52.80.32.140 - IPInfo

Basic Info

City: unknown

Region: unknown

Country: China

Internet Service Provider: Beijing Guanghuan Xinwang Digital Technology Co.Ltd

Hostname: unknown

Organization: unknown

Usage Type: Data Center/Web Hosting/Transit

Comments:

Make a comment on this IP

Type	Details	Datetime
attack	The IP has triggered Cloudflare WAF. CF-Ray: 5431c29e0e4a7940 \| WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 \| WAF_Kind: firewall \| CF_Action: drop \| Country: CN \| CF_IPClass: noRecord \| Protocol: HTTP/1.1 \| Method: GET \| Host: d.skk.moe \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 \| CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).	2019-12-12 06:34:37

Type

Details

Datetime

attack

The IP has triggered Cloudflare WAF. CF-Ray: 5431c29e0e4a7940 | WAF_Rule_ID: 3b40188685924a32bf11d40edea05a27 | WAF_Kind: firewall | CF_Action: drop | Country: CN | CF_IPClass: noRecord | Protocol: HTTP/1.1 | Method: GET | Host: d.skk.moe | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 | CF_DC: LAX. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/SukkaW/Cloudflare-WAF-to-AbuseIPDB).

2019-12-12 06:34:37

Comments on same subnet:

No discussion about this subnet yet..

Whois info:

Dig info:

; <<>> DiG 9.10.3-P4-Ubuntu <<>> 52.80.32.140
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19547
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;52.80.32.140.			IN	A

;; AUTHORITY SECTION:
.			248	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2019121101 1800 900 604800 86400

;; Query time: 66 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Dec 12 06:34:35 CST 2019
;; MSG SIZE  rcvd: 116

Host info

140.32.80.52.in-addr.arpa domain name pointer ec2-52-80-32-140.cn-north-1.compute.amazonaws.com.cn.

Nslookup info:

Server:		183.60.83.19
Address:	183.60.83.19#53

Non-authoritative answer:
140.32.80.52.in-addr.arpa	name = ec2-52-80-32-140.cn-north-1.compute.amazonaws.com.cn.

Authoritative answers can be found from:

Related IP info:

Related comments:

IP	Type	Details	Datetime
52.130.85.229	attackbotsspam	Sep 27 05:51:50 NG-HHDC-SVS-001 sshd[18768]: Invalid user gary from 52.130.85.229 ...	2020-09-27 06:19:24
42.224.76.39	attackbotsspam	DATE:2020-09-25 22:36:32, IP:42.224.76.39, PORT:telnet Telnet brute force auth on honeypot server (epe-honey1-hq)	2020-09-27 06:14:26
167.248.133.33	attack	Sep 14 06:05:33 hidden postfix/postscreen[42581]: DNSBL rank 3 for [167.248.133.33]:40148	2020-09-27 06:26:11
116.196.72.227	attackbotsspam	Sep 27 00:03:13 inter-technics sshd[22759]: Invalid user server from 116.196.72.227 port 44294 Sep 27 00:03:13 inter-technics sshd[22759]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.196.72.227 Sep 27 00:03:13 inter-technics sshd[22759]: Invalid user server from 116.196.72.227 port 44294 Sep 27 00:03:15 inter-technics sshd[22759]: Failed password for invalid user server from 116.196.72.227 port 44294 ssh2 Sep 27 00:06:59 inter-technics sshd[23140]: Invalid user richard from 116.196.72.227 port 44972 ...	2020-09-27 06:30:04
190.237.93.172	attackbots	2020-09-26 00:56:12.830744-0500 localhost smtpd[97588]: NOQUEUE: reject: RCPT from unknown[190.237.93.172]: 554 5.7.1 Service unavailable; Client host [190.237.93.172] blocked using zen.spamhaus.org; https://www.spamhaus.org/sbl/query/SBLCSS / https://www.spamhaus.org/query/ip/190.237.93.172; from= to= proto=ESMTP helo=<[190.237.93.172]>	2020-09-27 06:29:10
211.145.49.253	attackbotsspam	Sep 27 00:01:36 marvibiene sshd[23338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.145.49.253 Sep 27 00:01:38 marvibiene sshd[23338]: Failed password for invalid user toor from 211.145.49.253 port 49261 ssh2 Sep 27 00:13:07 marvibiene sshd[24301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.145.49.253	2020-09-27 06:18:16
50.233.148.74	attack	Port scan denied	2020-09-27 06:20:31
112.91.145.58	attackbotsspam	sshd jail - ssh hack attempt	2020-09-27 06:09:30
192.35.169.31	attackspam	TCP (SYN) 192.35.169.31:5853 -> port 22, len 44	2020-09-27 06:20:08
61.177.172.128	attack	2020-09-27T00:11:44+0200 Failed SSH Authentication/Brute Force Attack.(Server 2)	2020-09-27 06:12:25
52.137.119.99	attackspambots	Sep 27 00:24:23 vps639187 sshd\[23915\]: Invalid user 54.252.210.166 from 52.137.119.99 port 19144 Sep 27 00:24:23 vps639187 sshd\[23915\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.137.119.99 Sep 27 00:24:25 vps639187 sshd\[23915\]: Failed password for invalid user 54.252.210.166 from 52.137.119.99 port 19144 ssh2 ...	2020-09-27 06:41:51
180.182.220.133	attackspam	1601066312 - 09/25/2020 22:38:32 Host: 180.182.220.133/180.182.220.133 Port: 23 TCP Blocked ...	2020-09-27 06:22:56
104.211.245.131	attackspambots	SSH Invalid Login	2020-09-27 06:15:32
106.12.8.149	attackspambots	web-1 [ssh] SSH Attack	2020-09-27 06:09:53
51.144.130.90	attackspambots	SSH Brute Force	2020-09-27 06:40:26

Recently Reported IPs

150.255.4.207	105.112.120.10	152.4.135.155	124.88.113.25
165.124.190.106	123.191.130.87	123.160.173.172	123.145.11.119
123.144.20.191	121.57.229.29	121.57.228.255	121.57.227.249
121.57.225.159	119.39.47.161	117.14.113.141	116.252.0.95
115.53.115.179	113.128.105.67	113.128.104.236	112.66.99.211