JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 101.200.124.12

101.200.124.12 was found in our database!

This IP was reported 236 times. Confidence of Abuse is 99%: ?

99%

ISP	Aliyun Computing Co., LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS37963
Domain Name	alibabacloud.com
Country	🇨🇳 China
City	Beijing, Beijing

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 101.200.124.12

Whois 101.200.124.12

IP Abuse Reports for 101.200.124.12:

This IP address has been reported a total of 236 times from 101 distinct sources. 101.200.124.12 was first reported on November 26th 2025, and the most recent report was 10 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇩 Diskominfo Lumajang	2026-07-29 19:05:04 (10 hours ago)	Security Event Detected by SOC Diskominfo Lumajang: event=alert, hits=1	Brute-Force
🇫🇷 dynamix	2026-07-29 18:14:10 (11 hours ago)	Multiple WAF Violations	Web App Attack
🇩🇪 janbro	2026-07-28 19:45:44 (1 day ago)	Automated attempt to access sensitive configuration files.	Port Scan Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-28 16:38:23 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 101.200.124.12 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 101.200.124.12 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 28 12:38:19.262495 2026] [security2:error] [pid 1181507:tid 1181507] [client 101.200.124.12:44536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.143"] [uri "/.env.swp"] [unique_id "amja-zLEejLkq3U07IgGvQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-28 16:20:39 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
🇧🇾 lns.bz	2026-07-28 12:41:13 (1 day ago)	.env scanning [BY]	Web App Attack
🇫🇷 dynamix	2026-07-27 19:47:04 (2 days ago)	Multiple WAF Violations	Web App Attack
🇮🇳 evicky2002	2026-07-17 06:00:00 (1 week ago)	Confirmed malicious by STILWaters CTI platform (score=90, sources=1)	Hacking Brute-Force SSH
🇧🇷 Peregrine	2026-07-16 03:11:16 (2 weeks ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: - 101.200.124.12 - - [13/Jul/2026:09:45:10 -0300] "GET /. ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: - 101.200.124.12 - - [13/Jul/2026:09:45:10 -0300] "GET /.git/config HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:13 -0300] "GET /.env.swo HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:15 -0300] "GET /.env.staging HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:16 -0300] "GET /.env.old HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:17 -0300] "GET /.env~ HTTP/1.1" 404 414 show less	Bad Web Bot
🇧🇷 Peregrine	2026-07-15 03:10:44 (2 weeks ago)	Fail2Ban Jail: tomcat-honeypot \| Evidence: - 101.200.124.12 - - [13/Jul/2026:09:45:10 -0300] "GET /. ... show more Fail2Ban Jail: tomcat-honeypot \| Evidence: - 101.200.124.12 - - [13/Jul/2026:09:45:10 -0300] "GET /.git/config HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:13 -0300] "GET /.env.swo HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:15 -0300] "GET /.env.staging HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:16 -0300] "GET /.env.old HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:17 -0300] "GET /.env~ HTTP/1.1" 404 414 show less	Bad Web Bot
🇸🇬 WMK965	2026-07-14 18:53:19 (2 weeks ago)	101.200.124.12 - - [15/Jul/2026:02:53:17 +0800] "GET /settings.py HTTP/1.1" 444 0 "-" "Mozilla/5.0 ( ... show more 101.200.124.12 - - [15/Jul/2026:02:53:17 +0800] "GET /settings.py HTTP/1.1" 444 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1" "[LOCAL_IP]" 101.200.124.12 - - [15/Jul/2026:02:53:18 +0800] "GET /private/credentials.json HTTP/1.1" 444 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1" "[LOCAL_IP]" 101.200.124.12 - - [15/Jul/2026:02:53:18 +0800] "GET /actuator/threaddump HTTP/1.1" 444 0 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1" "[LOCAL_IP]" show less	Port Scan Web App Attack
🇧🇷 Peregrine	2026-07-13 12:45:21 (2 weeks ago)	Fail2Ban Jail: tomcat-404 \| Evidence: - 101.200.124.12 - - [13/Jul/2026:09:45:08 -0300] "GET /servic ... show more Fail2Ban Jail: tomcat-404 \| Evidence: - 101.200.124.12 - - [13/Jul/2026:09:45:08 -0300] "GET /service-account.json HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:09 -0300] "GET /containers/json HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:10 -0300] "GET /config.js HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:11 -0300] "GET /firebase-adminsdk.json HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:12 -0300] "GET /settings.py HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:13 -0300] "GET /terraform.tfvars HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:14 -0300] "GET /%2eenv HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:15 -0300] "GET /version HTTP/1.1" 404 414 - 101.200.124.12 - - [13/Jul/2026:09:45:18 -0300] "GET /aws.json HTTP/1.1" 404 414 show less	Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-11 22:25:03 (2 weeks ago)		Brute-Force Web App Attack
🇳🇱 astijf	2026-07-11 17:06:57 (2 weeks ago)	Port Scan detected from 101.200.124.12 (CN/China/-). 5 hits in the last 345 seconds	Brute-Force Port Scan
Anonymous	2026-07-11 15:15:46 (2 weeks ago)	Fail2Ban triggered	Web App Attack

Showing 1 to 15 of 236 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 185.226.197.53

🇩🇪 167.94.146.77

🇺🇸 162.217.100.41

🇨🇳 119.120.225.184

🇫🇮 45.130.127.173

🇮🇷 31.214.248.58

🇺🇸 23.251.34.84

🇳🇱 5.61.209.44

🇨🇦 4.239.243.30

🇷🇺 217.107.101.131

🇬🇧 213.166.84.58

🇺🇸 209.6.226.104

🇳🇵 182.50.66.106

🇩🇪 167.94.146.41

🇵🇰 111.92.153.63

🇺🇸 104.236.83.40

🇮🇳 103.176.64.36

🇳🇱 95.155.151.113

🇮🇳 49.36.83.82

🇳🇱 45.148.10.141