JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

121.40.45.125

Recent Activity

Abuse Confidence Score

100% Critical

284 reports

91 reporters · latest 2 hours ago

ISP: Aliyun Computing Co., LTD
Usage Type: Data Center/Web Hosting/Transit
ASN: AS37963
Domain Name: alibabacloud.com
Country: 🇨🇳 China
City: Hangzhou, Zhejiang

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

284 from 91 distinct reporters

First reported

March 27th 2025

Most recent report

2 hours ago

Last 60 days

Top reporter locations 🇹🇷 Turkey 24 🇺🇸 United States of America 17 🇩🇪 Germany 11

Most common categories Port Scan 44 Hacking 27 Web App Attack 27 Brute-Force 14 SSH 6

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 /dev/null	2026-11-10 00:02:44 UTC · (2 hours ago)	RouterOS: Portscanner detected.	Port Scan Brute-Force
🇺🇸 schematics.cc	2026-11-09 02:17:00 UTC · (1 day ago)	Blocked by on honeypot2 [27917/tcp] \| SPT: 50575 \| TTL: 239 \| LEN: 40 \| TOS: 0x00 • Reported by: abuse.terraforge.fun	Port Scan
Anonymous	2026-11-09 00:38:23 UTC · (1 day ago)	fail2ban:mail3:14,18	Port Scan Brute-Force
🇩🇪 evvsk	2026-11-08 03:19:01 UTC · (1 day ago)	UFW blocked port scan: 3 attempts against ports 28325, 23062, 9783	Port Scan
🇹🇷 neron	2026-11-04 22:04:08 UTC · (5 days ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇫🇷 Petre 21_ip	2026-11-04 14:38:55 UTC · (5 days ago)	2026-11-04T15:38:53.187963+01:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=121.40.45.125 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=50476 PROTO=TCP SPT=43132 DPT=39312 WINDOW=1024 RES=0x ... show more 2026-11-04T15:38:53.187963+01:00 vmi2775508 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:50:56:5c:a7:cf:c0:69:11:b3:85:db:08:00 SRC=121.40.45.125 DST=155.133.26.57 LEN=40 TOS=0x00 PREC=0x00 TTL=236 ID=50476 PROTO=TCP SPT=43132 DPT=39312 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇹🇷 neron	2026-11-03 22:04:08 UTC · (6 days ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇩🇪 HoneyPot-FrPri	2026-11-03 07:39:41 UTC · (6 days ago)	1793691581 - 11/03/2026 08:39:41 Host: 121.40.45.125/121.40.45.125 Port: 2000 TCP Blocked ...	Port Scan
🇨🇳 鹏鹏	2026-11-03 02:28:51 UTC · (1 week ago)	monitor: on VM-0-7-ubuntu \| port: 3306 \| ttl: 244 script: github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇱🇻 radix	2026-11-03 00:14:00 UTC · (1 week ago)	Web application exploit / backdoor attempt detected.	Hacking Brute-Force
🇹🇷 neron	2026-11-02 22:04:08 UTC · (1 week ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-11-01 22:04:08 UTC · (1 week ago)	CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 Nova Reed	2026-11-01 04:02:08 UTC · (1 week ago)	Nov 1 12:01:28 racknerd-df72780 kernel: [9936972.591077] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:e8:95:3e:20:d8:0b:13:e1:41:08:00 SRC=121.40.45.125 DST=67.215.241.238 LEN=40 TOS=0x00 PREC=0x00 TTL=233 ID=21757 PROTO=TCP SPT=45688 DPT=40066 WINDOW=1024 ... show more Nov 1 12:01:28 racknerd-df72780 kernel: [9936972.591077] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:e8:95:3e:20:d8:0b:13:e1:41:08:00 