202.102.144.122

Basic Info

City: Henancun

Region: Shandong

Country: China

Internet Service Provider: China Unicom

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

No discussion about this IP yet. Click above link to make one.

Comments on same subnet:

IP	Type	Details	Datetime
202.102.144.114	attackbots	Port scan - 9 hits (greater than 5)	2020-09-17 23:35:47
202.102.144.114	attack	Port scan - 9 hits (greater than 5)	2020-09-17 15:42:35
202.102.144.114	attack	Honeypot attack, port: 81, PTR: ppp51.dyptt.sd.cn.	2020-09-17 06:48:40
202.102.144.114	attack	srvr2: (mod_security) mod_security (id:920350) triggered by 202.102.144.114 (CN/-/ppp51.dyptt.sd.cn): 1 in the last 600 secs; Ports: ; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/31 14:37:17 [error] 315421#0: 329363 [client 202.102.144.114] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159887743722.658890"] [ref "o0,12v21,12"], client: 202.102.144.114, [redacted] request: "GET / HTTP/1.1" [redacted]	2020-08-31 20:46:41
202.102.144.117	attackbots	Auto Detect Rule! proto TCP (SYN), 202.102.144.117:40641->gjan.info:23, len 40	2020-08-25 20:24:52
202.102.144.114	attackbots	TCP (SYN) 202.102.144.114:52224 -> port 443, len 40	2020-08-23 19:39:58
202.102.144.114	attackbots	Web application attack detected by fail2ban	2020-07-29 03:15:11
202.102.144.117	attack	Unauthorised access (Jun 30) SRC=202.102.144.117 LEN=40 TTL=238 ID=508 TCP DPT=23 WINDOW=1024 SYN Unauthorised access (Jun 30) SRC=202.102.144.117 LEN=40 TTL=238 ID=39599 TCP DPT=1433 WINDOW=1024 SYN	2020-07-01 03:16:20

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 202.102.144.122
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24599
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;202.102.144.122.		IN	A

;; AUTHORITY SECTION:
.			388	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2022061000 1800 900 604800 86400

;; Query time: 69 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat Jun 11 03:35:10 CST 2022
;; MSG SIZE  rcvd: 108

