49.7.4.189 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: China Telecom

Hostname: unknown

Organization: unknown

Usage Type: unknown

Comments:

Make a comment on this IP

Type	Details	Datetime
attackbotsspam	The IP has triggered Cloudflare WAF. CF-Ray: 543636cbb8d977b2 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: api.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 9; zh-CN; vivo Z1 Build/PKQ1.180819.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.6.6.1046 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 06:07:39

Type

Details

Datetime

attackbotsspam

The IP has triggered Cloudflare WAF. CF-Ray: 543636cbb8d977b2 | WAF_Rule_ID: asn | WAF_Kind: firewall | CF_Action: jschallenge | Country: CN | CF_IPClass: unknown | Protocol: HTTP/1.1 | Method: GET | Host: api.skk.moe | User-Agent: Mozilla/5.0 (Linux; U; Android 9; zh-CN; vivo Z1 Build/PKQ1.180819.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.6.6.1046 Mobile Safari/537.36 | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-12 06:07:39

Comments on same subnet:

IP	Type	Details	Datetime
49.7.4.35	attackspam	The IP has triggered Cloudflare WAF. CF-Ray: 5435dbc1a8aee4fa \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: ip.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 10; zh-CN; PCLM10 Build/QKQ1.190825.002) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Quark/3.6.2.122 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 07:18:27
49.7.4.136	attackspambots	The IP has triggered Cloudflare WAF. CF-Ray: 5436372e9f21e4fa \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: ip.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 9; zh-CN; vivo Z1 Build/PKQ1.180819.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.6.6.1046 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 06:08:10
49.7.4.134	attack	The IP has triggered Cloudflare WAF. CF-Ray: 543850f4095aeb75 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: d.skk.moe \| User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 13_1_3 like Mac OS X; zh-CN) AppleWebKit/537.51.1 (KHTML, like Gecko) Mobile/17A878 UCBrowser/12.7.1.1240 Mobile AliApp(TUnionSDK/0.1.20.3) \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 05:48:00
49.7.4.154	attack	The IP has triggered Cloudflare WAF. CF-Ray: 543379425d06e50a \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: disqus.skk.moe \| User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_2 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8H7 Safari/6533.18.5 UCBrowser/12.2.8.1008 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 05:22:10
49.7.4.162	attack	The IP has triggered Cloudflare WAF. CF-Ray: 5433794fcdf5eb99 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: disqus.skk.moe \| User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_2 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8H7 Safari/6533.18.5 UCBrowser/12.2.8.1008 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 05:21:52
49.7.4.17	attackspambots	The IP has triggered Cloudflare WAF. CF-Ray: 5432e94f2c79eb45 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: ip.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 8.1.0; zh-CN; 16th Plus Build/OPM1.171019.026) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Quark/3.6.2.122 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 04:58:34
49.7.4.98	attackspam	The IP has triggered Cloudflare WAF. CF-Ray: 5431524afcb3e80d \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 9; zh-CN; GLK-AL00 Build/HUAWEIGLK-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.7.1.1051 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 04:58:21
49.7.4.125	attackbots	The IP has triggered Cloudflare WAF. CF-Ray: 54315244eedcd386 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: jschallenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 9; zh-CN; GLK-AL00 Build/HUAWEIGLK-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.7.1.1051 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 03:40:07
49.7.4.17	attackspambots	The IP has triggered Cloudflare WAF. CF-Ray: 5416ccf66b55e50e \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 9; zh-CN; Redmi K20 Pro Build/PKQ1.181121.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Quark/3.6.2.122 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 04:46:02
49.7.4.36	attack	The IP has triggered Cloudflare WAF. CF-Ray: 541259482eb4eb49 \| WAF_Rule_ID: asn \| WAF_Kind: firewall \| CF_Action: challenge \| Country: CN \| CF_IPClass: unknown \| Protocol: HTTP/1.1 \| Method: GET \| Host: img.skk.moe \| User-Agent: Mozilla/5.0 (Linux; U; Android 6.0.1; zh-CN; OPPO R9sk Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 UCBrowser/12.7.6.1056 Mobile Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-08 02:06:32
49.7.4.87	attackbots	The%20IP%20has%20triggered%20Cloudflare%20WAF.%20Report%20generated%20by%20Cloudflare-WAF-to-AbuseIPDB%20(https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB)	2019-11-19 04:59:00
49.7.43.8	attack	Blocked for port scanning. Time: Tue Oct 15. 19:44:47 2019 +0200 IP: 49.7.43.8 (CN/China/-) Sample of block hits: Oct 15 19:43:42 vserv kernel: [44763591.510049] Firewall: TCP_IN Blocked IN=eth0 OUT= MAC= SRC=49.7.43.8 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=13671 DF PROTO=TCP SPT=30539 DPT=25084 WINDOW=29200 RES=0x00 SYN URGP=0 Oct 15 19:43:43 vserv kernel: [44763592.512217] Firewall: TCP_IN Blocked IN=eth0 OUT= MAC= SRC=49.7.43.8 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=13672 DF PROTO=TCP SPT=30539 DPT=25084 WINDOW=29200 RES=0x00 SYN URGP=0 Oct 15 19:43:45 vserv kernel: [44763594.517298] Firewall: TCP_IN Blocked IN=eth0 OUT= MAC= SRC=49.7.43.8 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=13673 DF PROTO=TCP SPT=30539 DPT=25084 WINDOW=29200 RES=0x00 SYN URGP=0 Oct 15 19:43:49 vserv kernel: [44763598.525602] Firewall: TCP_IN Blocked IN=eth0 OUT= MAC= SRC=49.7.43.8 DST=[removed] LEN=60 TOS=0x00 PREC=0x00 TTL=45 ID=13674 DF PROTO=TCP SPT=30539 DPT=25084 WINDOW=29200	2019-10-16 08:55:30

