JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 128.1.120.167

128.1.120.167 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 52%: ?

52%

ISP	Zenlayer Inc
Usage Type	Data Center/Web Hosting/Transit
ASN	AS62610
Domain Name	zenlayer.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 128.1.120.167

Whois 128.1.120.167

IP Abuse Reports for 128.1.120.167:

This IP address has been reported a total of 19 times from 11 distinct sources. 128.1.120.167 was first reported on May 28th 2026, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 london2038.com	2026-07-10 04:52:16 (17 hours ago)	Connection atttempts against closed TCP ports Jul 10 03:00:36 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x0 ... show more Connection atttempts against closed TCP ports Jul 10 03:00:36 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=44082 DPT=443 WINDOW=0 RES=0x00 RST Jul 10 06:51:49 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=57560 DPT=443 WINDOW=0 RES=0x00 RST Jul 10 06:52:15 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=57560 DPT=443 WINDOW=0 RES=0x00 RST show less	Port Scan
🇩🇪 london2038.com	2026-07-09 04:47:15 (1 day ago)	Connection atttempts against closed TCP ports Jul 9 06:47:03 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x0 ... show more Connection atttempts against closed TCP ports Jul 9 06:47:03 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=43268 DPT=443 WINDOW=0 RES=0x00 RST Jul 9 06:47:04 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=43268 DPT=443 WINDOW=0 RES=0x00 RST Jul 9 06:47:14 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=43268 DPT=443 WINDOW=0 RES=0x00 RST show less	Port Scan
🇩🇪 london2038.com	2026-07-07 04:44:24 (3 days ago)	Connection atttempts against closed TCP ports Jul 7 06:44:23 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x0 ... show more Connection atttempts against closed TCP ports Jul 7 06:44:23 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=46710 DPT=443 WINDOW=0 RES=0x00 RST Jul 7 06:44:23 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=46710 DPT=443 WINDOW=0 RES=0x00 RST Jul 7 06:44:24 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=46710 DPT=443 WINDOW=0 RES=0x00 RST show less	Port Scan
🇩🇪 london2038.com	2026-07-03 05:37:51 (1 week ago)	Connection atttempts against closed TCP ports Jul 3 07:37:47 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x0 ... show more Connection atttempts against closed TCP ports Jul 3 07:37:47 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=59450 DPT=443 WINDOW=0 RES=0x00 RST Jul 3 07:37:48 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=59450 DPT=443 WINDOW=0 RES=0x00 RST Jul 3 07:37:50 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x00 TTL=52 ID=0 DF PROTO=TCP SPT=59450 DPT=443 WINDOW=0 RES=0x00 RST show less	Port Scan
🇩🇪 london2038.com	2026-07-02 14:14:00 (1 week ago)	Connection atttempts against closed TCP ports Jul 2 16:13:44 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x0 ... show more Connection atttempts against closed TCP ports Jul 2 16:13:44 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=32950 DPT=443 WINDOW=0 RES=0x00 RST Jul 2 16:13:47 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=32950 DPT=443 WINDOW=0 RES=0x00 RST Jul 2 16:13:54 BLOCK SRC=128.1.120.167 LEN=40 TOS=0x08 PREC=0x20 TTL=52 ID=0 DF PROTO=TCP SPT=32950 DPT=443 WINDOW=0 RES=0x00 RST show less	Port Scan
