110.16.112.239
Recent Activity
This IP has received recent abuse reports, which causes the score to increase.
- ISP
- China Unicom InnerMongolia province network
- Usage Type
- Fixed Line ISP
- ASN
- AS4837
- Domain Name
- chinaunicom.cn
- Country
- 🇨🇳 China
- City
- Hohhot, Inner Mongolia
Abuse Reports
Total reports
10 from
10 distinct
reporters
First reported
Most recent report
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
| Reporter | IoA Timestamp (UTC) | Comment | Categories |
|---|---|---|---|
| 🇧🇷 ICS Labs |
ICS Labs threat intelligence (ICS Feeds): Exploited Host. Last observed 2026-11-09 UTC.
|
Exploited Host | |
| 🇩🇪 Jochen Pretli |
connection to honeypot
|
Email Spam Port Scan | |
| 🇫🇮 6kilowatti |
|
Port Scan | |
| Anonymous |
Blocked by UFW [5985/tcp] | SPT: 58901 | TTL: 239 | LEN: 40 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇫🇷 EvoX |
🛡️ Honeypot [bsts-tpot-sensor]: HTTP/1.1 request on 5985
POST /wsman
User-Agent: Python WinRM client
Accept: */*
Accept-Encoding: gzip, deflate; 5985 [1] TCP
|
Hacking Bad Web Bot | |
| 🇺🇸 xmission.com |
Blocked by UFW (TCP on 5985)
Source port: 43138
TTL: 242
Packet length: 40
TOS: 0x00
This report (for 110.16.112.239) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Port Scan | |
| 🇰🇷 ian ian |
Unsolicited TCP SYN to closed port(s) 5985 (1 attempt(s)) on a host that serves no such service; first seen 2026-11-06T03:25:38Z UTC, blocked by firewall.
|
Brute-Force Port Scan | |
| 🇫🇷 Kejult |
Honeypot Finding: active TCP application payload captured by Honeytrap; 5 payload-bearing connection/event(s), 1103 payload byte(s) total, maximum payload 221 byte(s). Target port(s): 5985.
|
Port Scan Hacking | |
| 🇦🇺 LiftUp Hosting |
Honeypot hit: HTTP/1.1 request on 5985
POST /wsman
User-Agent: Python WinRM client
Accept: */*
Accept-Encoding: gzip, deflate; 5985 [1] TCP
|
Hacking Bad Web Bot | |
| 🇯🇵 jsys |
Automated report (nfacl NetFlow analysis, 300s window): host sweep (253 distinct dst hosts)
|
Port Scan |
Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown