120.38.48.199 - IPInfo

Basic Info

City: Zhangzhou

Region: Fujian

Country: China

Internet Service Provider: ChinaNet Fujian Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	ET SCAN Suspicious inbound to MSSQL port 1433 - port: 1433 proto: TCP cat: Potentially Bad Traffic	2020-05-17 08:08:10

Comments on same subnet:

IP	Type	Details	Datetime
120.38.48.109	attackspam	DATE:2020-03-11 03:11:16, IP:120.38.48.109, PORT:1433 MSSQL brute force auth on honeypot server (epe-honey1-hq)	2020-03-11 12:35:03
120.38.48.46	attackbots	lfd: (smtpauth) Failed SMTP AUTH login from 120.38.48.46 (46.48.38.120.broad.zz.fj.dynamic.163data.com.cn): 5 in the last 3600 secs - Sun Jul 15 05:38:04 2018	2020-02-27 22:40:41

Type

Details

Datetime

120.38.48.109

attackspam

DATE:2020-03-11 03:11:16, IP:120.38.48.109, PORT:1433 MSSQL brute force auth on honeypot server (epe-honey1-hq)

2020-03-11 12:35:03

120.38.48.46

attackbots

lfd: (smtpauth) Failed SMTP AUTH login from 120.38.48.46 (46.48.38.120.broad.zz.fj.dynamic.163data.com.cn): 5 in the last 3600 secs - Sun Jul 15 05:38:04 2018

2020-02-27 22:40:41

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 120.38.48.199
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 5199
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;120.38.48.199.			IN	A

;; AUTHORITY SECTION:
.			517	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020051601 1800 900 604800 86400

;; Query time: 103 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sun May 17 08:08:06 CST 2020
;; MSG SIZE  rcvd: 117

Host info

199.48.38.120.in-addr.arpa domain name pointer 199.48.38.120.broad.zz.fj.dynamic.163data.com.cn.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
199.48.38.120.in-addr.arpa	name = 199.48.38.120.broad.zz.fj.dynamic.163data.com.cn.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
94.25.228.184	attackspam	Honeypot attack, port: 445, PTR: client.yota.ru.	2020-02-20 02:05:07
218.92.0.204	attackbots	Feb 19 17:36:03 zeus sshd[4656]: Failed password for root from 218.92.0.204 port 51675 ssh2 Feb 19 17:36:06 zeus sshd[4656]: Failed password for root from 218.92.0.204 port 51675 ssh2 Feb 19 17:36:08 zeus sshd[4656]: Failed password for root from 218.92.0.204 port 51675 ssh2 Feb 19 17:39:30 zeus sshd[4778]: Failed password for root from 218.92.0.204 port 10386 ssh2	2020-02-20 01:51:55
125.63.116.106	attack	Feb 19 10:33:51 firewall sshd[20999]: Invalid user cpaneleximfilter from 125.63.116.106 Feb 19 10:33:53 firewall sshd[20999]: Failed password for invalid user cpaneleximfilter from 125.63.116.106 port 19994 ssh2 Feb 19 10:34:35 firewall sshd[21022]: Invalid user msagent from 125.63.116.106 ...	2020-02-20 01:54:22
185.143.223.173	attack	Feb 19 17:12:58 grey postfix/smtpd\[26631\]: NOQUEUE: reject: RCPT from unknown\[185.143.223.173\]: 554 5.7.1 Service unavailable\; Client host \[185.143.223.173\] blocked using truncate.gbudb.net\; http://www.gbudb.com/truncate/ \[185.143.223.173\]\; from=\ to=\ proto=ESMTP helo=\<\[185.143.223.163\]\> ...	2020-02-20 01:23:07
42.115.1.143	attack	Fail2Ban Ban Triggered	2020-02-20 01:42:28
94.190.9.106	attack	Automatic report - Port Scan Attack	2020-02-20 01:45:52
103.131.51.86	attackbotsspam	MultiHost/MultiPort Probe, Scan, Hack -	2020-02-20 01:47:32
190.122.112.5	attackspam	Telnetd brute force attack detected by fail2ban	2020-02-20 02:03:41
58.23.153.10	attackbots	Feb 19 17:18:45 hell sshd[12779]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.23.153.10 Feb 19 17:18:48 hell sshd[12779]: Failed password for invalid user nagios from 58.23.153.10 port 60062 ssh2 ...	2020-02-20 01:50:40
128.14.134.134	attackbotsspam	GET /version HTTP/1.1	2020-02-20 01:58:05
103.114.107.129	attackbots	MultiHost/MultiPort Probe, Scan, Hack -	2020-02-20 01:58:26
1.159.15.27	attack	Honeypot attack, port: 5555, PTR: cpe-1-159-15-27.vb12.vic.asp.telstra.net.	2020-02-20 02:03:15
114.55.0.50	attack	Unauthorized connection attempt detected from IP address 114.55.0.50 to port 445	2020-02-20 01:43:18
187.189.241.135	attackbots	2020-02-19T17:15:57.994255 sshd[29791]: Invalid user server from 187.189.241.135 port 38740 2020-02-19T17:15:58.008918 sshd[29791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.189.241.135 2020-02-19T17:15:57.994255 sshd[29791]: Invalid user server from 187.189.241.135 port 38740 2020-02-19T17:15:59.190271 sshd[29791]: Failed password for invalid user server from 187.189.241.135 port 38740 ssh2 ...	2020-02-20 01:38:47
129.28.88.77	attackspambots	Feb 19 20:47:16 areeb-Workstation sshd[28036]: Failed password for rabbitmq from 129.28.88.77 port 54914 ssh2 Feb 19 20:56:01 areeb-Workstation sshd[29705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=129.28.88.77 ...	2020-02-20 01:59:48

Recently Reported IPs

107.148.131.145	73.48.75.125	136.55.51.236	172.127.22.7
187.191.62.204	17.40.102.32	34.241.219.112	103.45.117.20
176.230.218.234	190.19.18.177	103.45.70.63	109.42.78.255
117.181.203.65	86.219.55.193	217.97.254.49	105.206.170.29
50.127.116.184	42.94.209.200	208.125.243.189	145.7.54.202