JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

217.211.120.138

Recent Activity

Abuse Confidence Score

43% Elevated

18 reports

12 reporters · latest 10 hours ago

ISP: Telia Network Services
Usage Type: Fixed Line ISP
ASN: AS3301
Hostname(s): 217-211-120-138-no2550.tbcn.telia.com
Domain Name: telia.net
Country: 🇸🇪 Sweden
City: Karlstad, Varmland

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

18 from 12 distinct reporters

First reported

September 18th 2026

Most recent report

10 hours ago

Last 60 days

Top reporter locations 🇮🇳 India 4 🇨🇦 Canada 3 🇺🇸 United States of America 3

Most common categories SSH 13 Brute-Force 12 Web App Attack 6 Port Scan 4 IoT Targeted 2

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇭🇺 jani.hu	2026-11-06 04:05:49 UTC · (10 hours ago)	Hit on SSH honeypot at 2026-11-06 04:05:49 from 217.211.120.138 as user support with password support	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-11-03 02:47:14 UTC · (3 days ago)	(mod_security) mod_security (id:225170) triggered by 217.211.120.138 (217-211-120-138-no2550.tbcn.telia.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 21:47:09.250576 2026] [security2:error] [pid 25468:tid ... show more (mod_security) mod_security (id:225170) triggered by 217.211.120.138 (217-211-120-138-no2550.tbcn.telia.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 21:47:09.250576 2026] [security2:error] [pid 25468:tid 25468] [client 217.211.120.138:50230] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.fixmyland.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.fixmyland.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aulLLcBSJ8YvDG1rZmBCgQAAABo"], referer: https://www.fixmyland.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 LSPCCU	2026-11-02 08:49:39 UTC · (4 days ago)	TSEC Honeypot Network report. Threat score: 64/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH, IoT Targeted. Honeypot: beelzebub. Context: 217.211.120.138 classified as botnet node participating in coordinated attack campaigns ... show more TSEC Honeypot Network report. Threat score: 64/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH, IoT Targeted. Honeypot: beelzebub. Context: 217.211.120.138 classified as botnet node participating in coordinated attack campaigns (high confidence). show less	Port Scan Hacking Brute-Force Web App Attack SSH IoT Targeted
🇩🇪 ropi	2026-11-02 05:45:20 UTC · (4 days ago)	2026-11-02T05:45:15.034984+00:00 ubuntu-4gb-nbg1-1 sshd[1875334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.211.120.138 2026-11-02T05:45:17.171356+00:00 ubuntu-4gb-nbg1-1 sshd[1875334]: Failed passwor ... show more 2026-11-02T05:45:15.034984+00:00 ubuntu-4gb-nbg1-1 sshd[1875334]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.211.120.138 2026-11-02T05:45:17.171356+00:00 ubuntu-4gb-nbg1-1 sshd[1875334]: Failed password for invalid user AdminGPON from 217.211.120.138 port 41142 ssh2 2026-11-02T05:45:19.134758+00:00 ubuntu-4gb-nbg1-1 sshd[1875334]: Connection closed by invalid user AdminGPON 217.211.120.138 port 41142 [preauth] ... show less	Brute-Force SSH
🇮🇳 Parth Maniar	2026-10-24 07:05:35 UTC · (1 week ago)	This IP address carried out 4 port scanning attempts on 23-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.	Port Scan SSH
🇮🇳 Parth Maniar	2026-10-24 05:56:53 UTC · (1 week ago)	This IP address carried out 1 SSH credential attack (attempts) on 23-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-10-15 14:33:07 UTC · (3 weeks ago)	(mod_security) mod_security (id:225170) triggered by 217.211.120.138 (217-211-120-138-no2550.tbcn.telia.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:33:02.962450 2026] [security2:error] [pid 20331:tid ... show more (mod_security) mod_security (id:225170) triggered by 217.211.120.138 (217-211-120-138-no2550.tbcn.telia.com): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:33:02.962450 2026] [security2:error] [pid 20331:tid 20337] [client 217.211.120.138:55222] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.reghay.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.reghay.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "atDkHvBMEeClzcUrOKzG_AAAAMI"], referer: https://www.reghay.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 rd1742	2026-10-06 09:24:14 UTC · (1 month ago)	2026-10-06 09:24:14,534 quad proftpd[2107024] 2a03:4000:3e:312:360a:466c:8ea1:45b9 (217-211-120-138-no2550.tbcn.telia.com[217.211.120.138]): USER root: no such user found from 217-211-120-138-no2550.tbcn.telia.com [217.211.120.138] to 2.56.97.107:22	Brute-Force Exploited Host SSH
🇮🇳 Parth Maniar	2026-10-04 07:56:04 UTC · (1 month ago)	This IP address carried out 4 port scanning attempts on 03-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.	Port Scan SSH
🇮🇳 Parth Maniar	2026-10-04 07:13:17 UTC · (1 month ago)	This IP address carried out 1 SSH credential attack (attempts) on 03-10-2026. For more information or to report interesting / incorrect findings, give me a shoutout @parthmaniar on Twitter.	Brute-Force SSH
🇨🇦 DRI	2026-09-30 19:59:52 UTC · (1 month ago)	Web attack/Malicious activity detected	Web App Attack
🇨🇦 DRI	2026-09-29 04:33:07 UTC · (1 month ago)	Web attack/Malicious activity detected	Web App Attack
🇵🇱 lns.bz	2026-09-27 14:41:04 UTC · (1 month ago)	SSH bruteforce [BY]	SSH
Anonymous	2026-09-27 10:02:54 UTC · (1 month ago)	SSH Honeypot detected multiple failed login attempts	Brute-Force SSH
🇰🇷 2048	2026-09-24 04:18:28 UTC · (1 month ago)	SSH credential brute-force observed by honeypot. \| Source IP: 217.211.120.138 \| Targeted device: OpenWrt router \| First seen: 24 Sep 2026 04:18:28 UTC \| Last seen: 24 Sep 2026 04:18:28 UTC \| Attempts: 1 \| Client: SSH-2.0-Go \| Sample credentials: root ... show more SSH credential brute-force observed by honeypot. \| Source IP: 217.211.120.138 \| Targeted device: OpenWrt router \| First seen: 24 Sep 2026 04:18:28 UTC \| Last seen: 24 Sep 2026 04:18:28 UTC \| Attempts: 1 \| Client: SSH-2.0-Go \| Sample credentials: root:root show less	Brute-Force SSH IoT Targeted

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇳🇱 2a01:4020:2:b:102::ad

🇹🇼 198.235.24.14

🇮🇩 182.8.182.164

🇮🇳 103.248.120.6

🇳🇱 93.123.109.80

🇫🇷 85.217.140.11

🇦🇿 37.114.176.89

🇳🇱 185.224.128.16

🇹🇼 165.154.14.170

🇫🇮 147.185.133.47

🇦🇺 124.168.12.183

🇮🇳 124.123.68.73

🇺🇦 91.234.26.194

🇫🇷 88.191.132.181

🇧🇷 45.176.224.139

🇹🇼 35.221.188.111

🇳🇱 34.13.140.156

🇮🇳 203.192.232.180

🇹🇳 197.11.166.206

🇻🇳 160.30.158.218