JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

49.87.42.43

Recent Activity

Abuse Confidence Score

5% Caution

6 reports

6 reporters · latest 4 hours ago

ISP: CHINANET jiangsu province network
Usage Type: Fixed Line ISP
ASN: AS4134
Domain Name: chinatelecom.cn
Country: 🇨🇳 China
City: Nanjing, Jiangsu

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

6 from 6 distinct reporters

First reported

June 28th 2022

Most recent report

4 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 1

Most common categories Web App Attack 1 Brute-Force 1 Bad Web Bot 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-11-06 20:09:33 UTC · (4 hours ago)	(mod_security) mod_security (id:210831) triggered by 49.87.42.43 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:09:27.177100 2026] [security2:error] [pid 27687:tid 27687] [client 49.87.42.43:47631] ModSe ... show more (mod_security) mod_security (id:210831) triggered by 49.87.42.43 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 15:09:27.177100 2026] [security2:error] [pid 27687:tid 27687] [client 49.87.42.43:47631] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.bestcountryclubs.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.bestcountryclubs.com"] [uri "/"] [unique_id "au4z9xtqhv38Hp2kcDrNRAAAAA4"], referer: http://www.bestcountryclubs.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 Largnet SOC	2024-09-26 09:18:12 UTC · (2 years ago)	49.87.42.43 triggered Icarus honeypot on port 1433. Check us out on github.	Port Scan Hacking
🇩🇪 georgengelmann	2022-07-04 21:33:14 UTC · (4 years ago)	Jul 4 21:31:38 ryzen sshd[48221]: Failed password for root from 49.87.42.43 port 57148 ssh2 Jul 4 21:33:11 ryzen sshd[48234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 Jul 4 21:33:13 ryzen ... show more Jul 4 21:31:38 ryzen sshd[48221]: Failed password for root from 49.87.42.43 port 57148 ssh2 Jul 4 21:33:11 ryzen sshd[48234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 Jul 4 21:33:13 ryzen sshd[48234]: Failed password for invalid user zero from 49.87.42.43 port 44764 ssh2 ... show less	Brute-Force SSH
🇩🇪 Tha_14	2022-07-04 21:32:30 UTC · (4 years ago)	Jul 5 03:30:56 hosting sshd[2719426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 user=root Jul 5 03:30:59 hosting sshd[2719426]: Failed password for root from 49.87.42.43 port 43206 ssh2 Jul ... show more Jul 5 03:30:56 hosting sshd[2719426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 user=root Jul 5 03:30:59 hosting sshd[2719426]: Failed password for root from 49.87.42.43 port 43206 ssh2 Jul 5 03:32:29 hosting sshd[2719502]: Invalid user zero from 49.87.42.43 port 59056 show less	Brute-Force SSH
🇩🇪 www.blocklist.de	2022-06-28 21:21:01 UTC · (4 years ago)	Lines containing failures of 49.87.42.43 Jun 28 21:14:14 cumulus sshd[2328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 user=r.r Jun 28 21:14:16 cumulus sshd[2328]: Failed password for r.r fro ... show more Lines containing failures of 49.87.42.43 Jun 28 21:14:14 cumulus sshd[2328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 user=r.r Jun 28 21:14:16 cumulus sshd[2328]: Failed password for r.r from 49.87.42.43 port 42736 ssh2 Jun 28 21:14:18 cumulus sshd[2328]: Received disconnect from 49.87.42.43 port 42736:11: Bye Bye [preauth] Jun 28 21:14:18 cumulus sshd[2328]: Disconnected from authenticating user r.r 49.87.42.43 port 42736 [preauth] Jun 28 21:15:31 cumulus sshd[3089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.87.42.43 user=r.r Jun 28 21:15:33 cumulus sshd[3089]: Failed password for r.r from 49.87.42.43 port 57066 ssh2 Jun 28 21:15:34 cumulus sshd[3089]: Received disconnect from 49.87.42.43 port 57066:11: Bye Bye [preauth] Jun 28 21:15:34 cumulus sshd[3089]: Disconnected from authenticating user r.r 49.87.42.43 port 57066 [preauth] Jun 28 21:16:51 cumulus sshd[359........ ------------------------------ show less	FTP Brute-Force Hacking
🇺🇸 amit177	2022-06-28 21:16:57 UTC · (4 years ago)		Brute-Force SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇪 181.64.60.252

🇰🇷 175.199.7.55

🇺🇸 162.216.149.53

🇨🇳 125.124.226.217

🇺🇸 216.25.89.134

🇩🇪 151.243.11.169

🇨🇳 124.90.226.171

🇳🇱 109.160.32.180

🇭🇰 103.243.25.44

🇿🇦 102.133.162.110

🇺🇸 65.49.1.24

🇳🇱 45.74.28.2

🇰🇷 20.194.45.183

🇬🇧 216.213.159.234

🇩🇪 209.166.7.83

🇩🇪 207.154.250.192

🇨🇴 181.58.70.249

🇨🇱 181.43.214.228

🇵🇰 119.73.8.240

🇺🇸 45.192.40.91