49.7.20.28 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: China Telecom

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	Automatic report - Banned IP Access	2020-09-04 00:48:59
attack	Port Scan: TCP/443	2020-09-03 16:13:27
attack	Port Scan: TCP/443	2020-09-03 08:21:48
attackbots	404 NOT FOUND	2020-08-14 12:45:26
attack	Malicious brute force vulnerability hacking attacks	2020-06-24 21:19:56
attackbots	IP: 49.7.20.28 Ports affected http protocol over TLS/SSL (443) World Wide Web HTTP (80) Abuse Confidence rating 35% Found in DNSBL('s) ASN Details AS23724 IDC China Telecommunications Corporation China (CN) CIDR 49.7.0.0/16 Log Date: 7/03/2020 5:59:58 AM UTC	2020-03-07 15:39:15

Comments on same subnet:

IP	Type	Details	Datetime
49.7.20.86	attackbotsspam	Dangerous	2020-08-18 05:09:48
49.7.20.96	attackspambots	IP: 49.7.20.96 Ports affected World Wide Web HTTP (80) Found in DNSBL('s) ASN Details AS23724 IDC China Telecommunications Corporation China (CN) CIDR 49.7.0.0/16 Log Date: 28/02/2020 4:42:31 PM UTC	2020-02-29 01:36:31
49.7.20.161	attackspam	The IP has triggered Cloudflare WAF. CF-Ray: 54330e29e9a3e819 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 04:57:49
49.7.20.7	attackspam	The IP has triggered Cloudflare WAF. CF-Ray: 5430747a7e05eb25 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 04:06:55
49.7.20.22	attackbotsspam	The IP has triggered Cloudflare WAF. CF-Ray: 54340382ba31e7f9 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 00:15:26
49.7.20.177	attack	The IP has triggered Cloudflare WAF. CF-Ray: 540fb9f34fb3e50e \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 03:22:51
49.7.20.173	attackspambots	The IP has triggered Cloudflare WAF. CF-Ray: 540f7019ae38e82d \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 00:26:18

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 49.7.20.28
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1097
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;49.7.20.28.			IN	A

;; AUTHORITY SECTION:
.			336	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2020030401 1800 900 604800 86400

;; Query time: 108 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Wed Mar 04 16:35:37 CST 2020
;; MSG SIZE  rcvd: 114

Host info

Host 28.20.7.49.in-addr.arpa. not found: 3(NXDOMAIN)

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

** server can't find 28.20.7.49.in-addr.arpa: NXDOMAIN

Related IP info:

Related comments:

IP	Type	Details	Datetime
185.40.12.26	attackspam	3389BruteforceStormFW21	2019-10-20 07:51:14
65.49.212.67	attackspam	Oct 20 01:15:30 DAAP sshd[26471]: Invalid user moaremata1 from 65.49.212.67 port 50224 Oct 20 01:15:30 DAAP sshd[26471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.49.212.67 Oct 20 01:15:30 DAAP sshd[26471]: Invalid user moaremata1 from 65.49.212.67 port 50224 Oct 20 01:15:31 DAAP sshd[26471]: Failed password for invalid user moaremata1 from 65.49.212.67 port 50224 ssh2 ...	2019-10-20 07:53:07
123.207.2.120	attackbots	2019-10-19T23:16:01.273027abusebot-5.cloudsearch.cf sshd\[12389\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.207.2.120 user=root	2019-10-20 07:55:42
203.110.179.26	attack	2019-10-19T23:26:08.367663abusebot-4.cloudsearch.cf sshd\[15290\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.110.179.26 user=root	2019-10-20 07:46:44
220.174.209.154	attack	Automatic report - Banned IP Access	2019-10-20 08:03:50
118.24.104.152	attack	SSH invalid-user multiple login try	2019-10-20 07:57:25
116.89.12.18	attack	Invalid user pi from 116.89.12.18 port 33786	2019-10-20 07:57:53
218.150.220.202	attackspambots	2019-10-19T23:12:44.193328abusebot-5.cloudsearch.cf sshd\[12341\]: Invalid user robert from 218.150.220.202 port 58068	2019-10-20 07:45:03
124.93.18.202	attack	Invalid user melquior from 124.93.18.202 port 16039	2019-10-20 07:51:53
77.81.238.70	attackspambots	Oct 20 01:27:26 OPSO sshd\[8809\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.81.238.70 user=root Oct 20 01:27:28 OPSO sshd\[8809\]: Failed password for root from 77.81.238.70 port 52259 ssh2 Oct 20 01:37:16 OPSO sshd\[10146\]: Invalid user waski from 77.81.238.70 port 44781 Oct 20 01:37:16 OPSO sshd\[10146\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.81.238.70 Oct 20 01:37:18 OPSO sshd\[10146\]: Failed password for invalid user waski from 77.81.238.70 port 44781 ssh2	2019-10-20 07:42:26
81.22.45.29	attack	10/19/2019-17:08:25.299202 81.22.45.29 Protocol: 6 ET SCAN NMAP -sS window 1024	2019-10-20 07:58:10
80.249.161.171	attack	"Dobroslava" 69.94.151.126 hzehjx709625060366905040568460@rc.cumannnabhfear.com http://cumannnabhfear.com/aa.php?a=25yu35661726wp0qrxya82ks5n887mz2f7bkpt	2019-10-20 08:07:39
177.91.109.76	attack	Honeypot attack, port: 23, PTR: 76-109-91-177.pollynet.com.br.	2019-10-20 07:56:48
1.213.195.154	attackspam	Oct 19 12:39:54 kapalua sshd\[12669\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.213.195.154 user=root Oct 19 12:39:57 kapalua sshd\[12669\]: Failed password for root from 1.213.195.154 port 16329 ssh2 Oct 19 12:44:25 kapalua sshd\[13043\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.213.195.154 user=games Oct 19 12:44:27 kapalua sshd\[13043\]: Failed password for games from 1.213.195.154 port 36197 ssh2 Oct 19 12:49:01 kapalua sshd\[13422\]: Invalid user admin from 1.213.195.154	2019-10-20 07:49:37
157.245.230.224	attackspam	157.245.230.224 - - [20/Oct/2019:00:12:08 +0400] "POST /GponForm/diag_Form?style/ HTTP/1.1" 502 157 "-" "curl/7.3.2" ...	2019-10-20 08:03:22

Recently Reported IPs

177.69.231.201	106.0.191.193	137.118.40.128	188.162.142.185
23.95.198.142	45.177.93.92	85.158.39.20	114.4.120.251
84.205.235.9	47.92.73.109	61.253.187.223	218.5.230.212
95.142.173.253	69.131.231.11	148.255.224.171	102.42.237.185
37.123.163.106	123.20.60.213	117.1.249.91	132.232.31.117