🇺🇸 Josh S.	2026-06-29 13:18:48 (1 week ago)	Blocked by UFW on Mailcow [443/tcp] Source port: 33562 TTL: 46 Packet length: 40 TOS: 0x00 If this ... show more Blocked by UFW on Mailcow [443/tcp] Source port: 33562 TTL: 46 Packet length: 40 TOS: 0x00 If this was a mistake contact me: [email protected] show less	Port Scan Web App Attack
🇫🇷 Sklurk	2026-06-27 05:16:42 (1 week ago)	Web App Attack	Web App Attack
Anonymous	2026-06-27 03:27:15 (1 week ago)	Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (E ... show more Attribution: mikhail-smirnov-79830323 (LinkedIn/profile ID) employed by Angara Technologies Group (Explicitly identified himself as enemy a week before attack began) \| Aggressive search filter manipulation / web scraper probe on port 443 \| URI: Heavy query parameter abuse: /brands/xclaim.html?___SID=92a2c6c7e12286ba98efbe8eab264224U&dir=asc&mode=grid&order=rating_summary \| UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 \| (Magento Site) show less	Hacking Bad Web Bot
🇺🇸 kosada.com	2026-06-25 19:34:08 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇸🇬 mypatricks	2026-06-23 19:18:11 (2 weeks ago)	128.1.120.167 \| Port: 10522 \| DNS: 128.1.120.167 2026-06-24T03:18:10+08:00 Europe/Berlin \| FETCH Spr ... show more 128.1.120.167 \| Port: 10522 \| DNS: 128.1.120.167 2026-06-24T03:18:10+08:00 Europe/Berlin \| FETCH Sproofing Activity Detetced. \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 HTTP/1.1 443 GET \| URL: /?1754864963&faccbffbca8a8c=653 \| Ref: - \| Country: DE/Germany/+01:00 IP City: Frankfurt am Main a105d6492dc0d34c-FRA/Frankfurt, Germany 1 hits/0 secs Robots 2 show less	Brute-Force Web App Attack Blog Spam Web Spam Exploited Host
🇪🇸 el-brujo	2026-06-23 01:58:40 (2 weeks ago)	Cloudflare WAF: Request Path: /Smileys/navidad/tongue.gif Request Query: Host: forum.elhacker.net u ... show more Cloudflare WAF: Request Path: /Smileys/navidad/tongue.gif Request Query: Host: forum.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Action: managed_challenge Source: firewallCustom ASN Description: Zenlayer Inc Country: DE Method: GET Timestamp: 2026-06-23T01:58:40Z ruleId: 770fb332273f47628e1c012f2ac4e3d3. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
🇪🇸 el-brujo	2026-06-22 00:54:53 (2 weeks ago)	Cloudflare WAF: Request Path: /Smileys/navidad/carita.gif Request Query: Host: forum.elhacker.net u ... show more Cloudflare WAF: Request Path: /Smileys/navidad/carita.gif Request Query: Host: forum.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Action: managed_challenge Source: firewallCustom ASN Description: Zenlayer Inc Country: DE Method: GET Timestamp: 2026-06-22T00:54:53Z ruleId: 770fb332273f47628e1c012f2ac4e3d3. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB). show less	Hacking SQL Injection Web App Attack
Anonymous	2026-06-21 04:48:19 (2 weeks ago)	Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ... show more Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp show less	Exploited Host Bad Web Bot
🇦🇺 MAGIC	2026-06-21 01:49:59 (2 weeks ago)	VM1 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇩🇪 Vegascosmetics	2026-06-20 22:14:34 (2 weeks ago)	(Kingcopy.org-AI-IDS-Report):IP automatically blocked after obfuscated redirect. Vegas Security	DDoS Attack Hacking Exploited Host

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 94.154.43.88

🇳🇱 91.92.40.7

🇨🇳 61.177.173.178

🇨🇳 60.162.168.44

🇸🇬 47.84.205.31

🇳🇱 45.148.10.152

🇺🇸 44.4.176.173

🇧🇷 191.7.150.147

🇩🇪 167.172.187.11

🇮🇹 128.116.149.70

🇪🇸 47.61.178.16

🇬🇧 45.82.76.111

🇺🇸 44.17.133.174

🇳🇱 212.56.48.20

🇧🇪 198.235.24.220

🇺🇸 184.168.21.211

🇺🇸 162.216.150.158

🇺🇸 159.26.102.44

🇦🇴 154.116.254.157

🇰🇷 101.36.114.252