AbuseIPDB » 60.191.52.254

Enter an IP Address, Domain Name, or Subnet:

e.g. 3.231.212.98, microsoft.com, or 5.188.10.0/24

60.191.52.254 was found in our database!

This IP was reported 1282 times. Confidence of Abuse is 100%: ?

100%

ISP	Qingdao Shi Heng Trading Co. Ltd.
Usage Type	Commercial
Domain Name	chinatelecom.com.cn
Country	China
City	Qingdao, Shandong

Spot an error? IP info including ISP, Usage Type, and Location provided by IP2Location.

Report 60.191.52.254

Whois 60.191.52.254

IP Abuse Reports for 60.191.52.254:

This IP address has been reported a total of 1282 times from 165 distinct sources. 60.191.52.254 was first reported on January 4th 2017, and the most recent report was 7 months ago.

Old Reports: The most recent abuse report for this IP address is from 7 months ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	Date	Comment	Categories
iNetWorker	04 May 2019	firewall-block, port(s): 1723/tcp	Port Scan
Anonymous	03 May 2019	Portscan or hack attempt detected by psad/fwsnort	Port Scan Hacking
stfw	03 May 2019	1723/tcp 1723/tcp 1723/tcp... [2019-03-03/05-03]37pkt,1pt.(tcp)	Port Scan
iNetWorker	03 May 2019	firewall-block, port(s): 1723/tcp	Port Scan
Anonymous	02 May 2019	port scan and connect, tcp 9999 (abyss)	Port Scan
kiwi.network	01 May 2019	Port scan: Attack repeated for 24 hours	Port Scan Hacking Exploited Host
stfw	30 Apr 2019	1723/tcp 1723/tcp 1723/tcp... [2019-03-01/04-30]36pkt,1pt.(tcp)	Port Scan
FireGuard Pro	30 Apr 2019	IP: 60.191.52.254 ASN: AS4134 No.31 Jin-rong Street Port: World Wide Web HTTP 80 ... show moreIP: 60.191.52.254 ASN: AS4134 No.31 Jin-rong Street Port: World Wide Web HTTP 80 Found in one or more Blacklists Date: 1/05/2019 12:46:55 AM UTC show less	Hacking Web App Attack
hermawan	30 Apr 2019	[Fri Apr 12 06:51:15.276860 2019] [:error] [pid 9895:tid 139840091838208] [client 60.191.52.254:3324 ... show more[Fri Apr 12 06:51:15.276860 2019] [:error] [pid 9895:tid 139840091838208] [client 60.191.52.254:33240] [client 60.191.52.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/owasp-modsecurity-crs-3.1.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "792"] [id "920350"] [msg "Host header is a numeric IP address"] [data "112.124.42.80:63435"] [severity "WARNING"] [ver "OWASP_CRS/3.1.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "112.124.42.80"] [uri "/"] [unique_id "XLA1Y1pczRGROYds4DfpagAAAAk"] ... show less	Hacking Web App Attack
Anonymous	30 Apr 2019	port scan and connect, tcp 3128 (squid-http)	Port Scan
FireballDWF	30 Apr 2019	400 BAD REQUEST	Web App Attack
Anonymous	29 Apr 2019	port scan and connect, tcp 80 (http)	Port Scan
IgorS.zg.hr	29 Apr 2019	Web application attack detected by fail2ban	Hacking Web App Attack
FireGuard Pro	29 Apr 2019	IP: 60.191.52.254 ASN: AS4134 No.31 Jin-rong Street Port: World Wide Web HTTP 80 ... show moreIP: 60.191.52.254 ASN: AS4134 No.31 Jin-rong Street Port: World Wide Web HTTP 80 Found in one or more Blacklists Date: 29/04/2019 11:45:50 PM UTC show less	Hacking Web App Attack
nonastymail.com	29 Apr 2019	60.191.52.254 - - \[30/Apr/2019:01:21:38 +0200\] \"HEAD http://112.124.42.80:63435/ HTTP/1.1\" 200 - ... show more60.191.52.254 - - \[30/Apr/2019:01:21:38 +0200\] \"HEAD http://112.124.42.80:63435/ HTTP/1.1\" 200 - \"-\" \"Mozilla/5.0 $Macintosh\; Intel Mac OS X 10_11_6$ AppleWebKit/537.36 $KHTML, like Gecko$ Chrome/53.0.2785.143 Safari/537.36\" show less	Open Proxy