JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.133.191.189

125.133.191.189 was found in our database!

This IP was reported 39 times. Confidence of Abuse is 100%: ?

100%

ISP	Korea Telecom
Usage Type	Fixed Line ISP
ASN	AS4766
Domain Name	kt.com
Country	🇰🇷 Korea (the Republic of)
City	Pocheon-si, Gyeonggi-do

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.133.191.189

Whois 125.133.191.189

IP Abuse Reports for 125.133.191.189:

This IP address has been reported a total of 39 times from 34 distinct sources. 125.133.191.189 was first reported on July 14th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-15 06:00:00 (1 week ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇦🇹 urnilxfgbez	2026-07-14 22:45:00 (1 week ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇧🇷 diego	2026-07-14 07:04:48 (1 week ago)	[rede-168-134] (sshd) Failed SSH login from 125.133.191.189 (KR/South Korea/-): 5 in the last 3600 s ... show more [rede-168-134] (sshd) Failed SSH login from 125.133.191.189 (KR/South Korea/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Jul 14 04:03:32 sshd[2970]: Invalid user [USERNAME] from 125.133.191.189 port 60508 Jul 14 04:03:34 sshd[2970]: Failed password for invalid user [USERNAME] from 125.133.191.189 port 60508 ssh2 Jul 14 04:04:09 sshd[2988]: Invalid user [USERNAME] from 125.133.191.189 port 33880 Jul 14 04:04:12 sshd[2988]: Failed password for invalid user [USERNAME] from 125.133.191.189 port 33880 ssh2 Jul 14 04:04:47 sshd[3008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhos show less	Port Scan
🇺🇸 TPI-Abuse	2026-07-14 07:02:56 (1 week ago)	(mod_security) mod_security (id:218420) triggered by 125.133.191.189 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:218420) triggered by 125.133.191.189 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 03:02:51.191291 2026] [security2:error] [pid 27599:tid 27599] [client 125.133.191.189:50616] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.151.22:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.151.22"] [uri "/hello.world"] [unique_id "alXfG0HvgisH7R_fro71EQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇮 vereinshosting	2026-07-14 06:41:54 (1 week ago)	Invalid user admin from 125.133.191.189 port 43862	Brute-Force SSH
🇺🇸 ras07	2026-07-14 06:00:13 (1 week ago)	Brute force SSH login attempts.	Brute-Force SSH
🇳🇱 majo-it.nl	2026-07-14 05:53:46 (1 week ago)	Jul 14 05:53:43 fail2ban sshd[3878317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ... show more Jul 14 05:53:43 fail2ban sshd[3878317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.133.191.189 Jul 14 05:53:45 fail2ban sshd[3878317]: Failed password for invalid user admin from 125.133.191.189 port 43858 ssh2 ... show less	Brute-Force SSH
🇹🇷 Threat.live	2026-07-14 05:25:04 (1 week ago)	Suspicious Connection Attempts	Brute-Force
🇮🇹 alph44	2026-07-14 05:18:56 (1 week ago)	SSH brute force attack detected: 5 failed attempts	Brute-Force
🇧🇷 maviei	2026-07-14 05:07:02 (1 week ago)	CrowdSec local detection on srv1349699: http-cve-2021-41773. Blocked. AS4766 (KR), 1 events.	Hacking Web App Attack
🇺🇸 NeverBehave	2026-07-14 04:44:37 (1 week ago)	[fail2ban] service sshd jail	Brute-Force SSH
🇩🇪 jjjjj	2026-07-14 04:32:56 (1 week ago)	ssh fail2ban: 2026-07-14 06:31:03 +02:00 Invalid user admin, port=40918 2026-07-14 06:31:03 +02:00 a ... show more ssh fail2ban: 2026-07-14 06:31:03 +02:00 Invalid user admin, port=40918 2026-07-14 06:31:03 +02:00 auth fail: user unspecified 2026-07-14 06:31:05 +02:00 wrong password: user=admin, port=40918 2026-07-14 06:31:05 +02:00 conn closed by invalid user admin, port=40918 [preauth] 2026-07-14 06:32:54 +02:00 Invalid user orangepi, port=35134 2026-07-14 06:32:54 +02:00 auth fail: user unspecified 2026-07-14 06:32:56 +02:00 wrong password: user=orangepi, port=35134 (automated) show less	Brute-Force SSH
🇺🇸 Carltonfsck	2026-07-14 04:21:40 (1 week ago)	Jul 14 04:19:55 ssh sshd-session[5390]: Invalid user admin from 125.133.191.189 port 37274 Jul 14 04 ... show more Jul 14 04:19:55 ssh sshd-session[5390]: Invalid user admin from 125.133.191.189 port 37274 Jul 14 04:19:55 ssh sshd-session[5390]: Connection closed by invalid user admin 125.133.191.189 port 37274 [preauth] Jul 14 04:21:38 ssh sshd-session[5396]: Invalid user orangepi from 125.133.191.189 port 54006 ... show less	Brute-Force SSH
🇺🇸 yzfdude1	2026-07-14 04:12:08 (1 week ago)	Jul 13 22:12:04 b146-46 sshd[383900]: Invalid user orangepi from 125.133.191.189 port 51882 Jul 13 2 ... show more Jul 13 22:12:04 b146-46 sshd[383900]: Invalid user orangepi from 125.133.191.189 port 51882 Jul 13 22:12:04 b146-46 sshd[383900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.133.191.189 Jul 13 22:12:07 b146-46 sshd[383900]: Failed password for invalid user orangepi from 125.133.191.189 port 51882 ssh2 ... show less	Brute-Force SSH
🇱🇹 Selckie	2026-07-14 04:06:29 (1 week ago)	fail2ban: SSH Brute-Force	SSH Brute-Force

Showing 1 to 15 of 39 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 117.62.22.127

🇨🇳 118.121.202.149

🇻🇳 116.99.169.172

🇳🇱 91.92.40.27

🇿🇦 45.222.2.213

🇲🇺 41.173.43.34

🇨🇳 39.107.136.130

🇬🇧 35.203.211.88

🇹🇹 200.1.109.122

🇩🇴 190.103.183.18

🇺🇸 169.197.85.173

🇳🇱 91.92.47.123

🇺🇸 159.89.133.65

🇭🇰 150.5.169.176

🇸🇪 122.8.95.89

🇨🇳 116.172.201.78

🇰🇷 112.216.129.27

🇱🇺 64.89.160.39

🇰🇷 43.155.134.4

🇺🇾 186.53.186.93