Must be a valid IPv4 or IPv6 ip address, e.g. 127.0.0.1 or 2001:DB8:0:0:8:800:200C:417A
Basic Info

City: Guiyang

Region: Guizhou

Country: China

Internet Service Provider: China Unicom

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:
Make a comment on this IP
No discussion about this IP yet. Click above link to make one.
Comments on same subnet:
No discussion about this subnet yet..
Whois info:
% [whois.apnic.net]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

% Information related to '111.85.0.0 - 111.85.255.255'

% Abuse contact for '111.85.0.0 - 111.85.255.255' is 'hqs-ipabuse@chinaunicom.cn'

inetnum:        111.85.0.0 - 111.85.255.255
netname:        UNICOM-GZ
descr:          China Unicom Guizhou province network
descr:          China Unicom
country:        CN
admin-c:        CH1302-AP
tech-c:         ZL476-AP
abuse-c:        AC1718-AP
status:         ALLOCATED PORTABLE
remarks:        service provider
remarks:        --------------------------------------------------------
remarks:        To report network abuse, please contact mnt-irt
remarks:        For troubleshooting, please contact tech-c and admin-c
remarks:        Report invalid contact via www.apnic.net/invalidcontact
remarks:        --------------------------------------------------------
mnt-by:         APNIC-HM
mnt-lower:      MAINT-CNCGROUP
mnt-lower:      MAINT-CNCGROUP-GZ
mnt-routes:     MAINT-CNCGROUP-RR
mnt-irt:        IRT-CU-CN
last-modified:  2023-10-21T03:38:28Z
source:         APNIC

irt:            IRT-CU-CN
address:        No.21,Financial Street
address:        Beijing,100033
address:        P.R.China
e-mail:         hqs-ipabuse@chinaunicom.cn
abuse-mailbox:  hqs-ipabuse@chinaunicom.cn
admin-c:        CH1302-AP
tech-c:         CH1302-AP
auth:           # Filtered
remarks:        hqs-ipabuse@chinaunicom.cn was validated on 2026-08-19
mnt-by:         MAINT-CNCGROUP
last-modified:  2026-08-19T00:57:22Z
source:         APNIC

role:           ABUSE CUCN
country:        ZZ
address:        No.21,Financial Street
address:        Beijing,100033
address:        P.R.China
phone:          +000000000
e-mail:         hqs-ipabuse@chinaunicom.cn
admin-c:        CH1302-AP
tech-c:         CH1302-AP
nic-hdl:        AC1718-AP
remarks:        Generated from irt object IRT-CU-CN
remarks:        hqs-ipabuse@chinaunicom.cn was validated on 2026-08-19
abuse-mailbox:  hqs-ipabuse@chinaunicom.cn
mnt-by:         APNIC-ABUSE
last-modified:  2026-08-20T03:22:23Z
source:         APNIC

person:         ChinaUnicom Hostmaster
nic-hdl:        CH1302-AP
e-mail:         hqs-ipabuse@chinaunicom.cn
address:        No.21,Jin-Rong Street
address:        Beijing,100033
address:        P.R.China
phone:          +86-10-66259764
fax-no:         +86-10-66259764
country:        CN
mnt-by:         MAINT-CNCGROUP
last-modified:  2017-08-17T06:13:16Z
source:         APNIC

person:         zha lan
nic-hdl:        ZL476-AP
e-mail:         zha_l@hotmail.com
address:        1 NO, PuTuo Street ,YunYan district of Guiyang,Guizhou,China
phone:          +86-851-8660676
fax-no:         +86-851-8660600
country:        cn
mnt-by:         MAINT-NEW
last-modified:  2008-09-04T07:29:39Z
source:         APNIC

% Information related to '111.85.0.0/16AS4837'

route:          111.85.0.0/16
descr:          China Unicom Guizhou Province Network
country:        CN
origin:         AS4837
mnt-by:         MAINT-CNCGROUP-RR
last-modified:  2009-06-11T07:36:52Z
source:         APNIC

% This query was served by the APNIC Whois Service version 1.88.48 (WHOIS-AU5)
Dig info:
; <<>> DiG 9.10.3-P4-Ubuntu <<>> 111.85.238.196
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 40634
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;111.85.238.196.			IN	A

;; AUTHORITY SECTION:
.			30	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2026090500 1800 900 604800 86400

