JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 101.47.13.192

101.47.13.192 was found in our database!

This IP was reported 58 times. Confidence of Abuse is 100%: ?

100%

ISP	BYTEPLUS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS150436
Domain Name	bytedance.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 101.47.13.192

Whois 101.47.13.192

IP Abuse Reports for 101.47.13.192:

This IP address has been reported a total of 58 times from 53 distinct sources. 101.47.13.192 was first reported on July 19th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-07-21 06:00:00 (1 day ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇬🇧 gws-hostmaster	2026-07-20 07:22:46 (2 days ago)	ModSecurity OWASP CRS (Anomaly Score: 10): Restricted File Access Attempt;URL file extension is rest ... show more ModSecurity OWASP CRS (Anomaly Score: 10): Restricted File Access Attempt;URL file extension is restricted by policy; show less	Web App Attack
🇧🇷 diego	2026-07-20 07:18:48 (2 days ago)	[probe-44-49] 2026-07-20 06:59:29, Client: 101.47.13.192, Protocol: 6, Unauthorized activity to HTTP ... show more [probe-44-49] 2026-07-20 06:59:29, Client: 101.47.13.192, Protocol: 6, Unauthorized activity to HTTP: GET / show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 07:17:29 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 101.47.13.192 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 101.47.13.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 03:17:22.912866 2026] [security2:error] [pid 2769407:tid 2769407] [client 101.47.13.192:38710] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dmasoftlab.com"] [uri "/.git/config"] [unique_id "al3LgtvcuwfPYWdNuXK-AgAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇭🇺 DumaNet	2026-07-20 07:12:00 (2 days ago)	TCP connect flood, port scan (Port: 80/TCP). Date: Mon Jul 20. 07:29:47 2026 +0200 IP: 101.47.13.1 ... show more TCP connect flood, port scan (Port: 80/TCP). Date: Mon Jul 20. 07:29:47 2026 +0200 IP: 101.47.13.192 (CN/China/-) Connections (sample): tcp6: 101.47.13.192:40154 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:41972 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:40082 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:48126 -> [removed]:80 (FIN_WAIT1) tcp6: 101.47.13.192:47756 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:41480 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:41862 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:55650 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:41380 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:40246 -> [removed]:80 (CLOSING) tcp6: 101.47.13.192:55432 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:41596 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:41836 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:42086 -> [removed]:80 (TIME_WAIT) tcp6: 101.47.13.192:55574 -> [removed]:80 (TIME_WAIT) .... (445 times/attempts total at same time). show less	Port Scan Brute-Force
🇨🇦 Mediashaker	2026-07-20 07:10:44 (2 days ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 101.47.13.192 (SG/Singap ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 101.47.13.192 (SG/Singapore/-) show less	Port Scan
🇩🇪 jotoma.de	2026-07-20 07:05:02 (2 days ago)	[Mon Jul 20 09:04:58.960192 2026] [proxy_fcgi:error] [pid 525613:tid 525685] [client 101.47.13.192:5 ... show more [Mon Jul 20 09:04:58.960192 2026] [proxy_fcgi:error] [pid 525613:tid 525685] [client 101.47.13.192:54992] AH01071: Got error 'Primary script unknown' [Mon Jul 20 09:04:59.575962 2026] [proxy_fcgi:error] [pid 525613:tid 525678] [client 101.47.13.192:54956] AH01071: Got error 'Primary script unknown' [Mon Jul 20 09:05:02.114101 2026] [proxy_fcgi:error] [pid 525613:tid 525686] [client 101.47.13.192:55174] AH01071: Got error 'Primary script unknown' ... show less	Bad Web Bot Web App Attack
🇧🇬 Stoyko Stoykov	2026-07-20 07:04:46 (2 days ago)	101.47.13.192 - - [20/Jul/2026:10:04:45 +0300] "GET /.env.staging HTTP/1.1" 404 0 "-" "Mozilla/5.0 ( ... show more 101.47.13.192 - - [20/Jul/2026:10:04:45 +0300] "GET /.env.staging HTTP/1.1" 404 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Hacking Web App Attack
🇩🇪 dispaisyenterprises	2026-07-20 06:58:47 (2 days ago)	Honeypot [fra-de-honeypot]: Large payload (1483 bytes); 8451 [2] TCP Reported by DisPaisy Enterprise ... show more Honeypot [fra-de-honeypot]: Large payload (1483 bytes); 8451 [2] TCP Reported by DisPaisy Enterprises (dispaisy.systems) using: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 tikket	2026-07-20 06:48:28 (2 days ago)	Automated honeypot report: fail2ban 'caddy-honeypot' ban. Source probed honeypot/recon endpoints on ... show more Automated honeypot report: fail2ban 'caddy-honeypot' ban. Source probed honeypot/recon endpoints on void.xn--q9jyb4c. show less	Bad Web Bot Web App Attack
🇬🇧 myintarweb	2026-07-20 06:47:41 (2 days ago)	101.47.13.192 - - [20/Jul/2026:07:47:40 +0100] 80 "\x16\x03\x01\x05\xc6\x01" 400 1467 "-" "-" ...	Hacking Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 06:43:30 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 101.47.13.192 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 101.47.13.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 02:43:24.237174 2026] [security2:error] [pid 9685:tid 9685] [client 101.47.13.192:56406] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.cyclingboardgames.net"] [uri "/web.config"] [unique_id "al3DjEQ4IOTFZp8fBN46yAAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-07-20 06:42:11 (2 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 101.47.13.192 (SG/Singapore/-): 1 in the ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 101.47.13.192 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 101.47.13.192 - - [20/Jul/2026:08:42:06 +0200] "GET /secrets.json HTTP/2.0" 404 10912 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36" "101.47.13.192" host=www.consorzioaet.it show less	Port Scan
Anonymous	2026-07-20 06:36:03 (2 days ago)	Bot / scanning and/or hacking attempts: GET /aliyun.txt HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.env. ... show more Bot / scanning and/or hacking attempts: GET /aliyun.txt HTTP/1.1, GET /.env.txt HTTP/1.1, GET /.env.yaml HTTP/1.1, GET /secrets.conf HTTP/1.1, GET /.aliyun/config.yaml HTTP/1.1, GET /config.txt HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 06:25:53 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 101.47.13.192 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 101.47.13.192 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 02:25:47.314410 2026] [security2:error] [pid 27117:tid 27117] [client 101.47.13.192:33256] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tiny.abecasis.com"] [uri "/.env.staging"] [unique_id "al2_azoWEPZq9jljFkQGiAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 58 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇸🇬 185.150.0.77

🇵🇱 176.53.159.197

🇷🇺 158.46.17.30

🇨🇳 116.172.201.119

🇰🇪 102.210.149.236

🇺🇸 64.227.109.142

🇫🇮 45.154.244.149

🇰🇷 222.110.147.58

🇨🇷 200.229.6.61

🇲🇽 187.230.22.130

🇲🇽 177.225.176.182

🇺🇸 162.216.150.186

🇫🇮 147.185.133.88

🇳🇱 142.93.140.194

🇩🇪 141.98.102.235

🇩🇪 139.28.241.54

🇰🇷 130.94.30.100

🇨🇳 117.139.10.98

🇺🇸 100.50.17.159

🇳🇱 91.92.47.229