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 49.7.4.189
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 3245
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;49.7.4.189.			IN	A

;; AUTHORITY SECTION:
.			291	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121101 1800 900 604800 86400

;; Query time: 64 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Dec 12 06:07:34 CST 2019
;; MSG SIZE  rcvd: 114

Host info

Host 189.4.7.49.in-addr.arpa not found: 2(SERVFAIL)

Nslookup info:

;; Got SERVFAIL reply from 100.100.2.136, trying next server
;; Got SERVFAIL reply from 100.100.2.138, trying next server
Server:		100.100.2.138
Address:	100.100.2.138#53

** server can't find 189.4.7.49.in-addr.arpa: SERVFAIL

Related IP info:

Related comments:

IP	Type	Details	Datetime
111.231.93.242	attackspambots	Apr 24 14:21:21 OPSO sshd\[20415\]: Invalid user wisconsin from 111.231.93.242 port 60560 Apr 24 14:21:21 OPSO sshd\[20415\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.93.242 Apr 24 14:21:23 OPSO sshd\[20415\]: Failed password for invalid user wisconsin from 111.231.93.242 port 60560 ssh2 Apr 24 14:25:37 OPSO sshd\[21823\]: Invalid user Administrator from 111.231.93.242 port 50582 Apr 24 14:25:37 OPSO sshd\[21823\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.93.242	2020-04-24 20:51:09
187.191.96.60	attackbots	Apr 24 12:35:15 web8 sshd\[16734\]: Invalid user beng from 187.191.96.60 Apr 24 12:35:15 web8 sshd\[16734\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.191.96.60 Apr 24 12:35:17 web8 sshd\[16734\]: Failed password for invalid user beng from 187.191.96.60 port 42700 ssh2 Apr 24 12:38:50 web8 sshd\[18604\]: Invalid user zp from 187.191.96.60 Apr 24 12:38:50 web8 sshd\[18604\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.191.96.60	2020-04-24 20:41:20
18.222.111.164	attack	[Fri Apr 24 04:36:07 2020 GMT] Consumer Guardian [RDNS_DYNAMIC], Subject: Have you been injured by 3M Duel-Ended Combat Arms Earplugs? [Fri Apr 24 04:36:08 2020 GMT] SilverSingles Associate [RDNS_DYNAMIC], Subject: Meet your best match on SilverSingles while home	2020-04-24 20:59:56
193.112.5.66	attackbotsspam	Apr 24 14:06:48 dev0-dcde-rnet sshd[8123]: Failed password for root from 193.112.5.66 port 17346 ssh2 Apr 24 14:09:34 dev0-dcde-rnet sshd[8221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.112.5.66 Apr 24 14:09:36 dev0-dcde-rnet sshd[8221]: Failed password for invalid user alcauskas from 193.112.5.66 port 55108 ssh2	2020-04-24 21:15:26
