112.66.99.74 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: ChinaNet Hainan Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspam	The IP has triggered Cloudflare WAF. CF-Ray: 5414bd353ee5eb45 \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: ip.skk.moe \| User-Agent: Mozilla/5.066704189 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 01:09:41

Type

Details

Datetime

attackspam

The IP has triggered Cloudflare WAF. CF-Ray: 5414bd353ee5eb45 | WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 | WAF_Kind: firewall | CF_Action: challenge | Country: CN | CF_IPClass: noRecord | Protocol: HTTP/1.1 | Method: GET | Host: ip.skk.moe | User-Agent: Mozilla/5.066704189 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36 | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-08 01:09:41

Comments on same subnet:

IP	Type	Details	Datetime
112.66.99.6	attackspam	Unauthorized connection attempt detected from IP address 112.66.99.6 to port 8000 [J]	2020-01-27 15:15:57
112.66.99.159	attackspam	Unauthorized connection attempt detected from IP address 112.66.99.159 to port 802 [T]	2020-01-10 09:23:22
112.66.99.167	attackspam	Unauthorized connection attempt detected from IP address 112.66.99.167 to port 8899	2020-01-04 08:33:51
112.66.99.25	attackspambots	Unauthorized connection attempt detected from IP address 112.66.99.25 to port 8090	2020-01-01 21:33:22
112.66.99.1	attackspambots	Unauthorized connection attempt detected from IP address 112.66.99.1 to port 2095	2019-12-31 08:33:07
112.66.99.6	attackbotsspam	Unauthorized connection attempt detected from IP address 112.66.99.6 to port 3128	2019-12-31 07:42:24
112.66.99.211	attackspam	The IP has triggered Cloudflare WAF. CF-Ray: 5430c47bb86fe825 \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: drop \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: api.skk.moe \| User-Agent: Mozilla/5.064213590 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 06:48:59
112.66.99.155	attackspambots	The IP has triggered Cloudflare WAF. CF-Ray: 540f7b87ae62e4fe \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.064213590 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 01:35:16
112.66.99.63	attack	The%20IP%20has%20triggered%20Cloudflare%20WAF.%20Report%20generated%20by%20Cloudflare-WAF-to-AbuseIPDB%20(https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB)	2019-11-19 04:18:55

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 112.66.99.74
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60654
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;112.66.99.74.			IN	A

;; AUTHORITY SECTION:
.			359	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019120700 1800 900 604800 86400

;; Query time: 120 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun Dec 08 01:09:38 CST 2019
;; MSG SIZE  rcvd: 116

