JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

118.99.121.133

Recent Activity

Abuse Confidence Score

24% Elevated

17 reports

16 reporters · latest 6 hours ago

ISP: Biznet Networks
Usage Type: Fixed Line ISP
ASN: AS17451
Domain Name: biznetnetworks.com
Country: 🇮🇩 Indonesia
City: Probolinggo, East Java

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

17 from 16 distinct reporters

First reported

August 26th 2024

Most recent report

6 hours ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 2 🇩🇪 Germany 1 🇮🇩 Indonesia 1

Most common categories Bad Web Bot 3 DDoS Attack 1 Hacking 1 Email Spam 1

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 hermawan	2026-11-15 10:50:53 UTC · (6 hours ago)	[Sun Nov 15 17:50:52.069917 2026] [security2:error] [pid 861277:tid 140517471925952] [client 118.99.121.133:0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:^(?:json\\\\.\|\\\\x5c)?\|b[\\"'\\\\)\\\\[\\\\x5c](?:(?:(?:\\\\\|\\ ... show more [Sun Nov 15 17:50:52.069917 2026] [security2:error] [pid 861277:tid 140517471925952] [client 118.99.121.133:0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:^(?:json\\\\.\|\\\\x5c)?\|b[\\"'\\\\)\\\\[\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\x0b])?\\\\$[!#\\\$\\\\\\\\-0-9\\\\?@_a-\\\\{])?\\\\x5c?u[\\"'\\\$\\\\[\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\x0b])?\\\\$[!#\\\$\\\\\\\\-0-9\\\\?@_a-\\\\{])?\\\\x5c?s[\\"'\\\$\\\\[\\\\x5c](?:(?:(?:\\\\\|\\\\\|\|&&)[\\\\s\\\\x0b]*) ..." at ARGS_NAMES:id. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "3273"] [id "932350"] [msg "Remote Command Execution: Direct Unix Command Execution (No Arguments)"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: id found within ARGS_NAMES:id: id request_line = GET /index.php?option=com_tags&view=tag&id=4735 HTTP/1.1 Request URI RAW = /index.php?option=com_tags&view=ta ... show less	Email Spam Hacking
🇩🇪 nyuuzyou	2026-11-05 11:43:20 UTC · (1 week ago)	Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-11-05T11:43:20Z.	Bad Web Bot
🇺🇸 kosada.com	2026-10-26 18:02:45 UTC · (2 weeks ago)	Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=68&topics%5B2%5D=54&topics%5B3%5D=48&topics%5B4%5D=27 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/5 ... show more Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B1%5D=68&topics%5B2%5D=54&topics%5B3%5D=48&topics%5B4%5D=27 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36") show less	DDoS Attack Bad Web Bot
🇺🇸 鬼影233	2026-09-23 11:14:32 UTC · (1 month ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0	Bad Web Bot
🇺🇸 鬼影233	2026-08-31 00:04:45 UTC · (2 months ago)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36	Bad Web Bot
Anonymous	2026-01-28 04:04:47 UTC · (9 months ago)	Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp	Bad Web Bot Exploited Host
🇫🇷 botzung.fr	2024-08-27 01:08:18 UTC · (2 years ago)	Aug 27 03:07:36 botzung sshd[306430]: Failed password for root from 118.99.121.133 port 34284 ssh2 Aug 27 03:08:32 botzung sshd[306444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.121.133 user=root ... show more Aug 27 03:07:36 botzung sshd[306430]: Failed password for root from 118.99.121.133 port 34284 ssh2 Aug 27 03:08:32 botzung sshd[306444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.121.133 user=root Aug 27 03:08:33 botzung sshd[306444]: Failed password for root from 118.99.121.133 port 34740 ssh2 ... show less	Brute-Force SSH
Anonymous	2024-08-27 00:51:01 UTC · (2 years ago)	Malicious activity detected	Hacking Web App Attack
🇧🇷 diego	2024-08-27 00:30:22 UTC · (2 years ago)	Events: TCP SYN Discovery or Flooding, Seen 8 times in the last 10800 seconds	DDoS Attack
