This IP address has been reported a total of
14
times from
8 distinct
sources.
196.251.121.160 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Canada
with 4
reports;
China
with 2
reports;
France
with 1
report.
Over the same time period, 196.251.121.160 has changed
country of origin 2 times.
The most common categories in these recent reports were:
Port Scan
9
times;
Brute-Force
3
times;
Hacking
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
TCP port scan against non-whitelisted ports; whitelist=80,443,23456,33333,33334,39090,18080,18443. R ...
show moreTCP port scan against non-whitelisted ports; whitelist=80,443,23456,33333,33334,39090,18080,18443. Recent hits: dst_port=1433 src_port=23406; dst_port=1433 src_port=47887; dst_port=1433 src_port=13775.
show less
TCP port scan against non-whitelisted ports on the same router: 6 SYN packet(s) logged by nftables w ...
show moreTCP port scan against non-whitelisted ports on the same router: 6 SYN packet(s) logged by nftables within a 300s window starting 2026-09-27 03:57 (dst ports: 1433; nftables rate-limits logging, actual scan may be larger). Evidence: dst_port=1433 src_port=60064; dst_port=1433 src_port=21924. Reported automatically from firewall/SSH logs collected by abuseipdb-reporter.
show less
Network port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received ...
show moreNetwork port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received no service (SYN, no reply) -- passive network sensor.
show less
Network port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received ...
show moreNetwork port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received no service (SYN, no reply) -- passive network sensor.
show less
Network port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received ...
show moreNetwork port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received no service (SYN, no reply) -- passive network sensor.
show less
Rule : MSSQLSERVER
Rule: MSSQLSERVER
Event: MSSQLSERVER
sa Reason: Password did not match that fo ...
show moreRule : MSSQLSERVER
Rule: MSSQLSERVER
Event: MSSQLSERVER
sa Reason: Password did not match that for the login provided. [CLIENT: 196.251.121.160]
show less
Network port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received ...
show moreNetwork port/address scan: probed 1 distinct port(s) across 64 host(s); 100% of connections received no service (SYN, no reply) -- passive network sensor.
show less
byebyte.space auth: TCP packet to port 1433 (MSSQL) at 2026-07-20T12:02:17Z. Source port 51076. TCP ...
show morebyebyte.space auth: TCP packet to port 1433 (MSSQL) at 2026-07-20T12:02:17Z. Source port 51076. TCP flags: SYN. Packet: 40B, TTL 59, window 64240, IP id 57392. Single packet, dropped at firewall. p0f: 5 hops.
show less
Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 1433. Single burst at 202 ...
show morePort scan from this IP. Firewall dropped every packet. Targeted TCP ports: 1433. Single burst at 2026-07-20 12:02 UTC.
show less
Network port/address scan: probed 1 distinct port(s) across 24 host(s); 100% of connections received ...
show moreNetwork port/address scan: probed 1 distinct port(s) across 24 host(s); 100% of connections received no service (SYN, no reply) -- passive network sensor.
show less
Port Scan
Showing 1 to
14
of 14 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
