JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

119.199.72.168

Activity Trending Down

Abuse Confidence Score

31% Elevated

16 reports

15 reporters · latest 1 week ago

ISP: Korea Telecom
Usage Type: Fixed Line ISP
ASN: AS4766
Domain Name: kt.com
Country: 🇰🇷 Korea (the Republic of)
City: Kyosai, Gyeongsangnam-do

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

16 from 15 distinct reporters

First reported

August 22nd 2026

Most recent report

1 week ago

Last 60 days

Top reporter locations 🇺🇸 United States of America 6 🇩🇪 Germany 2 🇳🇱 Netherlands 2

Most common categories Brute-Force 10 SSH 7 Hacking 3 Web App Attack 2 FTP Brute-Force 1

Old reports The most recent abuse report for this IP address is from 1 week ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 WinterGateIC	2026-10-30 16:31:08 UTC · (1 week ago)	brute-force authentication attack \| kill-chain stage 4 — Exploitation \| ATT&CK:T1110 \| via auth ssh:// \| src_port=22 sev=high conf=80% usage=Fixed_Line_ISP domain=kt.com geo=KR sensor=ssh_monitor active=10-30 16:31..16:31Z \| raw=SSH brute force — inv ... show more brute-force authentication attack \| kill-chain stage 4 — Exploitation \| ATT&CK:T1110 \| via auth ssh:// \| src_port=22 sev=high conf=80% usage=Fixed_Line_ISP domain=kt.com geo=KR sensor=ssh_monitor active=10-30 16:31..16:31Z \| raw=SSH brute force — invalid username probe (user=admin) \| NOVEL_PAYLOAD fp=eb2041e01d99 \| 2026-10-30 16:31:08 UTC report#109 [zero-day candidate, correlated with prior observed variants] show less	Brute-Force SSH Hacking
🇩🇪 NetWatch	2026-10-08 11:12:25 UTC · (1 month ago)	NetWatch sensor network: The IP 119.199.72.168 executed unauthorized SSH login attempts.	Brute-Force SSH
🇺🇸 Like Ma	2026-10-04 05:48:35 UTC · (1 month ago)	Oct 4 01:48:31 newage sshd[13329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.199.72.168 Oct 4 01:48:33 newage sshd[13329]: Failed password for invalid user admin from 119.199.72.168 port 41228 ssh2 ... show more Oct 4 01:48:31 newage sshd[13329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.199.72.168 Oct 4 01:48:33 newage sshd[13329]: Failed password for invalid user admin from 119.199.72.168 port 41228 ssh2 ... show less	Brute-Force SSH
🇺🇸 drewf.ink	2026-10-03 15:33:54 UTC · (1 month ago)	[15:33] Attempted SSH login with credentials support:s*****t	Brute-Force SSH
🇺🇸 anon333	2026-10-03 13:33:13 UTC · (1 month ago)	Hacker syslog review 1791034393	Hacking
🇹🇷 Threat.live	2026-10-01 07:55:02 UTC · (1 month ago)	Threat.live: Brute Force	Brute-Force
🇰🇷 2048	2026-09-27 16:22:02 UTC · (1 month ago)	SSH credential brute-force observed by honeypot. Source IP: 119.199.72.168 Targeted device: DVR First seen: 27 Sep 2026 16:22:02 UTC Last seen: 27 Sep 2026 16:22:02 UTC Attempts: 1 Client: SSH-2.0-Go Sample credentials: support:support	Brute-Force SSH IoT Targeted
🇳🇱 Kolo	2026-09-24 06:07:11 UTC · (1 month ago)	WhoTouchedMySSH honeypot SSH bruteforce from 119.199.72.168 (Kyosai, KR)	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-09-23 07:07:00 UTC · (1 month ago)	(mod_security) mod_security (id:225170) triggered by 119.199.72.168 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 03:06:52.562110 2026] [security2:error] [pid 31457:tid 31457] [client 119.199.72.168:50614] ... show more (mod_security) mod_security (id:225170) triggered by 119.199.72.168 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 03:06:52.562110 2026] [security2:error] [pid 31457:tid 31457] [client 119.199.72.168:50614] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|frogdesignmexico.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "frogdesignmexico.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "arN6jNvbjvR2qx9yFvfrRwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 stom	2026-09-22 10:58:41 UTC · (1 month ago)	2026-09-22T10:58:38.079883 socky.stom66.co.uk proftpd[39174]: session[39174] 0.0.0.0 (119.199.72.168[119.199.72.168]): USER admin: no such user found from 119.199.72.168 [119.199.72.168] to ::ffff:5.79.80.26:2222 ...	Brute-Force FTP Brute-Force
🇨🇳 SA19999	2026-09-19 04:14:08 UTC · (1 month ago)	Auto-report: brute_force \| sources=["peer-sync"] \| Fox honeypot cluster	Web App Attack
🇺🇸 bigscoots.com	2026-09-16 19:31:47 UTC · (1 month ago)	119.199.72.168 (KR/South Korea/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_DISTATTACK; Logs: Sep 16 14:26:24 15216 sshd[25958]: pam_unix(sshd:auth): authentication failure; logname= uid= ... show more 119.199.72.168 (KR/South Korea/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: ; Direction: 1; Trigger: LF_DISTATTACK; Logs: Sep 16 14:26:24 15216 sshd[25958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.199.72.168 user=root Sep 16 14:26:25 15216 sshd[25958]: Failed password for root from 119.199.72.168 port 37490 ssh2 Sep 16 14:17:56 15216 sshd[23858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.220.217.73 user=root Sep 16 14:17:57 15216 sshd[23858]: Failed password for root from 24.220.217.73 port 40503 ssh2 Sep 16 14:31:24 15216 sshd[27052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.127.149.144 user=root IP Addresses Blocked: show less	Brute-Force SSH
🇺🇸 anon333	2026-09-14 22:33:16 UTC · (1 month ago)	Hacker syslog review 1789425196	Hacking
🇺🇸 Neosmith20	2026-09-07 15:35:32 UTC · (2 months ago)	Knock-Knock honeypot brute-force: SSH (1 total hits)	Brute-Force SSH
🇮🇹 VHosting	2026-08-28 19:15:04 UTC · (2 months ago)	Detected mail brute force attack from different servers	Brute-Force

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇰🇪 197.232.32.187

🇮🇷 185.147.42.41

🇧🇷 177.10.164.250

🇧🇷 177.10.160.250

🇺🇸 129.121.140.56

🇺🇸 64.23.240.87

🇯🇵 43.133.193.86

🇳🇱 213.209.159.241

🇲🇾 210.187.180.12

🇺🇸 201.79.17.184

🇫🇷 91.231.89.133

🇺🇸 24.234.85.196

🇨🇳 211.145.71.32

🇺🇸 201.79.18.7

🇳🇵 182.93.95.214

🇺🇸 168.144.59.222

🇵🇹 144.64.176.147

🇺🇸 143.198.52.252

🇺🇸 104.223.18.237

🇩🇪 88.130.221.69