112.66.107.70 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: ChinaNet Hainan Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Unauthorized connection attempt detected from IP address 112.66.107.70 to port 8082 [J]	2020-03-02 20:34:45

Comments on same subnet:

IP	Type	Details	Datetime
112.66.107.228	attackspambots	The IP has triggered Cloudflare WAF. CF-Ray: 541755e7a874999b \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: theme-suka.skk.moe \| User-Agent: Mozilla/5.077692140 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 06:05:42
112.66.107.110	attack	The IP has triggered Cloudflare WAF. CF-Ray: 541760960bd7eb91 \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: blog.skk.moe \| User-Agent: Mozilla/5.084743666 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 04:13:22

Type

Details

Datetime

112.66.107.228

attackspambots

The IP has triggered Cloudflare WAF. CF-Ray: 541755e7a874999b | WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 | WAF_Kind: firewall | CF_Action: challenge | Country: CN | CF_IPClass: noRecord | Protocol: HTTP/1.1 | Method: GET | Host: theme-suka.skk.moe | User-Agent: Mozilla/5.077692140 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-08 06:05:42

112.66.107.110

attack

The IP has triggered Cloudflare WAF. CF-Ray: 541760960bd7eb91 | WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 | WAF_Kind: firewall | CF_Action: challenge | Country: CN | CF_IPClass: noRecord | Protocol: HTTP/1.1 | Method: GET | Host: blog.skk.moe | User-Agent: Mozilla/5.084743666 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-08 04:13:22

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 112.66.107.70
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 16892
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;112.66.107.70.			IN	A

;; AUTHORITY SECTION:
.			491	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020030200 1800 900 604800 86400

;; Query time: 128 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Mar 02 20:34:38 CST 2020
;; MSG SIZE  rcvd: 117

Host info

Host 70.107.66.112.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 70.107.66.112.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
221.178.157.244	attackspam	Sep 25 03:55:59 work-partkepr sshd\[8484\]: Invalid user vowell from 221.178.157.244 port 16929 Sep 25 03:55:59 work-partkepr sshd\[8484\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.178.157.244 ...	2019-09-25 12:32:35
45.130.255.93	attackspam	B: Magento admin pass test (wrong country)	2019-09-25 12:14:05
66.220.155.135	attack	Port Scan: TCP/25	2019-09-25 09:48:38
176.121.209.113	attackspam	[portscan] Port scan	2019-09-25 12:28:50
112.64.32.118	attackbotsspam	Sep 25 06:49:04 site1 sshd\[12514\]: Invalid user jwy from 112.64.32.118Sep 25 06:49:06 site1 sshd\[12514\]: Failed password for invalid user jwy from 112.64.32.118 port 37562 ssh2Sep 25 06:52:41 site1 sshd\[12790\]: Invalid user admin from 112.64.32.118Sep 25 06:52:43 site1 sshd\[12790\]: Failed password for invalid user admin from 112.64.32.118 port 38058 ssh2Sep 25 06:56:23 site1 sshd\[13056\]: Invalid user website from 112.64.32.118Sep 25 06:56:25 site1 sshd\[13056\]: Failed password for invalid user website from 112.64.32.118 port 38550 ssh2 ...	2019-09-25 12:06:33
81.22.45.252	attackspam	09/24/2019-23:55:19.127594 81.22.45.252 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 84	2019-09-25 12:17:39
107.170.227.141	attackbotsspam	Sep 25 06:08:39 eventyay sshd[10434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.227.141 Sep 25 06:08:41 eventyay sshd[10434]: Failed password for invalid user genesis from 107.170.227.141 port 56602 ssh2 Sep 25 06:12:58 eventyay sshd[10525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.170.227.141 ...	2019-09-25 12:21:30
217.61.2.97	attack	Sep 24 17:52:07 tdfoods sshd\[23734\]: Invalid user p@ssw0rd from 217.61.2.97 Sep 24 17:52:07 tdfoods sshd\[23734\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.2.97 Sep 24 17:52:10 tdfoods sshd\[23734\]: Failed password for invalid user p@ssw0rd from 217.61.2.97 port 39673 ssh2 Sep 24 17:56:31 tdfoods sshd\[24133\]: Invalid user p@Ssw0rd from 217.61.2.97 Sep 24 17:56:31 tdfoods sshd\[24133\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.61.2.97	2019-09-25 12:02:18
177.185.219.7	attackspam	Sep 25 05:56:22 lnxweb61 sshd[18034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.185.219.7 Sep 25 05:56:22 lnxweb61 sshd[18034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.185.219.7	2019-09-25 12:11:34
202.5.61.24	attackspam	Sep 25 05:56:04 smtp postfix/smtpd[96345]: NOQUEUE: reject: RCPT from unknown[202.5.61.24]: 554 5.7.1 Service unavailable; Client host [202.5.61.24] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?202.5.61.24; from= to= proto=ESMTP helo= ...	2019-09-25 12:23:38
61.53.16.56	attackspam	Port Scan: TCP/23	2019-09-25 09:49:15
114.141.191.238	attackbotsspam	$f2bV_matches	2019-09-25 12:22:48
106.13.33.181	attackspam	Sep 25 04:29:35 work-partkepr sshd\[8871\]: Invalid user odroid from 106.13.33.181 port 40486 Sep 25 04:29:35 work-partkepr sshd\[8871\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.33.181 ...	2019-09-25 12:31:34
116.3.241.5	attackbotsspam	Unauthorised access (Sep 25) SRC=116.3.241.5 LEN=40 TTL=49 ID=32083 TCP DPT=8080 WINDOW=52739 SYN Unauthorised access (Sep 25) SRC=116.3.241.5 LEN=40 TTL=49 ID=53112 TCP DPT=8080 WINDOW=26672 SYN	2019-09-25 12:27:18
115.203.49.88	attackspam	Port Scan: TCP/23	2019-09-25 09:45:17

Recently Reported IPs

100.14.178.204	193.230.222.156	19.139.103.99	145.11.154.239
126.25.51.14	96.102.148.10	184.146.32.136	68.24.9.117
51.36.100.212	166.200.46.198	85.105.4.239	178.72.36.112
133.72.112.190	178.200.246.159	46.198.148.255	114.21.41.194
63.225.68.254	151.125.95.110	42.2.114.127	184.23.25.169