IP address

Search at other sites:
.007121.40.213.105
Shodan(more info)
Passive DNS
Tags:
IP blacklists
AbuseIPDB
121.40.213.105 is listed on the AbuseIPDB blacklist.

Description: AbuseIPDB is a project managed by Marathon Studios Inc.<br>Lists IPs performing a malicious activity (DDoS, spam, phishing...)
Type of feed: primary (feed detail page)

Last checked at: 2026-08-27 04:00:00.592000
Was present on blacklist at: 2026-08-22 04:00, 2026-08-26 04:00, 2026-08-27 04:00
blocklist.de SSH
121.40.213.105 is listed on the blocklist.de SSH blacklist.

Description: Blocklist.de feed is a free and voluntary service provided<br>by a Fraud/Abuse-specialist. IPs performing SSH attacks.
Type of feed: primary (feed detail page)

Last checked at: 2026-08-27 22:05:05.302000
Was present on blacklist at: 2026-08-26 04:05, 2026-08-26 10:05, 2026-08-26 16:05, 2026-08-26 22:05, 2026-08-27 04:05, 2026-08-27 10:05, 2026-08-27 16:05, 2026-08-27 22:05

Threat categories

TLRoleCategoryDetails
43 src login protocol: ssh
port: 9384
41 src scan
38 dst malware_distribution
25 src —
Warden events (8)
2026-08-28
ReconScanning (node.4dc198): 1
2026-08-27
ReconScanning (node.368407): 1
2026-08-24
ReconScanning (node.4dc198): 1
2026-08-20
ReconScanning (node.368407): 1
2026-08-16
ReconScanning (node.368407): 1
2026-08-13
AnomalyTraffic (node.ce2b59): 1
ReconScanning (node.4dc198): 2
DShield reports (IP summary, reports)
2026-08-24
Number of reports: 14
Distinct targets: 13
2026-08-25
Number of reports: 14
Distinct targets: 13
2026-08-26
Number of reports: 14
Distinct targets: 6
Origin AS
AS37963 - CNNIC-ALIBABA-CN-NET-AP
BGP Prefix
121.40.0.0/15
geo
China, Hangzhou
🕑 Asia/Shanghai
hostname
(null)
Address block ('inetnum' or 'NetRange' in whois database)
121.40.0.0 - 121.43.255.255
last_activity
2026-08-28 05:26:45
last_warden_event
2026-08-28 05:26:45
rep
0.0065809315412534986
reserved_range
0
Shodan's InternetDB
Open ports: 11, 15, 25, 37, 70, 85, 104, 110, 111, 135, 143, 175, 427, 441, 444, 554, 886, 992, 993, 1177, 1364, 1604, 1800, 1962, 1976, 1979, 2054, 2065, 2067, 2126, 2154, 2201, 2332, 2345, 2404, 2443, 2551, 3021, 3050, 3052, 3083, 3113, 3142, 3146, 3162, 3197, 3306, 3388, 3550, 3551, 3552, 4063, 4095, 4120, 4148, 4157, 4165, 4244, 4321, 4333, 4430, 4440, 4499, 4506, 4899, 4933, 5007, 5009, 5022, 5130, 5226, 5233, 5246, 5271, 5273, 5432, 5569, 5595, 5858, 5913, 5984, 6000, 6002, 6060, 6070, 6666, 6667, 7000, 7070, 7272, 7415, 7434, 7634, 7654, 7774, 7778, 7801, 8044, 8068, 8075, 8120, 8134, 8136, 8144, 8145, 8146, 8170, 8199, 8241, 8291, 8315, 8333, 8405, 8444, 8545, 8553, 8575, 8686, 8788, 8825, 8845, 8846, 8852, 8872, 8882, 8883, 8989, 9034, 9042, 9066, 9133, 9162, 9182, 9214, 9221, 9300, 9306, 9418, 9758, 9909, 9999, 10002, 10029, 10044, 10049, 10134, 10209, 10398, 10554, 10943, 11075, 11084, 11211, 11288, 12084, 12130, 12153, 12156, 12170, 12182, 12196, 12250, 12264, 12304, 12309, 12325, 12345, 12346, 12403, 12415, 12422, 12440, 12463, 12464, 12467, 12491, 12496, 12530, 12560, 14005, 14265, 14344, 14404, 14687, 14978, 15038, 15042, 16027, 16028, 16064, 17498, 17779, 18036, 18053, 18063, 18100, 18488, 19091, 20070, 20200, 20256, 20547, 21247, 21248, 21283, 21319, 21325, 22380, 22556, 24510, 25001, 27589, 30000, 31650, 33297, 34779, 35466, 35554, 36023, 36505, 43484, 44304, 44350, 44400, 44818, 45555, 47348, 48018, 49692, 50000, 50007, 50085, 50103, 51000, 51003, 51235, 52200, 52931, 53482, 55296, 60129, 62237, 62660, 62929, 63210, 65000
Tags: honeypot
CPEs: cpe:/a:openbsd:openssh:8.2p1, cpe:/o:microsoft:windows, cpe:/a:cisco:ssh:3524665.35, cpe:/a:openbsd:openssh:8.6, cpe:/a:mysql:mysql, cpe:/a:apache:subversion, cpe:/a:openbsd:openssh:X.X, cpe:/o:cisco:ios, cpe:/a:realvnc:realvnc:::enterprise, cpe:/a:openbsd:openssh:6.6.1, cpe:/a:openbsd:openssh:8.0, cpe:/o:hp:hp-ux, cpe:/o:canonical:ubuntu_linux, cpe:/a:openbsd:openssh:7.4
ts_added
2026-08-13 19:56:39.927000
ts_last_update
2026-08-30 19:56:40.114000

Warden event timeline

DShield event timeline

Presence on blacklists