JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.120.157.98

125.120.157.98 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 73%: ?

73%

ISP	CHINANET-ZJ Hangzhou node network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	hz.zj.cn
Country	🇨🇳 China
City	Hangzhou, Zhejiang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.120.157.98

Whois 125.120.157.98

IP Abuse Reports for 125.120.157.98:

This IP address has been reported a total of 23 times from 16 distinct sources. 125.120.157.98 was first reported on May 12th 2022, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 RAP	2026-07-16 19:44:59 (1 week ago)	2026-07-16 19:44:59 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇳🇱 BIV	2026-07-16 16:35:32 (1 week ago)	Honeypot multi-source hit. Sources: dshield:cowrie,dshield:fw. Ports: 2223,23. Automated tiered (T-P ... show more Honeypot multi-source hit. Sources: dshield:cowrie,dshield:fw. Ports: 2223,23. Automated tiered (T-Pot+DShield). show less	Port Scan Hacking Brute-Force SSH
Anonymous	2026-07-16 15:44:35 (1 week ago)	Port Scanner	Port Scan
Anonymous	2026-07-16 14:04:29 (1 week ago)	IP & Port Scan.	SSH Port Scan Brute-Force
🇩🇪 Admins@FBN	2026-07-16 08:42:53 (1 week ago)	FW-PortScan: Traffic Blocked srcport=52097 dstport=23	Port Scan
Anonymous	2026-07-16 05:23:10 (1 week ago)	Blocked by firewall on hugin [2323/tcp] \| Rule: UFW \| SPT: 52439 \| TTL: 51 \| LEN: 60 \| TOS: 0x00 • R ... show more Blocked by firewall on hugin [2323/tcp] \| Rule: UFW \| SPT: 52439 \| TTL: 51 \| LEN: 60 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan IoT Targeted
🇺🇸 RAP	2026-07-16 00:02:33 (1 week ago)	2026-07-16 00:02:33 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇫🇷 Hiigara	2026-07-15 15:31:09 (1 week ago)	connection attempt : 125.120.157.98 on port : tcp/2323 (Alt Telnet)	Port Scan
🇫🇷 security.rdmc.fr	2026-07-15 13:15:48 (1 week ago)	Port Scan Attack proto:TCP src:33814 dst:23	Port Scan
🇩🇪 Admins@FBN	2026-07-15 00:28:04 (1 week ago)	FW-PortScan: Traffic Blocked srcport=50574 dstport=23	Port Scan
🇦🇹 urnilxfgbez	2026-07-14 22:45:00 (1 week ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 NetVexor	2026-07-14 17:07:08 (1 week ago)	Attack source identified and submitted via NetVexor BGP Blackhole Network	Port Scan Hacking Brute-Force
🇺🇸 pcprincipal8752	2026-07-14 10:21:36 (1 week ago)	NULLPOT TELNET HONEYPOT · SESSION REPORT: 1) enable \| 2) system \| 3) shell \| 4) sh \| 5) linuxshell \| ... show more NULLPOT TELNET HONEYPOT · SESSION REPORT: 1) enable \| 2) system \| 3) shell \| 4) sh \| 5) linuxshell \| 6) ping ;sh \| 7) /bin/busybox \| 8) iptables -F \| 9) /bin/busybox echo > /tmp/.fxcat && sh /tmp/.fxcat && cd /tmp/ \| 10) /bin/busybox echo > /var/.fxcat && sh /var/.fxcat && cd /var/ \| 11) /bin/busybox echo > /var/run/.fxcat && sh /var/run/.fxcat && cd /var/run/ \| 12) /bin/busybox echo > /var/tmp/.fxcat && sh /var/tmp/.fxcat && cd /var/tmp/ \| 13) /bin/busybox echo > /dev/.fxcat && sh /dev/.fxcat && cd /dev/ \| 14) /bin/busybox echo > /dev/shm/.fxcat && sh /dev/shm/.fxcat && cd /dev/shm/ \| 15) /bin/busybox echo > /etc/.fxcat && sh /etc/.fxcat && cd /etc/ \| 16) /bin/busybox echo > /mnt/.fxcat && sh /mnt/.fxcat && cd /mnt/ \| 17) /bin/busybox echo > /usr/.fxcat && sh /usr/.fxcat && cd /usr/ \| 18) /bin/busybox echo > /boot/.fxcat && sh /boot/.fxcat && cd /boot/ \| 19) /bin/busybox echo > /home/.fxcat && sh /home/.fxcat && cd /home/ \| 20) for pid in /proc/[0-9]; do pid_num="${pid##/}"; if [ -r "$pid/maps" ]; then sus show less	Brute-Force
Anonymous	2026-07-14 08:50:52 (1 week ago)	Attempted to write/download suspicious payload 'wget.sh' over SSH/SFTP. Indication of malware delive ... show more Attempted to write/download suspicious payload 'wget.sh' over SSH/SFTP. Indication of malware delivery. show less	Hacking SSH
🇫🇷 security.rdmc.fr	2026-07-14 03:34:30 (1 week ago)	Port Scan Attack proto:TCP src:37175 dst:23	Port Scan

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.153.86.250

🇸🇪 4.223.77.241

🇰🇷 220.92.179.226

🇳🇱 192.253.248.93

🇲🇾 183.171.49.152

🇧🇷 179.125.154.188

🇺🇸 172.90.128.97

🇬🇧 121.91.85.235

🇻🇳 116.118.4.222

🇫🇮 95.216.1.167

🇳🇱 91.92.47.117

🇷🇺 45.195.221.26

🇺🇸 198.23.239.107

🇲🇿 197.218.49.228

🇧🇷 189.37.68.105

🇬🇧 188.166.170.179

🇰🇷 183.107.219.58

🇮🇳 182.66.213.59

🇰🇷 175.45.204.121

🇺🇸 172.232.181.29