39.66.12.31 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: China Unicom Shandong Province Network

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attackspambots	unauthorized connection attempt	2020-01-28 20:16:15

Comments on same subnet:

IP	Type	Details	Datetime
39.66.128.26	attackbots	Unauthorised access (Apr 11) SRC=39.66.128.26 LEN=40 TTL=49 ID=15180 TCP DPT=8080 WINDOW=58766 SYN Unauthorised access (Apr 11) SRC=39.66.128.26 LEN=40 TTL=49 ID=29837 TCP DPT=8080 WINDOW=58766 SYN Unauthorised access (Apr 10) SRC=39.66.128.26 LEN=40 TTL=49 ID=123 TCP DPT=8080 WINDOW=58766 SYN Unauthorised access (Apr 9) SRC=39.66.128.26 LEN=40 TTL=49 ID=37742 TCP DPT=8080 WINDOW=58766 SYN Unauthorised access (Apr 9) SRC=39.66.128.26 LEN=40 TTL=49 ID=52320 TCP DPT=8080 WINDOW=58766 SYN Unauthorised access (Apr 8) SRC=39.66.128.26 LEN=40 TTL=49 ID=42439 TCP DPT=8080 WINDOW=35887 SYN Unauthorised access (Apr 7) SRC=39.66.128.26 LEN=40 TTL=49 ID=47340 TCP DPT=8080 WINDOW=23269 SYN Unauthorised access (Apr 6) SRC=39.66.128.26 LEN=40 TTL=49 ID=32178 TCP DPT=8080 WINDOW=23269 SYN Unauthorised access (Apr 5) SRC=39.66.128.26 LEN=40 TTL=49 ID=52920 TCP DPT=8080 WINDOW=35887 SYN	2020-04-12 02:47:34
39.66.128.26	attackbots	(Apr 4) LEN=40 TTL=49 ID=6995 TCP DPT=8080 WINDOW=35887 SYN (Apr 3) LEN=40 TTL=49 ID=46064 TCP DPT=8080 WINDOW=19023 SYN (Apr 3) LEN=40 TTL=49 ID=13622 TCP DPT=8080 WINDOW=58766 SYN (Apr 3) LEN=40 TTL=49 ID=28368 TCP DPT=8080 WINDOW=23269 SYN (Apr 2) LEN=40 TTL=49 ID=47435 TCP DPT=8080 WINDOW=23269 SYN (Apr 1) LEN=40 TTL=49 ID=53193 TCP DPT=8080 WINDOW=58766 SYN (Apr 1) LEN=40 TTL=49 ID=6497 TCP DPT=8080 WINDOW=23269 SYN (Mar 31) LEN=40 TTL=49 ID=63687 TCP DPT=8080 WINDOW=35887 SYN (Mar 31) LEN=40 TTL=49 ID=20155 TCP DPT=8080 WINDOW=23269 SYN (Mar 31) LEN=40 TTL=49 ID=46808 TCP DPT=8080 WINDOW=58766 SYN (Mar 30) LEN=40 TTL=49 ID=65481 TCP DPT=8080 WINDOW=35887 SYN	2020-04-04 19:21:42
39.66.128.26	attackbotsspam	Unauthorised access (Mar 31) SRC=39.66.128.26 LEN=40 TTL=49 ID=20155 TCP DPT=8080 WINDOW=23269 SYN Unauthorised access (Mar 31) SRC=39.66.128.26 LEN=40 TTL=49 ID=46808 TCP DPT=8080 WINDOW=58766 SYN Unauthorised access (Mar 30) SRC=39.66.128.26 LEN=40 TTL=49 ID=65481 TCP DPT=8080 WINDOW=35887 SYN	2020-03-31 20:50:28

