JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 125.25.232.130

125.25.232.130 was found in our database!

This IP was reported 26 times. Confidence of Abuse is 90%: ?

90%

ISP	TOT Public Company Limited Bangkok
Usage Type	Fixed Line ISP
ASN	AS23969
Hostname(s)	node-19xe.pool-125-25.dynamic.nt-isp.net
Domain Name	totisp.net
Country	🇹🇭 Thailand
City	Uttaradit, Uttaradit

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 125.25.232.130

Whois 125.25.232.130

IP Abuse Reports for 125.25.232.130:

This IP address has been reported a total of 26 times from 22 distinct sources. 125.25.232.130 was first reported on February 16th 2023, and the most recent report was 36 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-22 15:04:17 (36 minutes ago)	IP & Port Scan.	SSH Port Scan Brute-Force
🇹🇼 kk_it_man	2026-07-22 09:00:09 (6 hours ago)	honey catch	Port Scan
🇺🇸 NetVexor	2026-07-22 07:23:50 (8 hours ago)	Attack source identified and submitted via NetVexor BGP Blackhole Network	Port Scan Hacking Brute-Force
🇦🇹 urnilxfgbez	2026-07-21 22:45:00 (16 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇺🇸 RAP	2026-07-21 18:02:47 (21 hours ago)	2026-07-21 18:02:47 UTC Unauthorized activity to TCP port 23. Telnet	Port Scan
🇩🇪 Tsumugi Kotobuki	2026-07-21 15:08:12 (1 day ago)	Port Scan on Honeypot \| Ports: 23/Telnet \| Proto: TCP(1) \| Flags: all SYN \| TTL: 46 \| Len: 60B \| Win ... show more Port Scan on Honeypot \| Ports: 23/Telnet \| Proto: TCP(1) \| Flags: all SYN \| TTL: 46 \| Len: 60B \| Win: 14380(1) \| rDNS: node-19xe.pool-125-25.dynamic.nt-isp.net \| F2B/ufw-honeypot@2026-07-21T15:08:12Z show less	Port Scan Hacking
🇺🇸 MPL	2026-07-21 13:42:52 (1 day ago)	tcp/23 (4 or more attempts)	Port Scan
🇩🇪 0xrh0d4m1n	2026-07-21 08:34:30 (1 day ago)	🛡️ HPN Threat Sighting by 0xrh0d4m1n · 🔹 Verdict MALICIOUS (High), score 75/100 · 📌 HPN-TELNET-BRUTE ... show more 🛡️ HPN Threat Sighting by 0xrh0d4m1n · 🔹 Verdict MALICIOUS (High), score 75/100 · 📌 HPN-TELNET-BRUTE (Telnet/IoT Brute-Force) · 🎯 66 events/24h on telnet · 🔑 1 unique secrets tried (root) · 📍 Origin Thailand · TOT Public Company Limited · 💻 Commands echo, /bin/busybox · 🦠 Malware Mirai · 🌐 Payload source 205.237.110.232 · 🔬 Behavior antivm, defense_evasion, discovery, linux · 🧠 MITRE ATT&CK T1110 (Brute Force) · 🛰️ Cross-Intel no public blocklist yet · ⏱️ 2026-07-21 08:34 UTC → 2026-07-21 08:34 UTC · 🕵️ HPN Autonomous Sensor Grid show less	IoT Targeted Brute-Force
🇫🇷 security.rdmc.fr	2026-07-21 07:53:35 (1 day ago)	Port Scan Attack proto:TCP src:56937 dst:23	Port Scan
🇩🇪 femboy.cat	2026-07-21 04:52:29 (1 day ago)	Port scan to tcp/23 from 125.25.232.130	Brute-Force
Anonymous	2026-07-21 04:52:07 (1 day ago)	Unauthorized connection to Telnet port 23	Port Scan
🇵🇱 mkey	2026-07-21 04:50:01 (1 day ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS ... show more Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=23 \| HITS=2 \| IPSET=ADD \| FIRST=2026-07-21 06:47:42 \| LAST=2026-07-21 06:47:43. Last seen 2026-07-21 06:47:43. show less	Port Scan
Anonymous	2026-07-21 03:30:10 (1 day ago)	denied traffic to a honeypot network. destination port 2323.	Port Scan Hacking
🇺🇸 xmission.com	2026-07-21 02:26:43 (1 day ago)	Blocked by UFW (TCP on 23) Source port: 40765 TTL: 52 Packet length: 60 TOS: 0x00 This report (for ... show more Blocked by UFW (TCP on 23) Source port: 40765 TTL: 52 Packet length: 60 TOS: 0x00 This report (for 125.25.232.130) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇺🇸 pcprincipal8752	2026-07-21 02:18:38 (1 day ago)	NULLPOT TELNET HONEYPOT · SESSION REPORT: 1) enable \| 2) system \| 3) shell \| 4) sh \| 5) linuxshell \| ... show more NULLPOT TELNET HONEYPOT · SESSION REPORT: 1) enable \| 2) system \| 3) shell \| 4) sh \| 5) linuxshell \| 6) ping ;sh \| 7) /bin/busybox \| 8) iptables -F \| 9) /bin/busybox echo > /tmp/.fxcat && sh /tmp/.fxcat && cd /tmp/ \| 10) /bin/busybox echo > /var/.fxcat && sh /var/.fxcat && cd /var/ \| 11) /bin/busybox echo > /var/run/.fxcat && sh /var/run/.fxcat && cd /var/run/ \| 12) /bin/busybox echo > /var/tmp/.fxcat && sh /var/tmp/.fxcat && cd /var/tmp/ \| 13) /bin/busybox echo > /dev/.fxcat && sh /dev/.fxcat && cd /dev/ \| 14) /bin/busybox echo > /dev/shm/.fxcat && sh /dev/shm/.fxcat && cd /dev/shm/ \| 15) /bin/busybox echo > /etc/.fxcat && sh /etc/.fxcat && cd /etc/ \| 16) /bin/busybox echo > /mnt/.fxcat && sh /mnt/.fxcat && cd /mnt/ \| 17) /bin/busybox echo > /usr/.fxcat && sh /usr/.fxcat && cd /usr/ \| 18) /bin/busybox echo > /boot/.fxcat && sh /boot/.fxcat && cd /boot/ \| 19) /bin/busybox echo > /home/.fxcat && sh /home/.fxcat && cd /home/ \| 20) for pid in /proc/[0-9]; do pid_num="${pid##/}"; if [ -r "$pid/maps" ]; then sus show less	Brute-Force

Showing 1 to 15 of 26 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇰 202.63.209.53

🇳🇱 45.148.10.141

🇺🇸 24.144.83.218

🇺🇸 190.92.179.233

🇺🇸 165.232.58.140

🇸🇦 141.179.45.188

🇺🇸 135.232.225.16

🇨🇳 115.192.168.219

🇺🇸 91.230.168.4

🇬🇪 81.16.240.242

🇭🇰 43.135.36.201

🇺🇸 20.65.193.55

🇺🇸 172.56.183.219

🇺🇸 154.6.129.197

🇨🇳 146.56.197.150

🇨🇳 125.39.93.73

🇸🇬 124.243.145.46

🇧🇩 103.191.162.35

🇳🇬 102.90.80.231

🇫🇷 85.217.140.28