JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.212.241.131

125.212.241.131 was found in our database!

This IP was reported 199 times. Confidence of Abuse is 18%: ?

18%

This address is a Tor exit node. Neither the owner nor the provider are directly behind the offending action.

ISP	Viettel Group
Usage Type	Fixed Line ISP
ASN	AS38731
Hostname(s)	131.0-24.241.212.125.in-addr.arpa server.teetalk.vn
Domain Name	viettel.com.vn
Country	🇻🇳 Viet Nam
City	Ho Chi Minh City, Ho Chi Minh City (HCMC)

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.212.241.131

Whois 125.212.241.131

IP Abuse Reports for 125.212.241.131:

This IP address has been reported a total of 199 times from 108 distinct sources. 125.212.241.131 was first reported on December 20th 2021, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 ICS Labs	2026-06-09 19:42:38 (3 weeks ago)	ICS Labs identified 125.212.241.131 as a malicious indicator from threat intelligence.	DDoS Attack Hacking Brute-Force Exploited Host
🇩🇪 LRob	2026-05-27 15:45:11 (1 month ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
🇳🇱 Kotiacat_one	2026-05-23 13:39:00 (1 month ago)	2026-05-23T16:38:59.954366+03:00 kotiacat.nexus sshd-session[6847]: Invalid user admin from 125.212. ... show more 2026-05-23T16:38:59.954366+03:00 kotiacat.nexus sshd-session[6847]: Invalid user admin from 125.212.241.131 port 50198 ... show less	Brute-Force SSH
🇨🇳 ThreatBook.io	2026-05-13 01:40:43 (1 month ago)	ThreatBook Intelligence: tor_proxy,Zombie more details on https://threatbook.io/ip/125.212.241.131 2 ... show more ThreatBook Intelligence: tor_proxy,Zombie more details on https://threatbook.io/ip/125.212.241.131 2026-05-12 10:24:24 / show less	Web App Attack
Anonymous	2026-05-06 04:00:19 (1 month ago)	2026-05-05 19:00:08,924 fail2ban.actions [3625835]: NOTICE [tor] Ban 125.212.241.131 2026-05 ... show more 2026-05-05 19:00:08,924 fail2ban.actions [3625835]: NOTICE [tor] Ban 125.212.241.131 2026-05-05 22:00:06,183 fail2ban.actions [3625835]: NOTICE [tor] Ban 125.212.241.131 2026-05-06 01:00:05,199 fail2ban.actions [3625835]: NOTICE [tor] Ban 125.212.241.131 2026-05-06 04:00:11,518 fail2ban.actions [3625835]: NOTICE [tor] Ban 125.212.241.131 2026-05-06 07:00:18,961 fail2ban.actions [3625835]: NOTICE [tor] Ban 125.212.241.131 show less	Brute-Force
🇺🇸 TPI-Abuse	2026-04-26 19:59:40 (2 months ago)	(mod_security) mod_security (id:225170) triggered by 125.212.241.131 (131.0-24.241.212.125.in-addr.a ... show more (mod_security) mod_security (id:225170) triggered by 125.212.241.131 (131.0-24.241.212.125.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 15:59:34.022393 2026] [security2:error] [pid 10888:tid 10888] [client 125.212.241.131:59058] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|iee-usa.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iee-usa.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae5upp7rggRHikaNFX1NbAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-04-24 21:00:36 (2 months ago)	2026-04-24 12:00:06,940 fail2ban.actions [7718]: NOTICE [tor] Ban 125.212.241.131 2026-04-24 ... show more 2026-04-24 12:00:06,940 fail2ban.actions [7718]: NOTICE [tor] Ban 125.212.241.131 2026-04-24 15:00:06,886 fail2ban.actions [7718]: NOTICE [tor] Ban 125.212.241.131 2026-04-24 18:00:06,789 fail2ban.actions [7718]: NOTICE [tor] Ban 125.212.241.131 2026-04-24 21:00:17,726 fail2ban.actions [7718]: NOTICE [tor] Ban 125.212.241.131 2026-04-25 00:00:31,666 fail2ban.actions [7718]: NOTICE [tor] Ban 125.212.241.131 show less	Brute-Force
🇦🇺 oncord	2026-04-12 18:29:17 (2 months ago)	Form spam	Web Spam
🇩🇪 LRob	2026-04-08 03:30:06 (2 months ago)	Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk- ... show more Plesk panel login attempt with forbidden username (root/admin), blocked by Fail2Ban in custom-plesk-login jail show less	Brute-Force Web App Attack
Anonymous	2026-03-23 16:32:01 (3 months ago)	Failed login attempt detected by Fail2Ban in plesk-panel jail	Brute-Force
Anonymous	2026-03-17 19:00:48 (3 months ago)	2026-03-17 10:00:07,913 fail2ban.actions [3511917]: NOTICE [tor] Ban 125.212.241.131 2026-03 ... show more 2026-03-17 10:00:07,913 fail2ban.actions [3511917]: NOTICE [tor] Ban 125.212.241.131 2026-03-17 13:00:07,528 fail2ban.actions [3511917]: NOTICE [tor] Ban 125.212.241.131 2026-03-17 15:00:23,791 fail2ban.actions [3511917]: NOTICE [tor] Ban 125.212.241.131 2026-03-17 18:00:08,113 fail2ban.actions [3511917]: NOTICE [tor] Ban 125.212.241.131 2026-03-17 21:00:35,100 fail2ban.actions [3511917]: NOTICE [tor] Ban 125.212.241.131 show less	Brute-Force
🇩🇪 todix	2026-03-15 23:38:12 (3 months ago)	Web App Attack Exploid from 125.212.241.131	Web App Attack
🇩🇪 LRob	2026-03-10 02:02:29 (3 months ago)	Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail	Bad Web Bot Web App Attack
🇩🇪 MusicLibrary	2026-03-07 12:44:43 (3 months ago)	Attempted access to non existent wordpress urls	Bad Web Bot
🇺🇸 TPI-Abuse	2026-03-04 02:34:53 (3 months ago)	(mod_security) mod_security (id:225170) triggered by 125.212.241.131 (131.0-24.241.212.125.in-addr.a ... show more (mod_security) mod_security (id:225170) triggered by 125.212.241.131 (131.0-24.241.212.125.in-addr.arpa): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 21:34:43.970668 2026] [security2:error] [pid 31402:tid 31402] [client 125.212.241.131:44144] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|mosheimlib.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "mosheimlib.org"] [uri "/wp-json/wp/v2/users"] [unique_id "aaeaQ_rku3qv4RggmvO9GQAAABc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 199 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2a03:2880:10ff:58::

🇺🇸 2604:a880:400:d1:0:4:6c79:d001

🇫🇮 216.40.73.141

🇺🇸 161.35.3.45

🇺🇸 147.185.132.21

🇨🇳 115.231.78.11

🇬🇧 81.111.230.66

🇩🇪 46.225.82.4

🇬🇧 5.226.140.103

🇺🇸 192.252.215.125

🇧🇷 177.77.134.60

🇰🇷 175.127.95.141

🇩🇪 167.94.146.63

🇺🇸 162.216.149.228

🇭🇰 154.221.25.72

🇨🇳 101.70.158.186

🇮🇷 78.109.200.147

🇺🇸 46.253.131.121

🇳🇱 45.148.10.141

🇭🇰 45.142.154.106