IP address

Warden events (1)

2025-12-06

IntrusionUserCompromise (node.cfb4f7): 1

DShield reports (IP summary, reports)

2025-12-13

Number of reports: 155

Distinct targets: 104

Origin AS

AS37963 - CNNIC-ALIBABA-CN-NET-AP

BGP Prefix

112.124.0.0/17

geo

China, Hangzhou

🕑 Asia/Shanghai

hostname

(null)

Address block ('inetnum' or 'NetRange' in whois database)

112.124.0.0 - 112.127.255.255

last_activity

2025-12-06 10:55:42

last_warden_event

2025-12-06 10:55:42

rep

0.009523809523809523

reserved_range

0

Shodan's InternetDB

Open ports: 13, 19, 21, 22, 43, 53, 102, 110, 111, 113, 121, 175, 179, 389, 440, 444, 449, 503, 541, 548, 789, 830, 853, 998, 1198, 1200, 1433, 1521, 1605, 1723, 1800, 1911, 1950, 1977, 2000, 2002, 2003, 2006, 2012, 2081, 2083, 2087, 2111, 2121, 2154, 2553, 2567, 2598, 2626, 2628, 2762, 3050, 3088, 3095, 3099, 3101, 3121, 3145, 3148, 3164, 3260, 3301, 3306, 3548, 3551, 4022, 4063, 4150, 4157, 4159, 4242, 4250, 4321, 4369, 4433, 4440, 4443, 4447, 4500, 4524, 4821, 4949, 4993, 5001, 5006, 5010, 5025, 5070, 5172, 5245, 5269, 5432, 5698, 5701, 5938, 5986, 5993, 6000, 6001, 6003, 6009, 6050, 6400, 6590, 6653, 6666, 6667, 6668, 6697, 6700, 7016, 7050, 7071, 7087, 7218, 7373, 7415, 7548, 8033, 8047, 8054, 8083, 8085, 8097, 8105, 8106, 8117, 8118, 8140, 8184, 8185, 8191, 8318, 8333, 8343, 8384, 8430, 8432, 8443, 8466, 8500, 8515, 8550, 8570, 8577, 8588, 8592, 8597, 8600, 8640, 8728, 8789, 8803, 8820, 8834, 8844, 8853, 8865, 8871, 8880, 8883, 9000, 9063, 9081, 9091, 9095, 9100, 9124, 9127, 9133, 9144, 9151, 9152, 9160, 9168, 9209, 9220, 9249, 9280, 9333, 9383, 9418, 9443, 9530, 9600, 9633, 9761, 9802, 9898, 9929, 9998, 9999, 10001, 10014, 10019, 10028, 10034, 10038, 10046, 10210, 10254, 10302, 10909, 11112, 11184, 12140, 12164, 12165, 12197, 12200, 12246, 12251, 12264, 12287, 12307, 12315, 12333, 12345, 12356, 12381, 12382, 12455, 12479, 12494, 12513, 12547, 12559, 12571, 12590, 12615, 14344, 15082, 15443, 16021, 16022, 16042, 16063, 16072, 16083, 16084, 16098, 16104, 16993, 17776, 18032, 18051, 18069, 18070, 18081, 18088, 18091, 18264, 19000, 19022, 20001, 20053, 20110, 20500, 20880, 21284, 21288, 21289, 21307, 21313, 21379, 23023, 25000, 25008, 25565, 30002, 31337, 35000, 35100, 37777, 41800, 43200, 44818, 45333, 48889, 49592, 49692, 50000, 50002, 50103, 50257, 50996, 51002, 51235, 52536, 55080, 55554, 57782, 60129, 61613, 61616, 62078, 63210, 63260

Tags: proxy, honeypot

CPEs: cpe:/o:cisco:ios, cpe:/a:openbsd:openssh:7.5, cpe:/a:vsftpd:vsftpd:1.2.2, cpe:/a:openbsd:openssh:7.4, cpe:/a:openbsd:openssh:8.0, cpe:/a:cisco:ssh:3524665.35, cpe:/a:openbsd:openssh:6.6.1, cpe:/a:apache:dubbo, cpe:/o:microsoft:windows, cpe:/a:openbsd:openssh, cpe:/a:openbsd:openssh:7.2p2, cpe:/a:openbsd:openssh:7.6p1, cpe:/a:openbsd:openssh:X.X, cpe:/a:openbsd:openssh:8.6, cpe:/o:canonical:ubuntu_linux

ts_added

2025-12-06 11:20:01.957000

ts_last_update

2025-12-16 11:20:11.415000

Warden event timeline

DShield event timeline