AS4816 China Telecom (Group)

Abuse reported against IP addresses announced by autonomous system 4816. If you run this network, the addresses below are a good place to start an abuse investigation.

In the last 30 days, 9 IP addresses in AS4816 China Telecom (Group) were reported for abuse, in 42 reports altogether. 1 of them (11%) has a confidence score of 75 or more and is on the default blocklist. The most common reasons were SSH, Malware Distribution and Command & Control. Most of them are in China.

9addresses reported, 30 days

1on the default blocklist (75+)

42reports against them

2 hsince the latest report

Most reported addresses

Address	Score	Reports	Categories	Last seen
🇨🇳103.39.213.200	76	13	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	2 h
🇨🇳211.161.235.13	67	11	DNS Poisoning Web Spam Port Scan Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack SSH Credential Stuffing Vulnerability Scan Malware Distribution Command & Control API Abuse Database Attack HTTP Flood Fake Accounts Telnet Abuse	11 h
🇨🇳103.236.66.210	58	5	DNS Poisoning FTP Brute-Force Phishing Open Proxy Web Spam Port Scan Hacking SQL Injection Brute-Force Bad Web Bot Exploited Host Web App Attack SSH Vulnerability Scan Malware Distribution Command & Control API Abuse HTTP Flood Fake Accounts Telnet Abuse	14 h
🇨🇳103.39.213.131	39	4	DNS Poisoning Web Spam Port Scan SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	8 h
🇨🇳103.191.243.96	39	4	DNS Poisoning Web Spam Port Scan SQL Injection Bad Web Bot Exploited Host SSH Vulnerability Scan Malware Distribution Command & Control API Abuse Fake Accounts Telnet Abuse	20 h
🇨🇳103.39.226.142	31	2	Web Spam Port Scan Hacking Bad Web Bot Vulnerability Scan	20 h
🇨🇳43.254.156.123	18	1	Brute-Force SSH Malware Distribution	10 h
🇨🇳103.39.213.250	18	1	Brute-Force SSH Malware Distribution	11 h
🇨🇳211.161.236.81	18	1	Web App Attack Command & Control	11 h

What they were reported for

Where they are

🇨🇳 China9

Block them

The blocklist holds every address with a confidence of 75 or more, in nine formats for firewalls, web servers and SIEMs. Download it with a free API key:

curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt"

See the integration guides for nginx, fail2ban, pfSense, MikroTik and more, or the API reference.

Figures cover the last 30 days and are refreshed hourly; last updated 43 minutes ago.