;; Query time: 5 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Sep 05 16:34:22 CST 2026
;; MSG SIZE  rcvd: 107
Host info
Host 196.238.85.111.in-addr.arpa. not found: 3(NXDOMAIN)
Nslookup info:
Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 196.238.85.111.in-addr.arpa: NXDOMAIN
Related IP info:
111.85.238.8
111.85.238.43
111.85.238.176
111.85.238.92
111.85.238.49
111.85.238.83
111.85.238.174
111.85.238.13
111.85.238.233
111.85.238.165
111.85.238.145
111.85.238.99
111.85.238.119
111.85.238.168
111.85.238.182
111.85.238.167
111.85.238.122
111.85.238.202
111.85.238.153
111.85.238.150
111.85.238.120
111.85.238.74
111.85.238.25
111.85.238.203
111.85.238.78
111.85.238.22
111.85.238.216
111.85.238.24
111.85.238.172
111.85.238.194
111.85.238.9
111.85.238.114
111.85.238.61
111.85.238.6
111.85.238.226
111.85.238.1
111.85.238.87
111.85.238.30
111.85.238.247
111.85.238.191
111.85.238.98
111.85.238.38
111.85.238.33
111.85.238.59
111.85.238.75
111.85.238.44
111.85.238.7
111.85.238.214
111.85.238.134
111.85.238.37
111.85.238.77
111.85.238.148
111.85.238.251
111.85.238.238
111.85.238.146
111.85.238.169
111.85.238.64
111.85.238.217
111.85.238.135
111.85.238.200
111.85.238.39
111.85.238.65
111.85.238.109
111.85.238.68
111.85.238.95
111.85.238.157
111.85.238.2
111.85.238.215
111.85.238.186
111.85.238.66
111.85.238.101
111.85.238.29
111.85.238.52
111.85.238.46
111.85.238.123
111.85.238.175
111.85.238.185
111.85.238.138
111.85.238.124
111.85.238.54
111.85.238.15
111.85.238.250
111.85.238.183
111.85.238.197
111.85.238.155
111.85.238.192
111.85.238.58
111.85.238.158
111.85.238.232
111.85.238.223
111.85.238.243
111.85.238.21
111.85.238.245
111.85.238.190
111.85.238.96
111.85.238.170
111.85.238.144
111.85.238.57
111.85.238.88
111.85.238.115
111.85.238.111
111.85.238.178
111.85.238.210
111.85.238.220
111.85.238.27
111.85.238.231
111.85.238.236
111.85.238.204
111.85.238.234
111.85.238.187
111.85.238.152
111.85.238.102
111.85.238.195
111.85.238.151
111.85.238.160
111.85.238.117
111.85.238.28
111.85.238.48
111.85.238.205
111.85.238.94
111.85.238.69
111.85.238.225
111.85.238.91
111.85.238.84
111.85.238.89
111.85.238.248
111.85.238.45
111.85.238.244
111.85.238.3
111.85.238.242
111.85.238.26
111.85.238.213
111.85.238.116
111.85.238.177
111.85.238.208
111.85.238.199
111.85.238.127
111.85.238.76
111.85.238.93
111.85.238.121
111.85.238.201
111.85.238.129
111.85.238.85
111.85.238.73
111.85.238.97
111.85.238.179
111.85.238.180
111.85.238.218
111.85.238.222
111.85.238.34
111.85.238.20
111.85.238.137
111.85.238.36
111.85.238.184
111.85.238.4
111.85.238.70
111.85.238.219
111.85.238.106
111.85.238.5
111.85.238.139
111.85.238.173
111.85.238.100
111.85.238.72
111.85.238.80
111.85.238.249
111.85.238.147
111.85.238.143
111.85.238.229
111.85.238.253
111.85.238.227
111.85.238.63
111.85.238.237
111.85.238.161
111.85.238.104
111.85.238.207
111.85.238.163
111.85.238.149
111.85.238.206
111.85.238.211
111.85.238.113
111.85.238.188
111.85.238.136
111.85.238.12
111.85.238.189
111.85.238.10
111.85.238.142
111.85.238.11
111.85.238.181
111.85.238.171
111.85.238.62
111.85.238.235
111.85.238.156
111.85.238.239
111.85.238.228
111.85.238.125
111.85.238.103
111.85.238.60
111.85.238.51
111.85.238.131
111.85.238.23
111.85.238.154
111.85.238.162
111.85.238.31
111.85.238.18
111.85.238.53
111.85.238.166
111.85.238.130
111.85.238.252
111.85.238.118
111.85.238.108
111.85.238.193
111.85.238.107
111.85.238.90