Host info

122.144.102.202.in-addr.arpa domain name pointer ppp59.dyptt.sd.cn.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
122.144.102.202.in-addr.arpa	name = ppp59.dyptt.sd.cn.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
202.93.226.250	attackbots	DATE:2019-09-03 20:38:51, IP:202.93.226.250, PORT:telnet - Telnet brute force auth on a honeypot server (epe-dc)	2019-09-04 05:06:59
23.129.64.193	attackspambots	Sep 3 21:13:32 MK-Soft-VM6 sshd\[14970\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.129.64.193 user=root Sep 3 21:13:34 MK-Soft-VM6 sshd\[14970\]: Failed password for root from 23.129.64.193 port 19459 ssh2 Sep 3 21:13:36 MK-Soft-VM6 sshd\[14970\]: Failed password for root from 23.129.64.193 port 19459 ssh2 ...	2019-09-04 05:21:58
222.186.52.78	attackbotsspam	Sep 3 17:01:04 ny01 sshd[18796]: Failed password for root from 222.186.52.78 port 37284 ssh2 Sep 3 17:01:06 ny01 sshd[18796]: Failed password for root from 222.186.52.78 port 37284 ssh2 Sep 3 17:01:08 ny01 sshd[18796]: Failed password for root from 222.186.52.78 port 37284 ssh2	2019-09-04 05:21:14
223.171.32.55	attackspam	Sep 3 11:06:51 friendsofhawaii sshd\[9252\]: Invalid user user100 from 223.171.32.55 Sep 3 11:06:51 friendsofhawaii sshd\[9252\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.32.55 Sep 3 11:06:54 friendsofhawaii sshd\[9252\]: Failed password for invalid user user100 from 223.171.32.55 port 10016 ssh2 Sep 3 11:11:42 friendsofhawaii sshd\[9814\]: Invalid user postgres from 223.171.32.55 Sep 3 11:11:42 friendsofhawaii sshd\[9814\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.171.32.55	2019-09-04 05:26:43
202.159.24.35	attackspambots	Sep 3 17:10:07 plusreed sshd[3381]: Invalid user march from 202.159.24.35 ...	2019-09-04 05:11:31
196.196.83.111	attackbotsspam	2019-09-03 13:37:10 dovecot_login authenticator failed for (hwacrsg7) [196.196.83.111]:4777 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=richard.grayson@lerctr.org) 2019-09-03 13:37:17 dovecot_login authenticator failed for (S84GSo5) [196.196.83.111]:3111 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=richard.grayson@lerctr.org) 2019-09-03 13:37:28 dovecot_login authenticator failed for (G4iPblsZ) [196.196.83.111]:3113 I=[192.147.25.65]:25: 535 Incorrect authentication data (set_id=richard.grayson@lerctr.org) ...	2019-09-04 05:42:55
221.214.74.10	attackbots	Sep 3 11:22:12 hcbb sshd\[26743\]: Invalid user test from 221.214.74.10 Sep 3 11:22:12 hcbb sshd\[26743\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.214.74.10 Sep 3 11:22:14 hcbb sshd\[26743\]: Failed password for invalid user test from 221.214.74.10 port 2225 ssh2 Sep 3 11:26:30 hcbb sshd\[27124\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.214.74.10 user=root Sep 3 11:26:32 hcbb sshd\[27124\]: Failed password for root from 221.214.74.10 port 2226 ssh2	2019-09-04 05:40:17
23.129.64.203	attackbots	Sep 3 23:22:43 lnxded64 sshd[13236]: Failed password for root from 23.129.64.203 port 47159 ssh2 Sep 3 23:22:43 lnxded64 sshd[13236]: Failed password for root from 23.129.64.203 port 47159 ssh2 Sep 3 23:22:47 lnxded64 sshd[13236]: Failed password for root from 23.129.64.203 port 47159 ssh2	2019-09-04 05:38:54
14.153.50.201	attackbots	Sep 3 21:08:18 ip-172-31-1-72 sshd\[28417\]: Invalid user sami from 14.153.50.201 Sep 3 21:08:18 ip-172-31-1-72 sshd\[28417\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.153.50.201 Sep 3 21:08:20 ip-172-31-1-72 sshd\[28417\]: Failed password for invalid user sami from 14.153.50.201 port 44986 ssh2 Sep 3 21:13:14 ip-172-31-1-72 sshd\[28631\]: Invalid user mcm from 14.153.50.201 Sep 3 21:13:14 ip-172-31-1-72 sshd\[28631\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.153.50.201	2019-09-04 05:19:57
197.51.154.128	attackspam	Caught in portsentry honeypot	2019-09-04 05:16:17
106.12.5.35	attack	Sep 3 21:32:20 hb sshd\[13585\]: Invalid user ny from 106.12.5.35 Sep 3 21:32:20 hb sshd\[13585\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.5.35 Sep 3 21:32:21 hb sshd\[13585\]: Failed password for invalid user ny from 106.12.5.35 port 58938 ssh2 Sep 3 21:36:49 hb sshd\[13936\]: Invalid user ionut from 106.12.5.35 Sep 3 21:36:49 hb sshd\[13936\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.5.35	2019-09-04 05:37:02
172.81.237.242	attackbots	Sep 3 11:08:06 sachi sshd\[6569\]: Invalid user night from 172.81.237.242 Sep 3 11:08:06 sachi sshd\[6569\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.237.242 Sep 3 11:08:07 sachi sshd\[6569\]: Failed password for invalid user night from 172.81.237.242 port 43334 ssh2 Sep 3 11:13:13 sachi sshd\[7092\]: Invalid user louis from 172.81.237.242 Sep 3 11:13:13 sachi sshd\[7092\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.81.237.242	2019-09-04 05:23:21
146.185.133.99	attackbotsspam	WordPress brute force	2019-09-04 05:12:53
185.217.228.12	attackspam	Tue, 03 Sep 2019 14:35:56 -0400 Received: from skill.xrmbest.com ([185.217.228.12]:26599 helo=canlobby.pro) From: Tinnitus cure spam	2019-09-04 05:44:37
138.75.57.170	attack	C1,WP GET /lappan/wp-login.php	2019-09-04 05:36:05

Recently Reported IPs

143.244.174.247	205.185.125.146	46.145.226.64	154.72.148.134
45.65.56.244	59.90.30.174	180.190.160.156	156.52.58.59
88.35.209.82	55.246.38.190	101.10.14.51	148.124.7.105
235.136.190.213	178.138.34.78	185.241.24.58	170.181.211.216
6.236.189.153	198.171.26.247	194.145.20.23	31.190.228.62