Type

Details

Datetime

39.66.128.26

attackbots

Unauthorised access (Apr 11) SRC=39.66.128.26 LEN=40 TTL=49 ID=15180 TCP DPT=8080 WINDOW=58766 SYN 
Unauthorised access (Apr 11) SRC=39.66.128.26 LEN=40 TTL=49 ID=29837 TCP DPT=8080 WINDOW=58766 SYN 
Unauthorised access (Apr 10) SRC=39.66.128.26 LEN=40 TTL=49 ID=123 TCP DPT=8080 WINDOW=58766 SYN 
Unauthorised access (Apr  9) SRC=39.66.128.26 LEN=40 TTL=49 ID=37742 TCP DPT=8080 WINDOW=58766 SYN 
Unauthorised access (Apr  9) SRC=39.66.128.26 LEN=40 TTL=49 ID=52320 TCP DPT=8080 WINDOW=58766 SYN 
Unauthorised access (Apr  8) SRC=39.66.128.26 LEN=40 TTL=49 ID=42439 TCP DPT=8080 WINDOW=35887 SYN 
Unauthorised access (Apr  7) SRC=39.66.128.26 LEN=40 TTL=49 ID=47340 TCP DPT=8080 WINDOW=23269 SYN 
Unauthorised access (Apr  6) SRC=39.66.128.26 LEN=40 TTL=49 ID=32178 TCP DPT=8080 WINDOW=23269 SYN 
Unauthorised access (Apr  5) SRC=39.66.128.26 LEN=40 TTL=49 ID=52920 TCP DPT=8080 WINDOW=35887 SYN

2020-04-12 02:47:34

39.66.128.26

attackbots

(Apr  4)  LEN=40 TTL=49 ID=6995 TCP DPT=8080 WINDOW=35887 SYN 
 (Apr  3)  LEN=40 TTL=49 ID=46064 TCP DPT=8080 WINDOW=19023 SYN 
 (Apr  3)  LEN=40 TTL=49 ID=13622 TCP DPT=8080 WINDOW=58766 SYN 
 (Apr  3)  LEN=40 TTL=49 ID=28368 TCP DPT=8080 WINDOW=23269 SYN 
 (Apr  2)  LEN=40 TTL=49 ID=47435 TCP DPT=8080 WINDOW=23269 SYN 
 (Apr  1)  LEN=40 TTL=49 ID=53193 TCP DPT=8080 WINDOW=58766 SYN 
 (Apr  1)  LEN=40 TTL=49 ID=6497 TCP DPT=8080 WINDOW=23269 SYN 
 (Mar 31)  LEN=40 TTL=49 ID=63687 TCP DPT=8080 WINDOW=35887 SYN 
 (Mar 31)  LEN=40 TTL=49 ID=20155 TCP DPT=8080 WINDOW=23269 SYN 
 (Mar 31)  LEN=40 TTL=49 ID=46808 TCP DPT=8080 WINDOW=58766 SYN 
 (Mar 30)  LEN=40 TTL=49 ID=65481 TCP DPT=8080 WINDOW=35887 SYN

2020-04-04 19:21:42

39.66.128.26

attackbotsspam

Unauthorised access (Mar 31) SRC=39.66.128.26 LEN=40 TTL=49 ID=20155 TCP DPT=8080 WINDOW=23269 SYN 
Unauthorised access (Mar 31) SRC=39.66.128.26 LEN=40 TTL=49 ID=46808 TCP DPT=8080 WINDOW=58766 SYN 
Unauthorised access (Mar 30) SRC=39.66.128.26 LEN=40 TTL=49 ID=65481 TCP DPT=8080 WINDOW=35887 SYN

2020-03-31 20:50:28

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 39.66.12.31
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36001
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;39.66.12.31.			IN	A

;; AUTHORITY SECTION:
.			522	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020012800 1800 900 604800 86400

;; Query time: 96 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Tue Jan 28 20:16:10 CST 2020
;; MSG SIZE  rcvd: 115

