JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 197.251.249.121

197.251.249.121 was found in our database!

This IP was reported 47 times. Confidence of Abuse is 34%: ?

34%

ISP	Ghana Telecommunications Company Limited
Usage Type	Fixed Line ISP
ASN	AS29614
Domain Name	ghana.com
Country	🇬🇭 Ghana
City	Tema, Greater Accra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 197.251.249.121

Whois 197.251.249.121

IP Abuse Reports for 197.251.249.121:

This IP address has been reported a total of 47 times from 24 distinct sources. 197.251.249.121 was first reported on May 10th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 EGP Abuse Dept	2026-09-01 00:12:11 (2 hours ago)	Scanning for port/service exploits on tpc-test-001.mach3builders.nl	Port Scan Hacking
🇨🇦 Liborio	2026-08-15 11:15:00 (2 weeks ago)	wp_login	Brute-Force Web App Attack
🇸🇪 vaia.cloud	2026-08-06 10:25:01 (3 weeks ago)	crowdsecurity/http-admin-interface-probing	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-28 23:26:26 (1 month ago)	(mod_security) mod_security (id:225170) triggered by 197.251.249.121 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:225170) triggered by 197.251.249.121 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 19:26:18.878450 2026] [security2:error] [pid 2042006:tid 2042006] [client 197.251.249.121:39496] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|primacomm.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "primacomm.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "amk6mpjtg9-UfFQP3GoqMQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2026-07-21 11:08:42 (1 month ago)	tcp/23	Port Scan
🇫🇷 security.rdmc.fr	2026-07-21 06:02:44 (1 month ago)	Port Scan Attack proto:TCP src:58568 dst:23	Port Scan
🇳🇱 ByeByte API	2026-07-18 22:23:21 (1 month ago)	Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 23. Single burst at 2026- ... show more Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 23. Single burst at 2026-07-18 22:23 UTC. show less	Port Scan
🇳🇱 ByeByte API	2026-07-18 22:23:21 (1 month ago)	Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 23. Single burst at 2026- ... show more Port scan from this IP. Firewall dropped every packet. Targeted TCP ports: 23. Single burst at 2026-07-18 22:23 UTC. show less	Port Scan
🇳🇱 ByeByte API	2026-07-18 22:23:20 (1 month ago)	byebyte.space auth: TCP packet to port 23 (telnet) at 2026-07-18T22:23:20Z. Source port 52001. TCP f ... show more byebyte.space auth: TCP packet to port 23 (telnet) at 2026-07-18T22:23:20Z. Source port 52001. TCP flags: SYN. Packet: 60B, TTL 49, window 29200, IP id 53548. Single packet, dropped at firewall. p0f: OS Linux 2.2.x-3.x (generic match), 15 hops, link generic tunnel or VPN. show less	Port Scan
🇩🇪 Da_tschek	2026-07-14 18:57:31 (1 month ago)	Port scanning	Port Scan Hacking
🇫🇮 6kilowatti	2026-07-14 05:42:23 (1 month ago)	2026-07-14T08:42:22.959675+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2 ... show more 2026-07-14T08:42:22.959675+03:00 oh6ah kernel: [UFW BLOCK] IN=enp2s0 OUT= MAC=00:26:18:a8:d6:75:2e:2d:5e:71:aa:73:08:00 SRC=197.251.249.121 DST=192.168.0.102 LEN=60 TOS=0x18 PREC=0x20 TTL=45 ID=5618 DF PROTO=TCP SPT=45762 DPT=23 WINDOW=29200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇮🇳 Parth Maniar	2026-07-12 11:07:55 (1 month ago)	This IP address carried out 2 port scanning attempts on 11-07-2026. For more information or to repor ... show more This IP address carried out 2 port scanning attempts on 11-07-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter. show less	Port Scan SSH
🇪🇸 pipeline.es	2026-07-03 08:45:36 (1 month ago)	SMTP AUTH credential-stuffing/brute-force against a compromised mailbox account on our Postfix mail ... show more SMTP AUTH credential-stuffing/brute-force against a compromised mailbox account on our Postfix mail infrastructure (pipeline.es), used to relay spam via authenticated SMTP submission. show less	Brute-Force Email Spam Hacking
🇺🇸 mnsf	2026-06-21 19:05:48 (2 months ago)	Abuse Detected (1)	Brute-Force Web App Attack
🇬🇧 PeravixGroup	2026-06-04 03:56:20 (2 months ago)	Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: ME ... show more Honeypot detection: Telnet / IoT device brute-force or exploitation attempt on port 23. Severity: MEDIUM. Aaran.cloud show less	IoT Targeted Brute-Force

Showing 1 to 15 of 47 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 213.234.9.218

🇭🇰 199.45.155.89

192.168.176.197

🇨🇴 191.97.12.90

🇺🇸 172.67.152.91

172.29.193.21

🇩🇪 167.94.145.21

🇺🇸 147.185.132.82

🇨🇦 138.197.147.76

🇨🇳 110.16.41.193

🇿🇦 102.23.194.195

🇷🇴 92.118.39.231

🇬🇧 92.26.55.35

🇬🇧 82.11.249.32

🇨🇳 61.145.181.7

🇸🇬 43.156.232.25

10.109.194.134

🇷🇺 5.128.200.38

🇹🇭 203.150.107.244

🇭🇰 199.45.154.77