JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 101.36.117.122

101.36.117.122 was found in our database!

This IP was reported 80 times. Confidence of Abuse is 68%: ?

68%

ISP	UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS135377
Domain Name	ucloud.cn
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 101.36.117.122

Whois 101.36.117.122

IP Abuse Reports for 101.36.117.122:

This IP address has been reported a total of 80 times from 34 distinct sources. 101.36.117.122 was first reported on January 2nd 2024, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇷 setupgr	2026-10-22 19:59:06 (2 hours ago)	(mod_security) mod_security (id:1000001) triggered by 101.36.117.122 (HK/Hong Kong/-/Hong Kong/-/[AS ... show more (mod_security) mod_security (id:1000001) triggered by 101.36.117.122 (HK/Hong Kong/-/Hong Kong/-/[AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Oct 22 22:59:05.191898 2026] [security2:error] [pid 408021:tid 408174] [client 101.36.117.122:58322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/7.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "102"] [id "1000001"] [msg "Bad file blocked: /7.php"] [severity "CRITICAL"] [tag "security"] [hostname "www.setworldup.com"] [uri "/7.php"] [unique_id "atprCYLiuKo2wwhXr0po9AAAAtE"] show less	Port Scan
🇺🇸 kosada.com	2026-10-22 19:31:45 (3 hours ago)	Repeated requests for suspicious nonexistent URLs, for example: /7.php (HTTP/1.1 port 443, user agen ... show more Repeated requests for suspicious nonexistent URLs, for example: /7.php (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0") show less	Web App Attack
🇬🇧 abivia	2026-10-22 17:44:49 (5 hours ago)	Abivia WAF trigger: Rule scriptKiddies: Probing for vulnerabilities uri: /7.php	Hacking
🇦🇺 Bay13	2026-10-20 00:45:59 (2 days ago)	CrowdSec:custom/http-probing	Web App Attack
🇷🇴 clauss	2026-10-17 19:56:25 (5 days ago)	101.36.117.122 - - [17/Oct/2026:22:56:24 +0300] "GET /7.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Window ... show more 101.36.117.122 - - [17/Oct/2026:22:56:24 +0300] "GET /7.php HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0" 101.36.117.122 - - [17/Oct/2026:22:56:25 +0300] "GET /7.php HTTP/2.0" 404 19262 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0" ... show less	Web App Attack
🇩🇪 bescared	2026-10-15 22:40:48 (1 week ago)	F2B - Malicious activity detected. URL Probing. -8ff06ede-	Hacking Bad Web Bot Web App Attack
🇬🇷 setupgr	2026-10-15 05:59:37 (1 week ago)	(mod_security) mod_security (id:1000001) triggered by 101.36.117.122 (HK/Hong Kong/-/Hong Kong/-/[AS ... show more (mod_security) mod_security (id:1000001) triggered by 101.36.117.122 (HK/Hong Kong/-/Hong Kong/-/[AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Thu Oct 15 08:59:32.680311 2026] [security2:error] [pid 2987:tid 3107] [client 101.36.117.122:58865] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/7.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "102"] [id "1000001"] [msg "Bad file blocked: /7.php"] [severity "CRITICAL"] [tag "security"] [hostname "www.setworldup.com"] [uri "/7.php"] [unique_id "atBrxACBw4eK8KCb0rKQfwAAA0s"] show less	Port Scan
🇷🇸 Smel	2026-10-15 03:52:01 (1 week ago)	HTTP/80/443/8080 Unauthorized Probe, Hack -	Hacking Web App Attack
🇬🇧 abivia	2026-10-15 03:47:26 (1 week ago)	Abivia WAF trigger: Rule scriptKiddies: Probing for vulnerabilities uri: /7.php	Hacking
🇲🇽 octageeks.com	2026-10-13 04:14:29 (1 week ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇩🇪 LRob	2026-10-12 19:46:40 (1 week ago)	Web shell probe \| method: GET \| path: /1.php \| ua: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gec ... show more Web shell probe \| method: GET \| path: /1.php \| ua: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0 \| 2026-10-12 19:46 UTC show less	Hacking Web App Attack
🇦🇺 Bay13	2026-10-12 11:59:21 (1 week ago)	CrowdSec:custom/webshell-scan	Web App Attack
🇺🇸 kosada.com	2026-10-12 11:49:24 (1 week ago)	Repeated requests for suspicious nonexistent URLs, for example: /1.php (HTTP/1.1 port 443, user agen ... show more Repeated requests for suspicious nonexistent URLs, for example: /1.php (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0") show less	Web App Attack
🇳🇿 Tripwire	2026-10-12 09:16:24 (1 week ago)	Scanning for exploits - /1.php	Hacking Web App Attack
🇺🇸 entangled_mongoose	2026-10-12 05:01:10 (1 week ago)	Probed /1.php.	Web App Attack

Showing 1 to 15 of 80 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 202.164.133.150

🇺🇸 193.56.116.80

🇨🇴 190.66.65.111

🇨🇴 181.78.4.253

🇨🇴 181.51.34.230

🇺🇸 147.185.132.160

🇭🇰 103.254.75.118

🇬🇧 77.67.26.215

🇸🇬 43.134.94.236

🇧🇪 34.53.172.208

🇺🇸 20.102.17.195

🇨🇭 209.99.184.98

🇧🇷 205.210.31.177

🇲🇴 182.93.50.90

🇺🇸 170.187.163.133

🇨🇳 120.232.251.20

🇸🇦 37.121.77.213

🇧🇷 179.216.168.216

🇺🇸 177.202.195.64

🇫🇷 90.53.7.74