117.91.252.16 - IPInfo

Basic Info

City: Nanjing

Region: Jiangsu

Country: China

Internet Service Provider: unknown

Hostname: unknown

Organization: No.31,Jin-rong Street

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
117.91.252.209	attack	Unauthorized connection attempt detected from IP address 117.91.252.209 to port 2220 [J]	2020-01-15 18:47:07
117.91.252.231	attackbots	SASL broute force	2019-10-08 01:51:47
117.91.252.140	attackbots	Oct 1 07:18:27 esmtp postfix/smtpd[22900]: lost connection after AUTH from unknown[117.91.252.140] Oct 1 07:18:30 esmtp postfix/smtpd[22900]: lost connection after AUTH from unknown[117.91.252.140] Oct 1 07:18:53 esmtp postfix/smtpd[22848]: lost connection after AUTH from unknown[117.91.252.140] Oct 1 07:18:53 esmtp postfix/smtpd[22870]: lost connection after AUTH from unknown[117.91.252.140] Oct 1 07:18:54 esmtp postfix/smtpd[22848]: lost connection after AUTH from unknown[117.91.252.140] ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=117.91.252.140	2019-10-04 15:53:06

Type

Details

Datetime

117.91.252.209

attack

Unauthorized connection attempt detected from IP address 117.91.252.209 to port 2220 [J]

2020-01-15 18:47:07

117.91.252.231

attackbots

SASL broute force

2019-10-08 01:51:47

117.91.252.140

attackbots

Oct  1 07:18:27 esmtp postfix/smtpd[22900]: lost connection after AUTH from unknown[117.91.252.140]
Oct  1 07:18:30 esmtp postfix/smtpd[22900]: lost connection after AUTH from unknown[117.91.252.140]
Oct  1 07:18:53 esmtp postfix/smtpd[22848]: lost connection after AUTH from unknown[117.91.252.140]
Oct  1 07:18:53 esmtp postfix/smtpd[22870]: lost connection after AUTH from unknown[117.91.252.140]
Oct  1 07:18:54 esmtp postfix/smtpd[22848]: lost connection after AUTH from unknown[117.91.252.140]

........
-----------------------------------------------
https://www.blocklist.de/en/view.html?ip=117.91.252.140

2019-10-04 15:53:06

Whois info:

Dig info:


; <<>> DiG 9.10.3-P4-Ubuntu <<>> 117.91.252.16
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19890
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;117.91.252.16.			IN	A

;; AUTHORITY SECTION:
.			3600	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019041300 1800 900 604800 86400

;; Query time: 2 msec
;; SERVER: 67.207.67.3#53(67.207.67.3)
;; WHEN: Sat Apr 13 16:32:30 +08 2019
;; MSG SIZE  rcvd: 117

Host info

Host 16.252.91.117.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		67.207.67.3
Address:	67.207.67.3#53

** server can't find 16.252.91.117.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
212.18.22.236	attack	(sshd) Failed SSH login from 212.18.22.236 (DE/Germany/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 21 09:31:58 idl1-dfw sshd[1903489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.18.22.236 user=root Sep 21 09:32:00 idl1-dfw sshd[1903489]: Failed password for root from 212.18.22.236 port 56968 ssh2 Sep 21 09:38:12 idl1-dfw sshd[1908195]: Invalid user ubuntu from 212.18.22.236 port 34812 Sep 21 09:38:14 idl1-dfw sshd[1908195]: Failed password for invalid user ubuntu from 212.18.22.236 port 34812 ssh2 Sep 21 09:42:29 idl1-dfw sshd[1911714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.18.22.236 user=root	2020-09-22 03:15:49
139.162.137.207	attackbots	Port Scan detected from 139.162.137.207 (DE/Germany/Hesse/Frankfurt am Main/li1403-207.members.linode.com). 4 hits in the last 66 seconds	2020-09-22 03:35:06
197.162.254.143	attackspambots	Listed on zen-spamhaus / proto=6 . srcport=35955 . dstport=23 . (2288)	2020-09-22 03:30:02
218.92.0.133	attackbotsspam	Sep 20 20:10:19 sip sshd[31521]: Failed password for root from 218.92.0.133 port 57241 ssh2 Sep 20 20:10:29 sip sshd[31521]: Failed password for root from 218.92.0.133 port 57241 ssh2 Sep 20 20:10:32 sip sshd[31521]: Failed password for root from 218.92.0.133 port 57241 ssh2 Sep 20 20:10:32 sip sshd[31521]: error: maximum authentication attempts exceeded for root from 218.92.0.133 port 57241 ssh2 [preauth]	2020-09-22 03:18:22
161.35.29.223	attackspam	firewall-block, port(s): 6320/tcp	2020-09-22 03:43:02
79.173.90.153	attackbots	0,16-01/02 [bc01/m11] PostRequest-Spammer scoring: brussels	2020-09-22 03:31:22
20.194.3.84	attackbots	SSH Honeypot -> SSH Bruteforce / Login	2020-09-22 03:28:46
200.216.30.196	attackbots	Sep 21 17:06:20 XXXXXX sshd[14497]: Invalid user padmin from 200.216.30.196 port 6664	2020-09-22 03:30:16
36.66.188.183	attackspam	Connection to SSH Honeypot - Detected by HoneypotDB	2020-09-22 03:38:15
61.133.232.253	attackspambots	(sshd) Failed SSH login from 61.133.232.253 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Sep 21 14:12:02 optimus sshd[24487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.133.232.253 user=root Sep 21 14:12:04 optimus sshd[24487]: Failed password for root from 61.133.232.253 port 62523 ssh2 Sep 21 14:12:50 optimus sshd[24879]: Invalid user adam from 61.133.232.253 Sep 21 14:12:50 optimus sshd[24879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.133.232.253 Sep 21 14:12:52 optimus sshd[24879]: Failed password for invalid user adam from 61.133.232.253 port 65249 ssh2	2020-09-22 03:15:24
125.227.255.79	attack	SSH Brute-Force reported by Fail2Ban	2020-09-22 03:13:52
195.58.38.183	attackbots	TCP (SYN) 195.58.38.183:20193 -> port 23, len 44	2020-09-22 03:25:21
98.142.143.152	attackspambots	Invalid user sshuser from 98.142.143.152 port 57872	2020-09-22 03:46:50
194.180.224.130	attack	Sep 21 21:08:21 vm0 sshd[19314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.180.224.130 ...	2020-09-22 03:12:16
194.61.24.102	attackbots	SQL Injection Attempts	2020-09-22 03:26:10

Recently Reported IPs

182.253.142.40	5.188.86.174	182.190.4.60	182.163.102.114
182.137.14.72	182.16.173.210	181.95.45.105	92.77.104.180
181.56.9.161	181.52.237.148	117.211.164.202	88.214.26.93
181.49.106.228	181.28.53.74	181.236.221.137	181.213.247.244
181.211.240.147	179.85.149.38	109.75.140.158	104.236.77.96