111.85.238.79
111.85.238.16
111.85.238.42
111.85.238.128
111.85.238.212
111.85.238.86
111.85.238.82
111.85.238.164
111.85.238.141
111.85.238.140
111.85.238.14
111.85.238.198
111.85.238.55
111.85.238.112
111.85.238.105
111.85.238.240
111.85.238.56
111.85.238.71
111.85.238.47
111.85.238.19
111.85.238.230
111.85.238.132
111.85.238.40
111.85.238.35
111.85.238.133
111.85.238.246
111.85.238.17
111.85.238.254
111.85.238.32
111.85.238.126
111.85.238.241
111.85.238.81
111.85.238.50
111.85.238.67
111.85.238.41
111.85.238.209
111.85.238.221
111.85.238.110
111.85.238.159
111.85.238.196
111.85.238.224
Related comments:
IP Type Details Datetime
118.126.98.159 attackspambots 
2020-07-07T01:02:51.599684mail.standpoint.com.ua sshd[8088]: Invalid user gas from 118.126.98.159 port 43490
2020-07-07T01:02:51.602336mail.standpoint.com.ua sshd[8088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.126.98.159
2020-07-07T01:02:51.599684mail.standpoint.com.ua sshd[8088]: Invalid user gas from 118.126.98.159 port 43490
2020-07-07T01:02:53.743585mail.standpoint.com.ua sshd[8088]: Failed password for invalid user gas from 118.126.98.159 port 43490 ssh2
2020-07-07T01:06:38.079933mail.standpoint.com.ua sshd[8562]: Invalid user kd from 118.126.98.159 port 57434
...
 2020-07-07 06:53:39
197.207.0.81 attackspam 
197.207.0.81 - - [06/Jul/2020:23:33:12 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
197.207.0.81 - - [06/Jul/2020:23:33:14 +0100] "POST /wp-login.php HTTP/1.1" 200 4971 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
197.207.0.81 - - [06/Jul/2020:23:34:29 +0100] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
...
 2020-07-07 06:38:19
181.230.65.232 attack 
This IOC was found in a paste: https://paste.cryptolaemus.com/emotet/2020/07/06/emotet-c2-rsa-update-07-06-20-1.html with the title "Emotet C2 and RSA Key Update - 07/06/2020 19:40"
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io
 2020-07-07 06:48:27
139.255.55.51 attackbots 
Unauthorized connection attempt from IP address 139.255.55.51 on Port 445(SMB)
 2020-07-07 06:27:00
200.29.105.12 attackbotsspam 
21 attempts against mh-ssh on storm
 2020-07-07 06:46:39
110.143.151.194 attackbots 
This IOC was found in a paste: https://paste.cryptolaemus.com/emotet/2020/07/06/emotet-c2-rsa-update-07-06-20-1.html with the title "Emotet C2 and RSA Key Update - 07/06/2020 19:40"
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io
 2020-07-07 06:50:06
80.82.68.136 attack 
2020-07-06T22:45:18.727148abusebot-8.cloudsearch.cf sshd[19342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.82.68.136  user=root
2020-07-06T22:45:21.194015abusebot-8.cloudsearch.cf sshd[19342]: Failed password for root from 80.82.68.136 port 56374 ssh2
2020-07-06T22:45:22.869678abusebot-8.cloudsearch.cf sshd[19344]: Invalid user admin from 80.82.68.136 port 58148
2020-07-06T22:45:22.875892abusebot-8.cloudsearch.cf sshd[19344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.82.68.136
2020-07-06T22:45:22.869678abusebot-8.cloudsearch.cf sshd[19344]: Invalid user admin from 80.82.68.136 port 58148
2020-07-06T22:45:25.227014abusebot-8.cloudsearch.cf sshd[19344]: Failed password for invalid user admin from 80.82.68.136 port 58148 ssh2
2020-07-06T22:45:26.833873abusebot-8.cloudsearch.cf sshd[19346]: Invalid user user from 80.82.68.136 port 59782
...
 2020-07-07 06:51:25
212.70.149.50 attack 
