Critical Alert
Security alert: 121.227.31.13 rated 10/10 based on 44 verified incidents.
Threat profile indicates sustained malicious activity with 95% confidence rating.
More threatening than 100% of monitored IPs
IP Address
121.227.31.13
IPv4
Public
CN
Threat Intelligence Analysis
Automated assessment based on aggregated, anonymized threat data
Top 5% Most Dangerous
CN
Location
Chinanet
ASN 4134
44
Reports
Honeypot
Data Source
Threat Categories
SSH
27
Hacking
16
Exploited Host
5
Brute-Force
4
Technical Details
SSH attacks attempt to gain server access through password guessing or exploitation of SSH vulnerabilities.
Recommended Mitigations
Use key-based authentication, change default ports, implement fail2ban, and disable root login.
Behavioral Analysis
Activity Pattern:
Consistent Activity
Steady malicious activity over 3 weeks indicates persistent threat actor operations.
First Observed
4. September 2026
Last Activity
30. September 2026
Recent (7 days)
8 incidents
Reputable Network
This IP is hosted on a network (ASN 4134) with generally good reputation. The ISP Chinanet maintains standard security practices.
The malicious activity may represent an isolated compromised system rather than systematic abuse.
Security Recommendations
Implement immediate countermeasures. Well-resourced threat actor identified.
Long-term blocking recommended.
Reputation Summary
Threat Level
10/10
Critical
Critical
Activity Frequency
8/10
High
Confidence Score
95%
Verified
Confidence History
9. Mar 2026 - 30. Sep 2026
95%
Current
Stable
Trend
Security Reports (30)
| Date | Categories | Source | Confidence |
|---|---|---|---|
| New | Hacking SSH | Honeypot x2 | 75% |
| New | Exploited Host SSH Hacking | Honeypot x3 | 75% |
| New | Hacking SSH | Honeypot x2 | 75% |
| New | Exploited Host Hacking SSH | Honeypot x3 | 75% |
| New | Hacking SSH | Honeypot x2 | 75% |
| Brute-Force SSH | Honeypot | 75% | |
| SSH Hacking | Honeypot x2 | 75% | |
| Hacking SSH Exploited Host | Honeypot x3 | 75% | |
| Hacking | Honeypot | 75% | |
| SSH Hacking | Honeypot x2 | 75% | |
| Hacking | Honeypot | 75% | |
| Hacking SSH Exploited Host | Honeypot x3 | 75% | |
| SSH Hacking | Honeypot x2 | 75% | |
| SSH Hacking | Honeypot x2 | 75% | |
| SSH Hacking | Honeypot x2 | 75% | |
| Hacking SSH Exploited Host | Honeypot x3 | 75% | |
| SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| Hacking | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| Brute-Force SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| Brute-Force SSH | Honeypot | 75% | |
| Brute-Force SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% | |
| SSH | Honeypot | 75% |
Technical Details
Basic Information
- IP Address
- 121.227.31.13
- IP Version
- IPv4
- Network Type
- Public
- Tor Network
- No
- Network Class
- Class A
Geolocation
- Country
-
CN
- ASN
- AS4134
- ISP
- Chinanet
DNS Information
- Reverse DNS
- None
- PTR Record
- No
- Connection Type
- Static
Statistics
- Total Reports
- 44
- First Reported
- 22 Feb 2026
- Last Reported
- 30 Sep 2026, 06:58
Network Reputation
Analysis of the entire network (ASN) that this IP address belongs to, providing context about the hosting provider and network-wide threat patterns.
Network Identity
AS4134
Chinanet
CN
Network Threat Assessment
3/10
This network appears to be relatively clean with very low threat indicators.
Network Statistics
8,261
Total IPs Monitored
33,059
Total Reports
4
Reports per IP
Network Context
This IP address belongs to Chinanet (AS4134), which manages 8,261 IP addresses in our monitoring system. Out of these, 33,059 have been reported for suspicious activities, resulting in a network-wide threat level of 3/10.
Network status:
This network appears to be well-maintained with low threat indicators.
Comparative Analysis
How this IP compares to others in our threat intelligence database
100
%
Global Threat Ranking
This IP is more threatening than 100% of all IPs in our database.
Top 10% Most DangerousGlobal Comparison
Compared against 805,389 reported IPs worldwide
Threat Level
10/10
avg: 6.3
++
Total Reports
44
avg: 9
++
Network Comparison
Compared against 14,576 IPs in ASN 4134
Threat Level
10/10
network avg: 7.4
+
Total Reports
44
network avg: 3
++
Network Chinanet has overall threat level 3/10
Geographic Comparison
Compared against 44,688 IPs in CN
Threat Level
10/10
country avg: 7.4
+
Total Reports
44
country avg: 5
++
Activity Trends
Daily report activity over the last 30 days showing patterns and peaks.
Peak Day
15 Sep 2026
4 reports
Daily Average
0.7
reports/day
Most Active
Tuesday
10 reports
Evolution of threat level over time based on reported categories and frequency.
Initial Threat
6/10
Current Threat
6/10
Distribution of threat categories reported over time.
Top Threat Categories
SSH
41
Hacking
16
Exploited Host
5
Brute-Force
4
Activity patterns showing when this IP is most active during the day and week.