SRC=121.40.45.125 DST=67.215.241.238 LEN=40 TOS=0x00 PREC=0x00 TTL=233 ID=21757 PROTO=TCP SPT=45688 DPT=40066 WINDOW=1024 RES=0x00 SYN URGP=0 Nov 1 12:01:49 racknerd-df72780 kernel: [9936992.896019] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:e8:95:3e:20:d8:0b:13:e1:41:08:00 SRC=121.40.45.125 DST=67.215.241.238 LEN=40 TOS=0x00 PREC=0x00 TTL=233 ID=4517 PROTO=TCP SPT=45688 DPT=30719 WINDOW=1024 RES=0x00 SYN URGP=0 Nov 1 12:02:07 racknerd-df72780 kernel: [9937011.216535] [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3c:e8:95:3e:20:d8:0b:13:e1:41:08:00 SRC=121.40.45.125 DST=67.215.241.238 LEN=40 TOS=0x00 PREC=0x00 TTL=233 ID=31851 PROTO=TCP SPT=45688 DPT=31407 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less	Brute-Force SSH
🇫🇷 arteagasoft	2026-11-01 00:32:34 UTC · (1 week ago)	2026-10-31T18:31:54.267518-06:00 2ce336a8e656 dovecot: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A00018C:SSL routines::version too low (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=121. ... show more 2026-10-31T18:31:54.267518-06:00 2ce336a8e656 dovecot: imap-login: Login aborted: Connection closed: SSL_accept() failed: error:0A00018C:SSL routines::version too low (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=121.40.45.125, lip=192.168.30.250, TLS handshaking: SSL_accept() failed: error:0A00018C:SSL routines::version too low, session=<ysugJyxf/JB5KC19> 2026-10-31T18:32:01.326603-06:00 2ce336a8e656 dovecot: imap-login: Login aborted: Connection closed (no auth attempts in 7 secs) (no_auth_attempts): user=<>, rip=121.40.45.125, lip=192.168.30.250, TLS, session=<JFoCKCxfoJN5KC19> 2026-10-31T18:32:24.621391-06:00 2ce336a8e656 dovecot: imap-login: Login aborted: Connection closed (no auth attempts in 0 secs) (no_auth_attempts): user=<>, rip=121.40.45.125, lip=192.168.30.250, TLS, session=<1ybEKSxfyKJ5KC19> ... show less	Brute-Force
🇺🇸 Axel	2026-10-31 23:15:24 UTC · (1 week ago)	Atom Honypot: 69 connections to login:telnet (tcp/23), telnet (tcp/23), login:telnet (tcp/2323), telnet (tcp/2323), vnc (tcp/5900), admin-panel (tcp/8081) and more observed by 1 honeypot sensor between 2026-10-31 23:14 UTC and 2026-10-31 23:15 UTC. I ... show more Atom Honypot: 69 connections to login:telnet (tcp/23), telnet (tcp/23), login:telnet (tcp/2323), telnet (tcp/2323), vnc (tcp/5900), admin-panel (tcp/8081) and more observed by 1 honeypot sensor between 2026-10-31 23:14 UTC and 2026-10-31 23:15 UTC. Includes 11 authentication attempts against decoy login services. show less	Port Scan Brute-Force

Showing 1 to 15 of 284 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇺🇸 216.25.90.57

🇬🇧 195.96.139.16

🇫🇮 178.20.210.152

🇳🇱 176.65.148.51

🇺🇸 172.252.56.232

🇨🇭 146.70.134.158

🇳🇱 109.160.32.133

🇷🇴 92.118.39.14

🇫🇮 89.125.113.3

🇷🇺 80.246.81.142

🇦🇿 37.61.127.13

🇵🇱 2400:cb00:923:1000:344a:bb4a:ab4a:798d

🇳🇱 213.209.159.242

🇺🇸 209.73.139.14

🇺🇸 162.216.149.129

🇺🇸 157.245.84.64

🇫🇮 104.245.240.26

🇮🇩 103.79.247.62

🇳🇱 86.38.187.191

🇧🇬 78.128.112.74