JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 222.117.25.117

222.117.25.117 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 47%: ?

47%

ISP	Korea Telecom
Usage Type	Fixed Line ISP
ASN	AS4766
Domain Name	kt.com
Country	🇰🇷 Korea (the Republic of)
City	Ansan-si, Gyeonggi-do

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 222.117.25.117

Whois 222.117.25.117

IP Abuse Reports for 222.117.25.117:

This IP address has been reported a total of 24 times from 22 distinct sources. 222.117.25.117 was first reported on June 26th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Like Ma	2026-10-07 12:11:17 (1 week ago)	Oct 7 08:11:13 newage sshd[7267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid= ... show more Oct 7 08:11:13 newage sshd[7267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.117.25.117 Oct 7 08:11:15 newage sshd[7267]: Failed password for invalid user telecomadmin from 222.117.25.117 port 40624 ssh2 ... show less	Brute-Force SSH
🇫🇷 900cm	2026-10-07 02:30:30 (1 week ago)	Oct 7 04:30:30 raspberrypi sshd[2381]: Failed none for admin from 222.117.25.117 port 51592 ssh2 .. ... show more Oct 7 04:30:30 raspberrypi sshd[2381]: Failed none for admin from 222.117.25.117 port 51592 ssh2 ... show less	Port Scan Brute-Force SSH
🇩🇪 NetWatch	2026-09-28 15:00:31 (2 weeks ago)	NetWatch sensor network: The IP 222.117.25.117 executed unauthorized SSH login attempts.	Brute-Force SSH
🇮🇩 sockominfo	2026-09-28 14:00:53 (2 weeks ago)	Active Response: IP 222.117.25.117 Blocked via Firewall Drop. Threat Score: 3.8/10 (LOW). Confidence ... show more Active Response: IP 222.117.25.117 Blocked via Firewall Drop. Threat Score: 3.8/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 40%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Fresh. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇮🇩 sockominfo	2026-09-28 13:00:09 (2 weeks ago)	Active Response: IP 222.117.25.117 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Re ... show more Active Response: IP 222.117.25.117 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT show less	Hacking Web App Attack
🇨🇳 SA19999	2026-09-25 16:04:08 (3 weeks ago)	Auto-report: brute_force \| sources=["peer-sync"] \| Fox honeypot cluster	Web App Attack
🇺🇸 bigscoots.com	2026-09-20 10:06:13 (3 weeks ago)	222.117.25.117 (KR/South Korea/-), 5 distributed sshd attacks on account [admin] in the last 3600 se ... show more 222.117.25.117 (KR/South Korea/-), 5 distributed sshd attacks on account [admin] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Sep 20 05:06:01 15216 sshd[19185]: Invalid user admin from 222.117.25.117 port 47018 Sep 20 05:01:53 15216 sshd[18281]: Invalid user admin from 111.70.21.51 port 46393 Sep 20 05:01:57 15216 sshd[18281]: Failed password for invalid user admin from 111.70.21.51 port 46393 ssh2 Sep 20 04:58:04 15216 sshd[17593]: Invalid user admin from 83.255.211.115 port 46406 Sep 20 04:58:06 15216 sshd[17593]: Failed password for invalid user admin from 83.255.211.115 port 46406 ssh2 IP Addresses Blocked: show less	Brute-Force SSH
🇦🇺 dyln	2026-09-18 11:17:12 (4 weeks ago)	Dyls honeypot brute-force: SSH (1 total hits)	Brute-Force SSH
🇰🇷 2048	2026-09-18 02:30:57 (4 weeks ago)	SSH credential brute-force observed by honeypot. Source IP: 222.117.25.117 Targeted device: Ubuntu s ... show more SSH credential brute-force observed by honeypot. Source IP: 222.117.25.117 Targeted device: Ubuntu server First seen: 18 Sep 2026 02:30:57 UTC Last seen: 18 Sep 2026 02:30:57 UTC Attempts: 1 Client: SSH-2.0-Go Sample credentials: root:root show less	Brute-Force SSH
🇳🇱 stom	2026-09-17 17:09:24 (4 weeks ago)	2026-09-17T17:09:21.863667 socky.stom66.co.uk proftpd[178294]: session[178294] 0.0.0.0 (222.117.25.1 ... show more 2026-09-17T17:09:21.863667 socky.stom66.co.uk proftpd[178294]: session[178294] 0.0.0.0 (222.117.25.117[222.117.25.117]): USER telecomadmin: no such user found from 222.117.25.117 [222.117.25.117] to ::ffff:5.79.80.26:2222 ... show less	Brute-Force FTP Brute-Force
🇳🇱 ParaBug	2026-09-14 20:32:07 (1 month ago)	2026-09-14T22:32:06.927504+02:00 r2d2 sshd-session[193770]: Invalid user admin from 222.117.25.117 p ... show more 2026-09-14T22:32:06.927504+02:00 r2d2 sshd-session[193770]: Invalid user admin from 222.117.25.117 port 49314 ... show less	Brute-Force SSH
🇩🇪 ghostwarriors	2026-09-13 20:50:19 (1 month ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇺🇸 SANYALnet Labs	2026-09-13 20:37:59 (1 month ago)	Sep 13 20:36:10 gigabyte-h410m sshd[498677]: User root from 222.117.25.117 not allowed because not l ... show more Sep 13 20:36:10 gigabyte-h410m sshd[498677]: User root from 222.117.25.117 not allowed because not listed in AllowUsers Sep 13 20:36:13 gigabyte-h410m sshd[498677]: Failed password for invalid user root from 222.117.25.117 port 60868 ssh2 Sep 13 20:36:15 gigabyte-h410m sshd[498677]: Connection closed by invalid user root 222.117.25.117 port 60868 [preauth] ... show less	Brute-Force
🇪🇸 masterguru	2026-09-11 11:57:15 (1 month ago)	(wplogin) Failed WordPress login from 222.117.25.117 (KR/South Korea/-): 5 in the last 3600 secs (0- ... show more (wplogin) Failed WordPress login from 222.117.25.117 (KR/South Korea/-): 5 in the last 3600 secs (0-122) show less	Hacking
🇧🇪 voormedia	2026-09-06 23:01:02 (1 month ago)	Accessed trap at '/wp-login.php'	Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 220.130.7.191

🇺🇸 147.185.132.115

🇬🇧 209.97.131.74

🇮🇹 128.116.205.208

🇰🇷 115.71.239.49

🇮🇳 103.227.94.204

🇬🇧 46.101.84.163

🇬🇧 209.97.139.118

🇩🇪 167.94.146.59

🇸🇬 137.132.211.22

🇳🇱 87.192.41.180

🇱🇹 77.90.185.20

🇳🇱 77.83.39.21

🇬🇧 64.227.34.121

🇸🇬 47.245.88.8

🇩🇪 34.179.199.54

🇺🇸 23.247.136.239

🇰🇷 211.106.133.202

🇩🇿 197.140.9.196

🇻🇳 171.237.176.209