IP address

Search at other sites:

--112.124.56.24

Shodan(more info)

Passive DNS

IP blacklists

DataPlane SIP query

112.124.56.24 is listed on the DataPlane SIP query blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds,<br>and measurement resource for operators, by operators. IP addresses that<br>has been seen initiating an unsolicited SIP OPTIONS query to a remote host.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-13 07:10:01.145000
Was present on blacklist at: 2025-12-06 11:10, 2025-12-06 15:10, 2025-12-06 19:10, 2025-12-06 23:10, 2025-12-07 03:10, 2025-12-07 07:10, 2025-12-07 11:10, 2025-12-07 15:10, 2025-12-07 19:10, 2025-12-07 23:10, 2025-12-08 03:10, 2025-12-08 07:10, 2025-12-08 11:10, 2025-12-08 15:10, 2025-12-08 19:10, 2025-12-08 23:10, 2025-12-09 03:10, 2025-12-09 07:10, 2025-12-09 15:10, 2025-12-09 19:10, 2025-12-09 23:10, 2025-12-10 03:10, 2025-12-10 07:10, 2025-12-10 15:10, 2025-12-10 19:10, 2025-12-11 03:10, 2025-12-11 07:10, 2025-12-11 11:10, 2025-12-11 15:10, 2025-12-11 19:10, 2025-12-11 23:10, 2025-12-12 03:10, 2025-12-12 07:10, 2025-12-12 11:10, 2025-12-12 15:10, 2025-12-12 19:10, 2025-12-12 23:10, 2025-12-13 03:10, 2025-12-13 07:10

Spamhaus XBL CBL

112.124.56.24 is listed on the Spamhaus XBL CBL blacklist.

Description: The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies, worms/viruses with built-in spam engines, and other types of trojan-horse exploits.
Type of feed: secondary (DNSBL) (feed detail page)

Last checked at: 2025-12-13 11:12:01.054000
Was present on blacklist at: 2025-12-13 11:12

DataPlane TELNET login

112.124.56.24 is listed on the DataPlane TELNET login blacklist.

Description: DataPlane.org is a community-powered Internet data, feeds,<br>and measurement resource for operators, by operators. IPs trying<br>an unsolicited login via TELNET password authentication.
Type of feed: primary (feed detail page)

Last checked at: 2025-12-16 11:10:03.222000
Was present on blacklist at: 2025-12-13 11:10, 2025-12-13 15:10, 2025-12-13 19:10, 2025-12-13 23:10, 2025-12-14 03:10, 2025-12-14 07:10, 2025-12-14 11:10, 2025-12-14 15:10, 2025-12-14 19:10, 2025-12-14 23:10, 2025-12-15 03:10, 2025-12-15 07:10, 2025-12-15 11:10, 2025-12-15 15:10, 2025-12-15 19:10, 2025-12-15 23:10, 2025-12-16 03:10, 2025-12-16 07:10, 2025-12-16 11:10

Origin AS

AS37963 - CNNIC-ALIBABA-CN-NET-AP

BGP Prefix

112.124.0.0/17

geo

China, Hangzhou

🕑 Asia/Shanghai

hostname

(null)

Address block ('inetnum' or 'NetRange' in whois database)

112.124.0.0 - 112.127.255.255

reserved_range

0

Shodan's InternetDB

Open ports: 2, 15, 17, 21, 23, 37, 49, 53, 101, 104, 106, 110, 113, 135, 175, 195, 199, 234, 400, 465, 502, 513, 548, 554, 636, 771, 782, 833, 992, 1023, 1099, 1119, 1153, 1200, 1370, 1387, 1414, 1446, 1458, 1494, 1500, 1521, 1599, 1604, 1605, 1723, 1800, 1926, 1956, 1970, 2002, 2031, 2049, 2063, 2065, 2067, 2081, 2103, 2111, 2154, 2181, 2222, 2382, 2453, 2455, 2552, 2602, 2628, 2761, 3001, 3016, 3062, 3066, 3072, 3073, 3076, 3108, 3115, 3121, 3157, 3167, 3268, 3270, 3306, 3337, 3389, 3407, 3524, 3540, 3780, 4063, 4150, 4157, 4282, 4321, 4500, 4506, 4700, 4786, 4999, 5001, 5006, 5007, 5010, 5201, 5222, 5243, 5269, 5321, 5443, 5544, 5591, 5858, 5984, 5986, 6000, 6070, 6081, 6264, 6379, 6482, 6588, 6667, 7001, 7018, 7022, 7071, 7218, 7443, 7548, 7634, 8007, 8009, 8025, 8083, 8089, 8094, 8101, 8133, 8139, 8164, 8187, 8200, 8237, 8243, 8251, 8280, 8291, 8333, 8405, 8408, 8440, 8441, 8505, 8545, 8554, 8575, 8578, 8588, 8601, 8643, 8728, 8765, 8832, 8834, 8838, 8844, 8870, 8880, 8901, 8943, 8969, 9000, 9001, 9027, 9042, 9063, 9067, 9072, 9091, 9094, 9100, 9120, 9148, 9149, 9151, 9158, 9177, 9312, 9400, 9458, 9529, 9600, 9606, 9633, 9710, 9761, 9797, 9898, 9993, 9999, 10000, 10001, 10023, 10048, 10065, 10909, 10943, 11210, 11211, 11288, 12127, 12131, 12163, 12218, 12255, 12332, 12338, 12345, 12347, 12368, 12388, 12395, 12396, 12404, 12405, 12409, 12410, 12434, 12442, 12458, 12479, 12486, 12503, 12507, 12532, 12540, 12546, 12569, 12584, 13579, 14265, 14330, 14400, 14880, 16019, 16024, 16036, 16045, 16047, 16080, 16086, 16311, 16993, 17082, 17776, 18008, 18010, 18017, 18043, 18061, 18069, 18083, 18245, 18765, 18888, 19000, 19022, 19080, 20070, 20440, 21231, 21238, 21240, 21278, 21313, 21328, 21379, 22222, 22556, 23023, 23184, 25001, 25007, 25010, 25082, 30013, 30017, 30050, 30121, 30468, 30892, 31337, 37777, 40471, 40892, 41800, 43221, 44309, 44410, 44818, 49210, 49688, 50000, 50443, 50997, 51007, 51235, 52010, 52931, 54138, 55000, 55475, 55554, 60443, 61613, 62443, 63210, 63260

Tags: proxy, honeypot

CPEs: cpe:/o:microsoft:qotd::::en, cpe:/a:openbsd:openssh:7.5, cpe:/a:openbsd:openssh:7.4, cpe:/a:openbsd:openssh:8.0, cpe:/a:eset:nod32_antivirus:99, cpe:/a:openbsd:openssh:6.6.1p1, cpe:/a:openbsd:openssh:8.6, cpe:/a:openbsd:openssh:6.6.1, cpe:/o:microsoft:windows, cpe:/a:openbsd:openssh:8.2p1, cpe:/a:apache:subversion, cpe:/a:realvnc:realvnc:::enterprise, cpe:/a:f5:nginx, cpe:/a:openbsd:openssh:6.2_hpn13v11, cpe:/a:openbsd:openssh:X.X, cpe:/o:freebsd:freebsd, cpe:/a:openbsd:openssh:7.6p1, cpe:/o:canonical:ubuntu_linux

ts_added

2025-12-06 11:11:56.512000

ts_last_update

2025-12-16 11:49:54.020000

Warden event timeline

DShield event timeline

Presence on blacklists