Check an IP Address, Domain Name, Subnet, or ASN
121.43.125.129 has a very high threat confidence level of 98%, originating from Hangzhou, China, on the Hangzhou Alibaba Advertising Co.,Ltd. network (37963). It has been observed across 271 sessions targeting HTTPS, TELNET, SSH, DOCKER, HTTP, with detected attack patterns including docker remote exec via api, First observed on January 20, 2026, most recently active March 10, 2026.
Attacker interaction with an exposed Docker Engine API resulting in container enumeration followed by remote command execution inside running containers. The sequence of GET /containers/json and subsequent POST /containers/{id}/exec and /exec/{id}/start calls represents deliberate hands-on-keyboard activity where the adversary uses the Docker daemon as a control plane to execute commands, deploy payloads, or pivot further within the host environment. This behavior reflects active container abuse observed directly through high-interaction honeypot instrumentation.
| Date | Category | Protocol | Comment |
|---|---|---|---|
| Mar 9, 2026 | Brute Force | SSH | SikkerGuard: 2 blocked packets |