202.113.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 17833
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;1.202.113.1.			IN	A

;; AUTHORITY SECTION:
.			261	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2024040402 1800 900 604800 86400

;; Query time: 38 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Fri Apr 05 07:54:35 CST 2024
;; MSG SIZE  rcvd: 104

Host info

1.113.202.1.in-addr.arpa domain name pointer 1.113.202.1.static.bjtelecom.net.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
1.113.202.1.in-addr.arpa	name = 1.113.202.1.static.bjtelecom.net.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
27.128.243.112	attackbots	Listed on zen-spamhaus / proto=6 . srcport=47968 . dstport=18897 . (2685)	2020-09-27 21:00:40
192.99.3.173	attackspam	Unauthorized connection attempt from IP address 192.99.3.173 on Port 445(SMB)	2020-09-27 20:40:32
222.186.42.213	attack	Sep 27 12:42:41 scw-tender-jepsen sshd[20496]: Failed password for root from 222.186.42.213 port 44228 ssh2 Sep 27 12:42:43 scw-tender-jepsen sshd[20496]: Failed password for root from 222.186.42.213 port 44228 ssh2	2020-09-27 20:45:12
85.239.35.130	attackbots	TCP (SYN) 85.239.35.130:15348 -> port 22, len 60	2020-09-27 20:52:40
192.95.30.59	attackbots	bad	2020-09-27 21:02:38
51.116.182.194	attack	Invalid user 139 from 51.116.182.194 port 39490	2020-09-27 21:16:08
221.213.115.48	attackbots	19507/tcp 15715/tcp 25165/tcp [2020-09-09/26]3pkt	2020-09-27 21:08:15
167.172.25.74	attack	Automated report - ssh fail2ban: Sep 27 14:52:50 Unable to negotiate with 167.172.25.74 port=47092: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] Sep 27 14:52:51 Unable to negotiate with 167.172.25.74 port=48080: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] Sep 27 14:52:51 Unable to negotiate with 167.172.25.74 port=48948: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth] Sep 27 14:52:52 Unable to negotiate with 167.172.25.74 port=49878: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [preauth]	2020-09-27 20:54:52
106.12.100.73	attack	(sshd) Failed SSH login from 106.12.100.73 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 27 06:53:05 server4 sshd[16109]: Invalid user itsupport from 106.12.100.73 Sep 27 06:53:05 server4 sshd[16109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.100.73 Sep 27 06:53:06 server4 sshd[16109]: Failed password for invalid user itsupport from 106.12.100.73 port 43948 ssh2 Sep 27 06:59:33 server4 sshd[19907]: Invalid user nexthink from 106.12.100.73 Sep 27 06:59:33 server4 sshd[19907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.100.73	2020-09-27 21:03:28
191.5.97.175	attack	Sep 26 22:39:19 ns382633 sshd\[32734\]: Invalid user admin from 191.5.97.175 port 58574 Sep 26 22:39:19 ns382633 sshd\[32734\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.5.97.175 Sep 26 22:39:21 ns382633 sshd\[32734\]: Failed password for invalid user admin from 191.5.97.175 port 58574 ssh2 Sep 26 22:39:26 ns382633 sshd\[32738\]: Invalid user admin from 191.5.97.175 port 58590 Sep 26 22:39:27 ns382633 sshd\[32738\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.5.97.175	2020-09-27 21:16:29
213.14.114.226	attackbots	445/tcp 445/tcp 445/tcp... [2020-07-28/09-26]5pkt,1pt.(tcp)	2020-09-27 21:01:11
148.72.168.23	attackspambots	UDP port : 5060	2020-09-27 20:40:58
192.35.169.24	attack	TCP (SYN) 192.35.169.24:37658 -> port 465, len 44	2020-09-27 21:09:50
118.25.63.170	attack	Sep 27 07:03:02 vlre-nyc-1 sshd\[20647\]: Invalid user iris from 118.25.63.170 Sep 27 07:03:02 vlre-nyc-1 sshd\[20647\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.63.170 Sep 27 07:03:04 vlre-nyc-1 sshd\[20647\]: Failed password for invalid user iris from 118.25.63.170 port 50800 ssh2 Sep 27 07:07:24 vlre-nyc-1 sshd\[20707\]: Invalid user postgres from 118.25.63.170 Sep 27 07:07:24 vlre-nyc-1 sshd\[20707\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.25.63.170 ...	2020-09-27 20:57:55
222.186.180.17	attack	Sep 27 14:37:38 nextcloud sshd\[18461\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17 user=root Sep 27 14:37:41 nextcloud sshd\[18461\]: Failed password for root from 222.186.180.17 port 15998 ssh2 Sep 27 14:38:04 nextcloud sshd\[18990\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.180.17 user=root	2020-09-27 20:40:12

Recently Reported IPs

1.203.174.139	2.56.72.80	2.56.72.78	2.56.72.89
2.56.72.77	2.56.72.60	2.56.72.45	2.56.72.42
2.56.72.50	2.56.72.14	2.56.72.23	2.56.62.76
3.0.209.178	3.1.62.165	3.0.208.154	3.1.7.32
3.0.222.73	3.1.9.119	3.1.3.57	3.1.51.181