AbuseIPDB » 42.85.158.119

42.85.158.119 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 42%: ?

42%

ISP	Unicom Liaoning Province Network
Usage Type	Unknown
Domain Name	chinaunicom.com
Country	China
City	Chaoyang, Liaoning

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 42.85.158.119

Whois 42.85.158.119

IP Abuse Reports for 42.85.158.119:

This IP address has been reported a total of 15 times from 12 distinct sources. 42.85.158.119 was first reported on September 6th 2024, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Anonymous	2024-09-10 22:04:11 (3 weeks ago)	SSH Bruteforce Attempt (failed auth)	Brute-Force SSH
MPL	2024-09-10 21:46:08 (3 weeks ago)	tcp/443	Port Scan
MPL	2024-09-10 21:46:08 (3 weeks ago)	tcp/443	Port Scan
TimmiORG	2024-09-10 21:16:39 (3 weeks ago)	Unauthorized connection to SSH port 22	Port Scan SSH
geoffray-levasseur.org	2024-09-10 20:14:24 (3 weeks ago)	Sep 10 22:14:02 apo sshd[4498]: Invalid user sysadmin from 42.85.158.119 port 40074 Sep 10 22: ... show moreSep 10 22:14:02 apo sshd[4498]: Invalid user sysadmin from 42.85.158.119 port 40074 Sep 10 22:14:02 apo sshd[4498]: Failed password for invalid user sysadmin from 42.85.158.119 port 40074 ssh2 Sep 10 22:14:23 apo sshd[4893]: Invalid user kf from 42.85.158.119 port 43544 Sep 10 22:14:23 apo sshd[4893]: Failed password for invalid user kf from 42.85.158.119 port 43544 ssh2 ... show less	Brute-Force SSH
bigscoots.com	2024-09-10 19:25:32 (3 weeks ago)	(sshd) Failed SSH login from 42.85.158.119 (CN/China/-): 5 in the last 3600 secs; Ports: ; Directio ... show more(sshd) Failed SSH login from 42.85.158.119 (CN/China/-): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Sep 10 14:24:30 14930 sshd[8416]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.85.158.119 user=root Sep 10 14:24:32 14930 sshd[8416]: Failed password for root from 42.85.158.119 port 43932 ssh2 Sep 10 14:24:55 14930 sshd[8418]: Invalid user install from 42.85.158.119 port 47416 Sep 10 14:24:57 14930 sshd[8418]: Failed password for invalid user install from 42.85.158.119 port 47416 ssh2 Sep 10 14:25:20 14930 sshd[8484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.85.158.119 user=root show less	Brute-Force SSH
Admins@FBN	2024-09-10 18:55:07 (3 weeks ago)	FW-PortScan: Traffic Blocked srcport=22494 dstport=22	Port Scan Hacking SSH
Anonymous	2024-09-10 17:42:48 (3 weeks ago)		Brute-Force SSH
EGP Abuse Dept	2024-09-09 04:25:53 (3 weeks ago)	Port connection indicating compromised host	Port Scan Hacking Exploited Host
amit177	2024-09-06 20:28:48 (4 weeks ago)		Brute-Force SSH
TPI-Abuse	2024-09-06 18:02:25 (4 weeks ago)	(mod_security) mod_security (id:218420) triggered by 42.85.158.119 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:218420) triggered by 42.85.158.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 06 14:02:21.209542 2024] [security2:error] [pid 25109:tid 25109] [client 42.85.158.119:44136] [client 42.85.158.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.78:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.78"] [uri "/hello.world"] [unique_id "ZttDrW0FyGR6aM9l28gorgAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
MPL	2024-09-06 17:38:01 (4 weeks ago)	tcp/443 (2 or more attempts)	Port Scan
bigscoots.com	2024-09-06 17:19:32 (4 weeks ago)	(sshd) Failed SSH login from 42.85.158.119 (CN/China/-): 5 in the last 3600 secs; Ports: ; Directio ... show more(sshd) Failed SSH login from 42.85.158.119 (CN/China/-): 5 in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_SSHD; Logs: Sep 6 12:18:37 15725 sshd[27729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.85.158.119 user=root Sep 6 12:18:39 15725 sshd[27729]: Failed password for root from 42.85.158.119 port 48674 ssh2 Sep 6 12:19:01 15725 sshd[27731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.85.158.119 user=root Sep 6 12:19:03 15725 sshd[27731]: Failed password for root from 42.85.158.119 port 50988 ssh2 Sep 6 12:19:26 15725 sshd[27795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.85.158.119 user=root show less	Brute-Force SSH
newbie-red	2024-09-06 16:44:27 (4 weeks ago)	2024-09-06T18:44:09.179728+02:00 linux-syslog sshd[156805]: Connection closed by authenticating user ... show more2024-09-06T18:44:09.179728+02:00 linux-syslog sshd[156805]: Connection closed by authenticating user root 42.85.158.119 port 39368 [preauth] 2024-09-06T18:44:25.944601+02:00 linux-syslog sshd[156807]: Connection closed by authenticating user root 42.85.158.119 port 41518 [preauth] ... show less	Brute-Force SSH
Anonymous	2024-09-06 16:39:14 (4 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host