JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 42.228.216.218

42.228.216.218

Recent Activity

7 reports found in our database

40% ▲ ▲ ▲ Elevated

Abuse confidence score ?

ISP

China Unicom Henan province network

Usage Type

Fixed Line ISP

ASN

AS4837

Hostname(s)

hn.kd.ny.adsl

Domain Name

chinaunicom.cn

Country

🇨🇳 China

City

Zhengzhou, Henan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Top Reporter Countries (Last 60 Days)

Example preview

Report Categories (Last 60 Days)

Example preview

Reports Activity

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 42.228.216.218:

This IP address has been reported a total of 7 times from 7 distinct sources. 42.228.216.218 was first reported on March 27th 2021, and the most recent report was 2 days ago. In the last 60 days, the top reporter locations were: United States of America with 3 reports; Australia with 1 report; Germany with 1 report. The most common categories in these recent reports were: Port Scan 3 times; Hacking 3 times; Exploited Host 2 times; IoT Targeted 1 time; Brute-Force 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 RAP	2026-09-07 07:17:18 (2 days ago)	2026-09-07 07:17:18 UTC Unauthorized activity to TCP port 2323. Telnet	Port Scan
🇦🇺 Telemetry2U.com	2026-09-07 00:11:59 (3 days ago)	Unauthorized connection attempt to port 8080	Hacking
Anonymous	2026-09-06 01:11:34 (4 days ago)	denied traffic to a honeypot network. destination port 23.	Port Scan Hacking
🇺🇸 PhilSchuyler	2026-09-06 00:00:00 (4 days ago)	Malware payload server observed at TCP port 55889 path /i. It served MIPS MSB Mirai-family DDoS bina ... show more Malware payload server observed at TCP port 55889 path /i. It served MIPS MSB Mirai-family DDoS binary SHA-256 4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7 to multiple attacking bot nodes. The payload contains HTTP flood functionality. Captured through Cowrie honeypot sessions. show less	Exploited Host
🇺🇸 MPL	2026-09-05 23:59:09 (4 days ago)	tcp/8080 (3 or more attempts)	Port Scan
🇫🇮 Birdo	2026-09-05 19:15:39 (4 days ago)	[Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader ... show more [Honeypot Report] Attempted malware delivery following Telnet intrusion An automated malware loader brute-forced our emulated Telnet service, then obtained shell access and executed commands, and finally attempted to retrieve a remote payload. Credentials and request paths match DVR / IP camera (OEM default), GPON/ONT fibre terminal. Observed: 2026-09-05 16:45 to 2026-09-05 19:15 UTC \| 713 sessions \| 11,408 events \| Telnet (port 2323) Attack chain: 1. 713 credential attempts: super/PhrQjGzk, CUAdmin/CUAdmin, admin/v2mprt, admin/aquario, root/zte (+35 more pairs) 2. Shell access obtained; 11 distinct commands executed: start ; enable ; config terminal 3. Payload retrieval attempted from: http://39.65.202.109:51237/i, http://39.65.202.109:51237/bin.sh Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/09/42.228.216.218.md Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised. show less	Exploited Host Hacking IoT Targeted Brute-Force
🇩🇪 www.blocklist.de	2021-03-27 13:20:49 (5 years ago)	Mar 27 18:13:38 terminus sshd[17101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 eu ... show more Mar 27 18:13:38 terminus sshd[17101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.228.216.218 user=r.r Mar 27 18:13:40 terminus sshd[17101]: Failed password for r.r from 42.228.216.218 port 37836 ssh2 Mar 27 18:13:42 terminus sshd[17103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.228.216.218 user=r.r Mar 27 18:13:43 terminus sshd[17103]: Failed password for r.r from 42.228.216.218 port 37944 ssh2 Mar 27 18:13:45 terminus sshd[17106]: Invalid user ubnt from 42.228.216.218 port 37965 Mar 27 18:13:45 terminus sshd[17106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.228.216.218 ........ ----------------------------------------------- https://www.blocklist.de/en/view.html?ip=42.228.216.218 show less	FTP Brute-Force Hacking

Showing 1 to 7 of 7 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 176.31.100.132

🇺🇸 162.216.149.56

🇺🇸 147.185.132.193

🇨🇳 119.48.135.167

🇮🇩 110.138.66.197

🇳🇬 102.88.137.145

🇺🇸 100.49.117.77

🇺🇸 100.29.192.115

🇩🇪 45.3.44.67

🇸🇬 43.134.93.164

🇨🇳 1.24.16.67

🇲🇾 202.165.26.42

🇳🇱 193.176.31.243

🇳🇱 193.176.31.226

🇺🇸 159.223.185.253

🇨🇳 116.179.37.165

🇧🇩 103.133.206.11

🇺🇸 91.230.168.131

🇳🇱 81.19.216.108

🇳🇱 81.19.216.96