JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 101.47.12.227

101.47.12.227 was found in our database!

This IP was reported 34 times. Confidence of Abuse is 49%: ?

49%

ISP	BYTEPLUS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS150436
Domain Name	bytedance.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 101.47.12.227

Whois 101.47.12.227

IP Abuse Reports for 101.47.12.227:

This IP address has been reported a total of 34 times from 24 distinct sources. 101.47.12.227 was first reported on January 10th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 burlacu.org	2026-10-16 07:16:03 (22 hours ago)	Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 3 attempts ... show more Nginx multi-log analysis detected: wordpress_scan. Evidence: WordPress config access with 3 attempts. Blocked automatically. show less	Web App Attack Bad Web Bot
🇹🇼 tyebstx	2026-10-16 01:15:04 (1 day ago)	Wazuh Alert Evidence: 101.47.12.227 - - [16/Oct/2026:01:15:02 +0000] "GET / HTTP/1.1" 444 0 "-" "Moz ... show more Wazuh Alert Evidence: 101.47.12.227 - - [16/Oct/2026:01:15:02 +0000] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" "-" show less	Web App Attack
Anonymous	2026-10-16 00:33:29 (1 day ago)	1792110808.0 fail2ban apache-modsecurity [Fri Oct 16 02:33:28.208161 2026] [:error] [pid 209931:tid ... show more 1792110808.0 fail2ban apache-modsecurity [Fri Oct 16 02:33:28.208161 2026] [:error] [pid 209931:tid 209959] [client 101.47.12.227:59074] [client 101.47.12.227] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "langua ... show less	Web App Attack
🇺🇸 dot.mg	2026-10-15 18:21:01 (1 day ago)	Scan of vulnerable files	Web App Attack
🇨🇳 PrivateLiu	2026-10-11 18:33:04 (5 days ago)	[AbuseIPDB auto-report] Rules: Rule1, Rule2, Rule5. Region: non-CN. Config/sensitive path probing: a ... show more [AbuseIPDB auto-report] Rules: Rule1, Rule2, Rule5. Region: non-CN. Config/sensitive path probing: accessed .env/.config/admin/.git paths returning 4xx/444; Broad path scanning: 50 x 404/403 responses in short window indicating automated scanner; Known vulnerability path probing: targeting CMS (WordPress/Drupal), phpMyAdmin, actuator endpoints, or other known vulnerable paths. Sample paths: /wp-config.php, /info.php, /application.yaml, /.env.staging, /application.properties, /application-prod.yml, /phpinfo.php, /actuator/env, /actuator/configprops/, /.env.local, /.env.dev, /actuator/configprops. Statuses: 200, 404, 444. Methods: GET. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Sa show less	Port Scan Bad Web Bot Web App Attack
🇺🇸 uchat-ai.com	2026-10-11 15:58:10 (5 days ago)	IP 101.47.12.227 在过去24小时内进行了 4 次攻击。详细信息: 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data ... show more IP 101.47.12.227 在过去24小时内进行了 4 次攻击。详细信息: 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found; 攻击类型: Restricted File Access Attempt, 攻击信息: No matched data found show less	Web App Attack
🇨🇳 xiamen	2026-10-10 12:24:06 (6 days ago)	Automated detection (fjxiamen.com): repeated probing of sensitive paths (wp-login/phpmyadmin/xmlrpc/ ... show more Automated detection (fjxiamen.com): repeated probing of sensitive paths (wp-login/phpmyadmin/xmlrpc/.env) within minutes. Malicious scanning. show less	Port Scan
🇫🇷 teknoshop	2026-10-03 20:22:42 (1 week ago)	Automated honeypot/rate-limit ban on teknoshopmarket.it: Honeypot endpoint: /.env.production	Port Scan Bad Web Bot Web App Attack
🇩🇪 SA19999	2026-10-03 14:09:40 (1 week ago)	Auto-report: cwp:attack_Laravel framework Information \| sources=["cwp"] \| Fox honeypot cluster	Web App Attack
🇨🇳 SA19999	2026-10-03 13:06:58 (1 week ago)	Auto-report: cwp:attack_Laravel framework Information \| sources=["peer-sync"] \| Fox honeypot cluste ... show more Auto-report: cwp:attack_Laravel framework Information \| sources=["peer-sync"] \| Fox honeypot cluster show less	Web App Attack
🇧🇪 voormedia	2026-10-01 16:34:59 (2 weeks ago)	Accessed trap at '/.env'	Web App Attack
🇫🇷 smtp.com.es	2026-04-04 20:37:32 (6 months ago)	Brute force attempt.	Brute-Force Email Spam
🇺🇸 ras07	2026-03-30 10:09:32 (6 months ago)	Spam and phishing attempts.	Phishing Web Spam Exploited Host
🇪🇸 librebit	2026-03-29 03:17:58 (6 months ago)	Listed IP in blacklist by postfix/dnsblog	Spoofing
🇺🇸 jkhorvath.com	2026-03-14 20:22:34 (7 months ago)	Unknown SMTP Client 101.47.12.227	Email Spam Brute-Force

Showing 1 to 15 of 34 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇼 198.235.24.105

🇹🇼 198.235.24.42

🇺🇸 185.180.141.43

🇻🇳 180.93.245.203

🇫🇷 91.231.89.222

🇨🇦 85.217.149.73

🇫🇷 45.132.158.197

🇺🇸 216.132.189.196

🇹🇼 198.235.24.40

🇹🇼 198.235.24.31

🇨🇴 170.239.205.223

🇺🇸 104.22.101.139

🇫🇷 88.167.123.203

🇫🇷 80.241.218.114

🇺🇸 74.249.178.67

🇺🇸 47.251.116.252

🇨🇦 35.203.25.103

🇧🇪 34.156.120.65

🇩🇪 31.70.118.203

🇷🇴 2.57.121.112