Jul  7 00:13:28 srv01 postfix/smtpd\[27821\]: warning: unknown\[212.70.149.50\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 00:13:33 srv01 postfix/smtpd\[5490\]: warning: unknown\[212.70.149.50\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 00:13:37 srv01 postfix/smtpd\[28375\]: warning: unknown\[212.70.149.50\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 00:13:38 srv01 postfix/smtpd\[28374\]: warning: unknown\[212.70.149.50\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Jul  7 00:14:02 srv01 postfix/smtpd\[27821\]: warning: unknown\[212.70.149.50\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
...
 2020-07-07 06:27:57
179.5.118.12 attackbotsspam 
This IOC was found in a paste: https://paste.cryptolaemus.com/emotet/2020/07/06/emotet-c2-rsa-update-07-06-20-1.html with the title "Emotet C2 and RSA Key Update - 07/06/2020 19:40"
For more information, or to report interesting/incorrect findings, contact us - bot@tines.io
 2020-07-07 06:49:49
181.30.99.114 attack 
2020-07-06T21:56:49.023353shield sshd\[20643\]: Invalid user admin from 181.30.99.114 port 45854
2020-07-06T21:56:49.027732shield sshd\[20643\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.30.99.114
2020-07-06T21:56:51.470144shield sshd\[20643\]: Failed password for invalid user admin from 181.30.99.114 port 45854 ssh2
2020-07-06T21:59:41.662510shield sshd\[21599\]: Invalid user test_qpfs from 181.30.99.114 port 43150
2020-07-06T21:59:41.667057shield sshd\[21599\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=181.30.99.114
 2020-07-07 06:34:27
168.81.221.66 attack 
Automatic report - Banned IP Access
 2020-07-07 06:59:04
58.145.187.245 attackbots 
Unauthorized connection attempt from IP address 58.145.187.245 on Port 445(SMB)
 2020-07-07 06:44:06
187.32.166.41 attackspam 
[2020-07-0623:10:06 0200]info[cpaneld]187.32.166.41-farmacia"POST/login/\?login_only=1HTTP/1.1"FAILEDLOGINcpaneld:invalidcpaneluserfarmacia\(has_cpuser_filefailed\)[2020-07-0623:10:08 0200]info[cpaneld]187.32.166.41-farmac"POST/login/\?login_only=1HTTP/1.1"FAILEDLOGINcpaneld:invalidcpaneluserfarmac\(has_cpuser_filefailed\)[2020-07-0623:10:09 0200]info[cpaneld]187.32.166.41-farmaci"POST/login/\?login_only=1HTTP/1.1"FAILEDLOGINcpaneld:invalidcpaneluserfarmaci\(has_cpuser_filefailed\)[2020-07-0623:10:11 0200]info[cpaneld]187.32.166.41-farma"POST/login/\?login_only=1HTTP/1.1"FAILEDLOGINcpaneld:invalidcpaneluserfarma\(has_cpuser_filefailed\)[2020-07-0623:10:12 0200]info[cpaneld]187.32.166.41-farmaciaf"POST/login/\?login_only=1HTTP/1.1"FAILEDLOGINcpaneld:invalidcpaneluserfarmaciaf\(has_cpuser_filefailed\)
 2020-07-07 06:44:46
183.89.212.199 attack 
(imapd) Failed IMAP login from 183.89.212.199 (TH/Thailand/mx-ll-183.89.212-199.dynamic.3bb.co.th): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jul  7 01:31:26 ir1 dovecot[2885757]: imap-login: Disconnected (auth failed, 1 attempts in 5 secs): user=, method=PLAIN, rip=183.89.212.199, lip=5.63.12.44, TLS: Connection closed, session=
 2020-07-07 06:57:24
181.114.19.74 attackspambots 
Unauthorized connection attempt from IP address 181.114.19.74 on Port 445(SMB)
 2020-07-07 06:39:22

Recently Reported IPs

39.154.19.86 36.35.252.41 223.88.58.115 183.225.47.49
182.127.27.132 123.13.82.82 123.134.239.230 120.242.190.160
120.239.72.55 120.219.79.1 120.219.178.134 119.180.128.59
119.179.10.222 115.57.151.244 112.51.178.132 112.50.36.220
111.208.81.78 101.26.28.143 2606:4700:10::6814:8316 34.11.95.44