JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

203.25.221.167

Recent Activity

Abuse confidence score ?

100% Critical

351 reports

111 reporters · latest 1 day ago

ISP	CHINANET Guangdong province network
Usage Type	Data Center/Web Hosting/Transit
ASN	AS139220
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Chengdu, Sichuan

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 203.25.221.167

This IP address has been reported a total of 351 times from 111 distinct sources. 203.25.221.167 was first reported on February 27th 2025, and the most recent report was 1 day ago. In the last 60 days, the top reporter locations were: United States of America with 55 reports; Germany with 25 reports; France with 11 reports. The most common categories in these recent reports were: Port Scan 95 times; Brute-Force 34 times; Hacking 33 times; SQL Injection 5 times; Exploited Host 3 times; Other 6 times.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TheAntiBotter	2026-09-07 13:44:20 (2 weeks ago)	propolis: 203.25.221.167 - 4 event(s) across 1 category since 2026-08-30T06:37:44.974137+00:00, curr ... show more propolis: 203.25.221.167 - 4 event(s) across 1 category since 2026-08-30T06:37:44.974137+00:00, current score 89.9 show less	Hacking
🇺🇸 TheAntiBotter	2026-09-07 13:44:20 (2 weeks ago)	propolis: 203.25.221.167 - 4 event(s) across 1 category since 2026-08-30T06:37:44.974137+00:00, curr ... show more propolis: 203.25.221.167 - 4 event(s) across 1 category since 2026-08-30T06:37:44.974137+00:00, current score 5.6 show less	Hacking
🇫🇷 zulzeen	2026-09-06 04:24:56 (2 weeks ago)	[incypit-web] Blocked by SysWarden Firewall [GEO] (Database/Cache Attack)	Hacking Brute-Force
🇩🇪 xavier-momain.eu	2026-09-05 12:59:45 (2 weeks ago)	CrowdSec: xavier/nftables-scan-any-port \| Port: multiple \| Attempts: 3 \| First: 2026-09-05 12:59:08 ... show more CrowdSec: xavier/nftables-scan-any-port \| Port: multiple \| Attempts: 3 \| First: 2026-09-05 12:59:08 +0000 UTC \| Last: 2026-09-05 12:59:08 +0000 UTC show less	Port Scan
🇫🇮 iamxorum	2026-09-05 07:54:50 (2 weeks ago)	Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-09-05T07:54:50.26 ... show more Port scan / reconnaissance probe on closed infrastructure service ports. Log: 2026-09-05T07:54:50.260056+00:00 XRM-01 kernel: [511575.982970] [TRAP:HONEYPORT] IN=eth0 OUT= MAC=REDACTED SRC=203.25.221.167 DST=REDACTED LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=44888 PROTO=TCP SPT=55962 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇧🇷 diego	2026-09-05 07:29:11 (2 weeks ago)	[rede-44-49] 09/05/2026-04:29:11.521470, 203.25.221.167, Protocol: 6, ET SCAN Suspicious inbound to ... show more [rede-44-49] 09/05/2026-04:29:11.521470, 203.25.221.167, Protocol: 6, ET SCAN Suspicious inbound to MSSQL port 1433 show less	Hacking
🇧🇷 diego	2026-09-05 06:18:32 (2 weeks ago)	[rede-44-49] 09/05/2026-03:18:32.254022, 203.25.221.167, Protocol: 6, ET SCAN Suspicious inbound to ... show more [rede-44-49] 09/05/2026-03:18:32.254022, 203.25.221.167, Protocol: 6, ET SCAN Suspicious inbound to MSSQL port 1433 show less	Hacking
🇺🇸 Cyber Crusader	2026-09-04 04:47:38 (3 weeks ago)	Hundreds of Attempts (at least) to Connect to and Access Firewall Ports	Port Scan Hacking Brute-Force
🇵🇱 bart@	2026-09-03 23:15:09 (3 weeks ago)	Automated scan detection against redacted protected targets. Hits=1; port 1433 proto 6 detection hon ... show more Automated scan detection against redacted protected targets. Hits=1; port 1433 proto 6 detection honeypot_tcp show less	Port Scan
🇩🇪 iNetWorker	2026-09-03 12:20:32 (3 weeks ago)	firewall-block, port(s): 1433/tcp	Port Scan
🇩🇪 banankicks	2026-09-03 05:13:10 (3 weeks ago)	Unauthorized connection attempt detected from IP address 203.25.221.167 to port 1433 (banankicks-ser ... show more Unauthorized connection attempt detected from IP address 203.25.221.167 to port 1433 (banankicks-server) [a] show less	Brute-Force Exploited Host
🇫🇷 sthoyer.de	2026-09-02 05:48:21 (3 weeks ago)	Sep 2 07:48:19 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f ... show more Sep 2 07:48:19 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=203.25.221.167 DST=173.212.223.67 LEN=40 TOS=0x00 PREC=0x00 TTL=238 ID=50779 PROTO=TCP SPT=45944 DPT=1433 WINDOW=1024 RES=0x00 SYN URGP=0 ... show less	Port Scan
Anonymous	2026-09-02 05:45:13 (3 weeks ago)	RdpGuard detected brute-force attempt on MS-SQL	Brute-Force
🇵🇱 sefinek.net	2026-09-02 02:13:13 (3 weeks ago)	Honeypot hit: MSSQL traffic (on 1433) with username sa and empty password Reported by: https://githu ... show more Honeypot hit: MSSQL traffic (on 1433) with username sa and empty password Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Brute-Force
🇮🇪 Coolnagour	2026-09-01 03:21:18 (3 weeks ago)	funnypot MSSQL honeypot, port 1433: connect MSSQL connection from 203.25.221.167:53572	Hacking Brute-Force

Showing 31 to 45 of 351 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.248

🇹🇼 198.235.24.60

🇬🇧 193.163.125.254

🇻🇳 171.254.93.44

🇬🇧 147.90.216.10

🇮🇳 103.179.111.84

🇮🇩 103.178.89.243

🇮🇳 103.173.112.10

🇱🇻 91.105.112.214

🇬🇧 193.163.125.219

🇺🇿 185.213.230.141

🇨🇳 182.116.113.85

🇺🇸 110.172.137.252

🇻🇳 103.172.236.241

🇻🇳 103.172.236.15

🇮🇩 103.172.20.218

🇫🇷 85.217.140.45

🇹🇷 78.173.11.161

🇺🇸 64.62.197.77

🇫🇷 51.178.27.107