Host info

Host 74.99.66.112.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 74.99.66.112.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
77.77.149.170	attackbots	Detected by ModSecurity. Request URI: /.well-known/pki-validation/00F79153117348CAD686244EB2902156.txt	2019-11-27 16:51:03
43.247.4.50	attackbots	2019-11-27T07:50:07.496699abusebot-7.cloudsearch.cf sshd\[26782\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.247.4.50 user=root	2019-11-27 16:18:38
209.235.23.125	attackspam	Nov 27 08:35:09 *** sshd[12978]: User root from 209.235.23.125 not allowed because not listed in AllowUsers	2019-11-27 16:38:12
222.186.180.223	attack	Nov 27 10:46:18 sauna sshd[40078]: Failed password for root from 222.186.180.223 port 50436 ssh2 Nov 27 10:46:22 sauna sshd[40078]: Failed password for root from 222.186.180.223 port 50436 ssh2 ...	2019-11-27 16:47:47
106.52.19.218	attackbotsspam	Nov 27 04:05:03 hostnameis sshd[23781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.19.218 user=r.r Nov 27 04:05:05 hostnameis sshd[23781]: Failed password for r.r from 106.52.19.218 port 49808 ssh2 Nov 27 04:05:05 hostnameis sshd[23781]: Received disconnect from 106.52.19.218: 11: Bye Bye [preauth] Nov 27 04:23:33 hostnameis sshd[23939]: Invalid user cnidc from 106.52.19.218 Nov 27 04:23:33 hostnameis sshd[23939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.19.218 Nov 27 04:23:35 hostnameis sshd[23939]: Failed password for invalid user cnidc from 106.52.19.218 port 56182 ssh2 Nov 27 04:23:35 hostnameis sshd[23939]: Received disconnect from 106.52.19.218: 11: Bye Bye [preauth] Nov 27 04:30:32 hostnameis sshd[23994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.52.19.218 user=r.r Nov 27 04:30:34 hostnameis sshd[23994]: Fai........ ------------------------------	2019-11-27 16:37:30
106.13.101.220	attackbotsspam	Nov 26 22:09:03 wbs sshd\[31469\]: Invalid user bandwitch from 106.13.101.220 Nov 26 22:09:03 wbs sshd\[31469\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.101.220 Nov 26 22:09:05 wbs sshd\[31469\]: Failed password for invalid user bandwitch from 106.13.101.220 port 48774 ssh2 Nov 26 22:16:10 wbs sshd\[32183\]: Invalid user shantanu from 106.13.101.220 Nov 26 22:16:10 wbs sshd\[32183\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.101.220	2019-11-27 16:28:22
218.104.234.173	attack	Nov 27 07:29:58 ns3042688 courier-imapd: LOGIN FAILED, method=PLAIN, ip=\[::ffff:218.104.234.173\] ...	2019-11-27 16:22:38
222.186.190.2	attackspambots	" "	2019-11-27 16:41:11
103.85.255.40	attack	Nov 25 09:51:13 fwweb01 sshd[3164]: Did not receive identification string from 103.85.255.40 Nov 25 09:51:54 fwweb01 sshd[3188]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.85.255.40 user=r.r Nov 25 09:51:57 fwweb01 sshd[3188]: Failed password for r.r from 103.85.255.40 port 24721 ssh2 Nov 25 09:51:58 fwweb01 sshd[3188]: Received disconnect from 103.85.255.40: 11: Normal Shutdown, Thank you for playing [preauth] Nov 25 09:52:12 fwweb01 sshd[3198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.85.255.40 user=r.r Nov 25 09:52:14 fwweb01 sshd[3198]: Failed password for r.r from 103.85.255.40 port 5041 ssh2 Nov 25 09:52:14 fwweb01 sshd[3198]: Received disconnect from 103.85.255.40: 11: Normal Shutdown, Thank you for playing [preauth] Nov 25 09:52:30 fwweb01 sshd[3215]: Invalid user r.r123 from 103.85.255.40 Nov 25 09:52:30 fwweb01 sshd[3215]: pam_unix(sshd:auth): authentication f........ -------------------------------	2019-11-27 16:49:46
188.213.212.66	attackspam	2019-11-27T07:29:16.774808stark.klein-stark.info postfix/smtpd\[10449\]: NOQUEUE: reject: RCPT from tremble.yarkaci.com\[188.213.212.66\]: 554 5.7.1 \: Relay access denied\; from=\ to=\ proto=ESMTP helo=\ ...	2019-11-27 16:46:23
89.248.168.217	attackbotsspam	11/27/2019-09:11:56.644054 89.248.168.217 Protocol: 17 ET DROP Dshield Block Listed Source group 1	2019-11-27 16:50:11
210.245.89.85	attackbotsspam	Nov 27 10:30:49 server sshd\[11433\]: User root from 210.245.89.85 not allowed because listed in DenyUsers Nov 27 10:30:49 server sshd\[11433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.245.89.85 user=root Nov 27 10:30:51 server sshd\[11433\]: Failed password for invalid user root from 210.245.89.85 port 54962 ssh2 Nov 27 10:30:53 server sshd\[11433\]: Failed password for invalid user root from 210.245.89.85 port 54962 ssh2 Nov 27 10:30:55 server sshd\[11433\]: Failed password for invalid user root from 210.245.89.85 port 54962 ssh2	2019-11-27 16:45:49
61.231.23.11	attackbotsspam	Fail2Ban - FTP Abuse Attempt	2019-11-27 16:16:02
80.82.64.73	attackbots	11/27/2019-02:36:21.470187 80.82.64.73 Protocol: 6 ET SCAN NMAP -sS window 1024	2019-11-27 16:15:09
122.14.209.213	attackspambots	Nov 27 03:24:53 plusreed sshd[879]: Invalid user flueckinger from 122.14.209.213 ...	2019-11-27 16:25:51

Recently Reported IPs

179.84.70.40	49.7.3.245	240e:58:2:200:100::c2	2408:8648:1300:40:787c:7954:546f:f43f
2408:8648:1300:40:4569:c195:5535:ab79	2400:dd0d:2000:0:29da:5f0d:fcc:1d49	56.12.133.14	34.82.3.66
27.224.137.98	3.112.171.116	223.166.75.60	223.166.74.143
222.94.163.135	221.213.75.207	221.13.12.188	220.250.62.202
12.79.244.19	53.250.140.191	180.95.231.196	175.184.167.72