Hourly Activity
Peak activity at 02:00 with 6 reports
Weekly Activity
Geographic Threat Distribution
732,469 threat incidents tracked globally • Last 24h: 28,911 Logs
FEED
Top Threat Sources
-
01
United States143,077 19.5% -
02
Brazil110,685 15.1%
-
03
India82,006 11.2%
-
04
China44,686 6.1%
-
05
SC29,232 4%
-
06
Netherlands17,442 2.4%
-
07
Germany17,410 2.4%
-
08
Pakistan16,564 2.3%
-
09
Argentina16,184 2.2%
-
10
Colombia15,130 2.1%
+40 more countries
THREAT LEVEL
LOW
MED
HIGH
Related IPs
Other IPs associated with this address through network or behavioral similarity
IPs from the same Autonomous System (AS) network provider.
20
Related IPs
9.5/10
Avg Threat
91%
Avg Confidence
20
High Threat
High-risk network: Majority of related IPs are flagged
202.101.144.44
10/10
Confidence
100%
Reports
16
Location
CN
CN
125.94.109.237
10/10
Confidence
100%
Reports
15
Location
CN
CN
222.220.102.32
10/10
Confidence
100%
Reports
12
Location
CN
CN
183.129.148.70
10/10
Confidence
98%
Reports
42
Location
CN
CN
202.107.164.66
10/10
Confidence
94%
Reports
13
Location
CN
CN
106.117.214.50
8/10
Confidence
93%
Reports
27
Location
CN
CN
27.128.171.39
10/10
Confidence
91%
Reports
25
Location
CN
CN
14.29.214.161
10/10
Confidence
90%
Reports
75
Location
CN
CN
120.33.126.224
8/10
Confidence
90%
Reports
64
Location
CN
CN
59.36.78.66
8/10
Confidence
89%
Reports
35
Location
CN
CN
220.179.81.109
10/10
Confidence
89%
Reports
30
Location
CN
CN
117.81.212.152
10/10
Confidence
88%
Reports
377
Location
CN
CN
49.64.85.138
10/10
Confidence
88%
Reports
51
Location
CN
CN
182.244.5.153
8/10
Confidence
88%
Reports
32
Location
CN
CN
58.221.60.25
10/10
Confidence
86%
Reports
135
Location
CN
CN
117.62.22.127
8/10
Confidence
86%
Reports
44
Location
CN
CN
116.1.149.196
10/10
Confidence
86%
Reports
25
Location
CN
CN
42.249.228.42
10/10
Confidence
85%
Reports
118
Location
CN
CN
183.66.166.30
10/10
Confidence
85%
Reports
48
Location
CN
CN
182.105.123.10
10/10
Confidence
85%
Reports
43
Location
CN
CN
IPs from the same country with similar threat profiles.
15
Related IPs
9.9/10
Avg Threat
99%
Avg Confidence
15
High Threat
High-risk network: Majority of related IPs are flagged
118.121.202.149
10/10
Confidence
100%
Reports
17
ISP
CHINANET SiChua...
202.101.144.44
10/10
Confidence
100%
Reports
16
ISP
Chinanet
118.196.142.135
10/10
Confidence
100%
Reports
16
ISP
China Telecom G...
125.94.109.237
10/10
Confidence
100%
Reports
15
ISP
Chinanet
115.191.27.238
10/10
Confidence
100%
Reports
15
ISP
Beijing Volcano...
27.155.120.131
10/10
Confidence
100%
Reports
14
ISP
Fuzhou
118.145.246.44
10/10
Confidence
100%
Reports
13
ISP
Beijing Volcano...
106.120.205.138
10/10
Confidence
100%
Reports
12
ISP
China Networks ...
222.220.102.32
10/10
Confidence
100%
Reports
12
ISP
Chinanet
203.56.198.45
10/10
Confidence
99%
Reports
26
ISP
Sichuan Chuanxn...
183.129.148.70
10/10
Confidence
98%
Reports
42
ISP
Chinanet
115.190.151.242
10/10
Confidence
98%
Reports
19
ISP
Beijing Volcano...
112.123.228.180
10/10
Confidence
98%
Reports
15
ISP
CHINA UNICOM Ch...
101.96.214.98
10/10
Confidence
98%
Reports
14
ISP
Beijing Volcano...
118.196.119.108
8/10
Confidence
98%
Reports
12
ISP
China Telecom (...
IPs with similar threat level and confidence scores.
15
Related IPs
9.6/10
Avg Threat
95%
Avg Confidence
15
High Threat
High-risk network: Majority of related IPs are flagged
91.196.152.49
10/10
Confidence
95%
Reports
154
Location
FR
FR
77.90.185.20
8/10
Confidence
95%
Reports
153
Location
IR
IR
91.196.152.229
10/10
Confidence
95%
Reports
148
Location
FR
FR
91.196.152.64
10/10
Confidence
95%
Reports
135
Location
FR
FR
91.196.152.156
10/10
Confidence
95%
Reports
132
Location
FR
FR
111.160.133.62
8/10
Confidence
95%
Reports
94
Location
CN
CN
41.111.198.172
8/10
Confidence
95%
Reports
78
Location
DZ
DZ
77.68.118.194
10/10
Confidence
95%
Reports
73
Location
GB
GB
113.23.225.9
10/10
Confidence
95%
Reports
67
Location
MY
MY
49.0.3.142
10/10
Confidence
95%
Reports
66
Location
ID
ID
41.111.187.130
10/10
Confidence
95%
Reports
62
Location
DZ
DZ
133.18.142.16
10/10
Confidence
95%
Reports
60
Location
JP
JP
82.147.142.205
10/10
Confidence
95%
Reports
59
Location
BG
BG
67.206.199.61
10/10
Confidence
95%
Reports
54
Location
PR
PR
103.226.242.125
10/10
Confidence
95%
Reports
53
Location
IN
IN