Host info

Host 31.12.66.39.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 31.12.66.39.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
128.199.248.200	attack	Observed brute-forces/probes at wordpress endpoints	2020-04-29 03:14:56
37.150.5.60	attackspambots	Honeypot attack, port: 445, PTR: 37.150.5.60.megaline.telecom.kz.	2020-04-29 02:44:43
24.181.205.130	attack	Apr 28 16:26:47 mail.srvfarm.net postfix/smtpd[1135175]: NOQUEUE: reject: RCPT from 024-181-205-130.biz.spectrum.com[24.181.205.130]: 554 5.7.1 Service unavailable; Client host [24.181.205.130] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?24.181.205.130; from= to= proto=ESMTP helo= Apr 28 16:26:52 mail.srvfarm.net postfix/smtpd[1135175]: NOQUEUE: reject: RCPT from 024-181-205-130.biz.spectrum.com[24.181.205.130]: 554 5.7.1 Service unavailable; Client host [24.181.205.130] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?24.181.205.130; from= to= proto=ESMTP helo= Apr 28 16:26:59 mail.srvfarm.net postfix/smtpd[1135175]: NOQUEUE: reject: RCPT from 024-181-205-130.biz.spectrum.com[24.181.205.130]: 554 5.7.1 Service unavailable; Client host [24.181.205.130] blocked using bl.spamcop.net; Blocked - see	2020-04-29 03:01:35
34.97.205.67	attackbots	2020-04-28T10:05:07.0875311495-001 sshd[13689]: Failed password for invalid user admin from 34.97.205.67 port 34544 ssh2 2020-04-28T10:07:42.8382701495-001 sshd[13837]: Invalid user caffe from 34.97.205.67 port 42116 2020-04-28T10:07:42.8509861495-001 sshd[13837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.205.97.34.bc.googleusercontent.com 2020-04-28T10:07:42.8382701495-001 sshd[13837]: Invalid user caffe from 34.97.205.67 port 42116 2020-04-28T10:07:44.7055281495-001 sshd[13837]: Failed password for invalid user caffe from 34.97.205.67 port 42116 ssh2 2020-04-28T10:10:18.0905661495-001 sshd[14000]: Invalid user liuyong from 34.97.205.67 port 49696 ...	2020-04-29 03:24:28
223.240.86.204	attackbotsspam	(sshd) Failed SSH login from 223.240.86.204 (-): 5 in the last 3600 secs	2020-04-29 03:01:49
80.91.163.138	attack	Honeypot attack, port: 445, PTR: PTR record not found	2020-04-29 03:16:30
113.142.139.118	attackbotsspam	$f2bV_matches \| Triggered by Fail2Ban at Vostok web server	2020-04-29 02:57:34
108.170.183.8	attackbots	Honeypot attack, port: 5555, PTR: dhcp-108-170-183-8.cable.user.start.ca.	2020-04-29 03:09:33
103.25.92.72	attackspambots	Apr 28 20:34:38 haigwepa sshd[19860]: Failed password for root from 103.25.92.72 port 21633 ssh2 ...	2020-04-29 02:51:44
222.186.173.238	attackspambots	Apr 28 18:59:09 localhost sshd[1589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238 user=root Apr 28 18:59:11 localhost sshd[1589]: Failed password for root from 222.186.173.238 port 33888 ssh2 Apr 28 18:59:14 localhost sshd[1589]: Failed password for root from 222.186.173.238 port 33888 ssh2 Apr 28 18:59:09 localhost sshd[1589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238 user=root Apr 28 18:59:11 localhost sshd[1589]: Failed password for root from 222.186.173.238 port 33888 ssh2 Apr 28 18:59:14 localhost sshd[1589]: Failed password for root from 222.186.173.238 port 33888 ssh2 Apr 28 18:59:09 localhost sshd[1589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.238 user=root Apr 28 18:59:11 localhost sshd[1589]: Failed password for root from 222.186.173.238 port 33888 ssh2 Apr 28 18:59:14 localhost sshd[1589]: Fai ...	2020-04-29 03:02:26
115.68.219.130	attack	Found by fail2ban	2020-04-29 02:48:27
180.188.182.59	attack	Honeypot attack, port: 5555, PTR: PTR record not found	2020-04-29 02:56:21
105.112.53.236	attackspam	Honeypot attack, port: 445, PTR: PTR record not found	2020-04-29 02:50:59
91.77.70.251	attackbots	Apr 28 14:05:34 ns382633 sshd\[5644\]: Invalid user grant from 91.77.70.251 port 48896 Apr 28 14:05:34 ns382633 sshd\[5644\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.77.70.251 Apr 28 14:05:36 ns382633 sshd\[5644\]: Failed password for invalid user grant from 91.77.70.251 port 48896 ssh2 Apr 28 14:08:50 ns382633 sshd\[5962\]: Invalid user horia from 91.77.70.251 port 48354 Apr 28 14:08:50 ns382633 sshd\[5962\]: pam_unix$sshd:auth$: authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.77.70.251	2020-04-29 02:44:13
184.106.251.114	attackspam	Honeypot attack, port: 445, PTR: 184-106-251-114.static.cloud-ips.com.	2020-04-29 03:13:05

Recently Reported IPs

36.237.7.146	5.63.15.176	1.246.222.208	197.60.218.89
189.163.77.162	177.41.214.156	156.206.56.233	125.24.11.52
109.160.96.41	94.28.30.251	91.139.0.6	89.250.223.118
81.30.204.254	77.79.240.9	49.82.98.211	47.64.46.248
36.71.159.111	200.125.235.134	191.240.146.54	189.252.153.233