185.50.149.17	attackbots	(smtpauth) Failed SMTP AUTH login from 185.50.149.17 (CZ/Czechia/-): 5 in the last 3600 secs	2020-04-24 20:53:59
103.145.13.12	attack	Apr 24 14:12:49 debian-2gb-nbg1-2 kernel: \[9989314.302649\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=103.145.13.12 DST=195.201.40.59 LEN=441 TOS=0x08 PREC=0x20 TTL=51 ID=35745 DF PROTO=UDP SPT=5074 DPT=5060 LEN=421	2020-04-24 20:50:45
106.13.41.87	attackbots	Apr 24 14:59:50 ncomp sshd[10776]: Invalid user mc2 from 106.13.41.87 Apr 24 14:59:50 ncomp sshd[10776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.13.41.87 Apr 24 14:59:50 ncomp sshd[10776]: Invalid user mc2 from 106.13.41.87 Apr 24 14:59:52 ncomp sshd[10776]: Failed password for invalid user mc2 from 106.13.41.87 port 40410 ssh2	2020-04-24 21:00:33
222.186.173.180	attackbotsspam	Apr 24 12:42:48 124388 sshd[27383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.180 user=root Apr 24 12:42:51 124388 sshd[27383]: Failed password for root from 222.186.173.180 port 28398 ssh2 Apr 24 12:43:07 124388 sshd[27383]: error: maximum authentication attempts exceeded for root from 222.186.173.180 port 28398 ssh2 [preauth] Apr 24 12:43:11 124388 sshd[27385]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.173.180 user=root Apr 24 12:43:13 124388 sshd[27385]: Failed password for root from 222.186.173.180 port 52428 ssh2	2020-04-24 20:53:07
182.74.217.186	attack	20/4/24@08:09:46: FAIL: Alarm-Network address from=182.74.217.186 20/4/24@08:09:46: FAIL: Alarm-Network address from=182.74.217.186 ...	2020-04-24 21:03:29
104.128.92.120	attackspam	Brute-force attempt banned	2020-04-24 21:02:12
103.72.144.228	attack	Brute-force attempt banned	2020-04-24 21:11:20
194.26.29.212	attackbotsspam	Apr 24 14:57:18 debian-2gb-nbg1-2 kernel: \[9991982.604385\] \[UFW BLOCK\] IN=eth0 OUT= MAC=96:00:00:0e:18:f4:d2:74:7f:6e:37:e3:08:00 SRC=194.26.29.212 DST=195.201.40.59 LEN=40 TOS=0x00 PREC=0x00 TTL=242 ID=14780 PROTO=TCP SPT=55761 DPT=6788 WINDOW=1024 RES=0x00 SYN URGP=0	2020-04-24 21:13:58
51.77.151.175	attack	prod8 ...	2020-04-24 21:20:05
115.84.91.101	attack	failed_logins	2020-04-24 21:13:05
222.175.19.94	attackspam	1587730216 - 04/24/2020 14:10:16 Host: 222.175.19.94/222.175.19.94 Port: 445 TCP Blocked	2020-04-24 20:39:28

Recently Reported IPs

25.164.104.165	222.82.63.22	222.79.48.153	220.200.156.90
218.58.38.199	210.203.20.175	183.184.26.193	182.138.158.72
182.88.78.52	209.119.140.22	180.95.238.218	175.184.164.171
175.152.31.100	204.212.82.137	172.104.101.218	171.34.179.231
149.129.93.168	131.159.24.47	128.199.238.128	125.230.175.194