🇩🇪 Herrminator	2024-08-27 00:30:03 UTC · (2 years ago)	2024-08-27 02:06:03 ssh-honeypotd[7]: Failed password for test01 from 118.99.121.133 port 47914 ssh2 (target: 172.18.0.2:22, password: 123456) 2024-08-27 02:06:52 ssh-honeypotd[7]: Failed password for root from 118.99.121.133 port 48352 ssh2 (target: ... show more 2024-08-27 02:06:03 ssh-honeypotd[7]: Failed password for test01 from 118.99.121.133 port 47914 ssh2 (target: 172.18.0.2:22, password: 123456) 2024-08-27 02:06:52 ssh-honeypotd[7]: Failed password for root from 118.99.121.133 port 48352 ssh2 (target: 172.18.0.2:22, password: Abcd12345^) 2024-08-27 02:07:39 ssh-honeypotd[7]: Failed password for student6 from 118.99.121.133 port 48842 ssh2 (target: 172.18.0.2:22, password: student) 2024-08-27 02:08:28 ssh-honeypotd[7]: Failed password for root from 118.99.121.133 port 49384 ssh2 (target: 172.18.0.2:22, password: 1qazXSW@xsw2) 2024-08-27 02:09:14 ssh-honeypotd[7]: Failed password for root from 118.99.121.133 port 49894 ssh2 (target: 172.18.0.2:22, password: Huawei@123) 2024-08-27 02:10:01 ssh-honeypotd[7]: Failed password for root from 118.99.121.133 port 50326 ssh2 (target: 172.18.0.2:22, password: 8owmpiyddyo) 2024-08-27 02:10:45 ssh-honeypotd[7]: Failed password for root from 118.99.121.133 port 50816 ssh2 (target: 172.18.0.2:22, passw ... show less	Brute-Force SSH
🇩🇪 MrIPBreaker	2024-08-27 00:26:16 UTC · (2 years ago)	Aug 27 02:14:11 vmd80284 sshd[2884657]: Invalid user sand from 118.99.121.133 port 51158 Aug 27 02:15:47 vmd80284 sshd[2884901]: Invalid user setup from 118.99.121.133 port 51916 Aug 27 02:26:16 vmd80284 sshd[2886364]: Invalid user postgres from 118. ... show more Aug 27 02:14:11 vmd80284 sshd[2884657]: Invalid user sand from 118.99.121.133 port 51158 Aug 27 02:15:47 vmd80284 sshd[2884901]: Invalid user setup from 118.99.121.133 port 51916 Aug 27 02:26:16 vmd80284 sshd[2886364]: Invalid user postgres from 118.99.121.133 port 58022 ... show less	Brute-Force SSH
🇨🇿 lp	2024-08-27 00:20:13 UTC · (2 years ago)	SSH Brute force: 23 attempts were recorded from 118.99.121.133 2024-08-27T01:56:48+02:00 Connection closed by authenticating user root 118.99.121.133 port 35232 [preauth] 2024-08-27T01:57:29+02:00 Invalid user teste from 118.99.121.133 port 35554 202 ... show more SSH Brute force: 23 attempts were recorded from 118.99.121.133 2024-08-27T01:56:48+02:00 Connection closed by authenticating user root 118.99.121.133 port 35232 [preauth] 2024-08-27T01:57:29+02:00 Invalid user teste from 118.99.121.133 port 35554 2024-08-27T01:58:17+02:00 Invalid user kafka from 118.99.121.133 port 36020 2024-08-27T01:59:03+02:00 Connection closed by authenticating user root 118.99.121.133 port 36396 [preauth] 2024-08-27T01:59:50+02:00 Connection closed by authenticating user root 118.99.121.133 port 36784 [preauth] 2024-08-27T02:00:41+02:00 Connection closed by authenticating user root 118.99.121.133 port 37140 [preauth] 2024-08-27T02:01:28+02:00 Invalid user monitor from 118.99.121.133 port 37532 2024-08-27T02:02:16+02:00 Connection closed by authenticating user root 118.99.121.133 port 37974 [preauth] 2024-08-27T02:03:08+02:00 Connection closed by authenticating user show less	Brute-Force SSH
🇺🇸 bigscoots.com	2024-08-27 00:06:57 UTC · (2 years ago)	118.99.121.133 (ID/Indonesia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_DISTATTACK; Logs: Aug 26 19:06:34 19302 sshd[26183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ... show more 118.99.121.133 (ID/Indonesia/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_DISTATTACK; Logs: Aug 26 19:06:34 19302 sshd[26183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.99.121.133 user=root Aug 26 18:52:58 19302 sshd[25121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.153.191.181 user=root Aug 26 18:53:00 19302 sshd[25121]: Failed password for root from 61.153.191.181 port 42494 ssh2 Aug 26 19:06:36 19302 sshd[26183]: Failed password for root from 118.99.121.133 port 34114 ssh2 Aug 26 19:04:22 19302 sshd[26010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.153.191.181 user=root IP Addresses Blocked: show less	Brute-Force SSH
🇸🇪 webbfabriken	2024-08-27 00:01:53 UTC · (2 years ago)	spam or other hacking activities reported by webbfabriken security servers Attack reported by Webbfabiken Security API - WFSecAPI	Web Spam
🇺🇸 MPL	2024-08-27 00:00:20 UTC · (2 years ago)	tcp ports: 23,80 (3 or more attempts)	Port Scan

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇨🇳 218.78.186.58

🇵🇪 190.237.14.143

🇮🇷 151.235.221.203

🇨🇳 123.178.210.188

🇻🇳 118.70.182.193

🇧🇩 116.206.58.172

🇬🇧 78.153.140.235

🇺🇸 68.235.57.43

🇺🇸 209.90.232.26

🇸🇬 167.172.85.147

🇺🇸 162.216.150.183

🇺🇸 162.216.150.4

🇨🇳 113.24.225.209

🇰🇷 112.161.42.97

🇷🇴 92.118.39.50

🇨🇳 36.140.151.122

🇰🇷 14.54.135.28

🇧🇷 152.233.1.224

🇮🇳 139.59.8.142

🇨🇳 115.159.197.62