JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 101.47.21.12

101.47.21.12 was found in our database!

This IP was reported 23 times. Confidence of Abuse is 24%: ?

24%

ISP	BYTEPLUS
Usage Type	Data Center/Web Hosting/Transit
ASN	AS150436
Domain Name	bytedance.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 101.47.21.12

Whois 101.47.21.12

IP Abuse Reports for 101.47.21.12:

This IP address has been reported a total of 23 times from 16 distinct sources. 101.47.21.12 was first reported on January 10th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 H. Hampel	2026-06-08 19:27:10 (4 days ago)	SMTP hacking.	Email Spam Spoofing Hacking
🇩🇪 kernel-error.de	2026-06-08 18:05:10 (5 days ago)	2026-06-08 20:05:10 #13240(rspamd_proxy) <b4688c>; proxy; rspamd_task_write_log: id: <20260609020506 ... show more 2026-06-08 20:05:10 #13240(rspamd_proxy) <b4688c>; proxy; rspamd_task_write_log: id: <[email protected]>, qid: <96E20C60C2>, ip: 101.47.21.12, from: <[email protected]>, (default: F (no action): [45.79/12.00] [SPAMTRAP(15.00){[email protected];},PH_SURBL_MULTI(7.50){cqizvybx.bhmsbp.cn:url;},BAYES_SPAM(5.10){100.00%;},ABUSE_SURBL(5.00){cqizvybx.bhmsbp.cn:url;lgwenfd.cn:from_smtp;lgwenfd.cn:from_mime;lgwenfd.cn:helo;lgwenfd.cn:dkim;lgwenfd.cn:mid;},HFILTER_HOSTNAME_UNKNOWN(2.50){},PHISHING(2.00){orico.co.jp->bhmsbp.cn;},RBL_MAILSPIKE_WORST(2.00){101.47.21.12:from;},RBL_VIRUSFREE_BOTNET(2.00){101.47.21.12:from;},RDNS_NONE(2.00){},RBL_SEM(1.00){101.47.21.12:from;},RDNS_DNSFAIL(-1.00){},URI_COUNT_ODD(1.00){17;},MV_CASE(0.50){},PHISHED_PHISHTANK(0.50){hpq http://www.phishtank.com/phish_detail.php?phish_id=9434547;},XM_CASE(0.50){},BAD_REP_POLICIES(0.10){},MIME_BASE64_TEXT(0.10){},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ONCE_RECEIVED(0.10){},MX_GOOD(-0.01) ... show less	Email Spam
🇨🇭 Origon	2026-06-08 16:01:05 (5 days ago)	NOQUEUE - IP: 101.47.21.12 - Jun 8 18:01:05 plesk postfix/smtpd[2482758]: NOQUEUE: reject: RCPT fro ... show more NOQUEUE - IP: 101.47.21.12 - Jun 8 18:01:05 plesk postfix/smtpd[2482758]: NOQUEUE: reject: RCPT from unknown[101.47.21.12]: 554 5.7.1 Service unavailable; Client host [101.47.21.12] blocked using bl.spamcop.net; Blocked - see https://www.spamcop.net/bl.shtml?101.47.21.12; from=<[email protected]> to=<REDACTED@REDACTED> proto=ESMTP helo=<lgwenfd.cn> show less	Email Spam
🇮🇹 MLO	2026-05-21 01:50:00 (3 weeks ago)	This IP was used as the originating sender of a phishing/spam email campaign impersonating a Japanes ... show more This IP was used as the originating sender of a phishing/spam email campaign impersonating a Japanese toll road inquiry service (ETC-MEISAI). The message was crafted in Japanese, sent from a randomized .info domain (nmxtfz.info), and contained a fraudulent call-to-action button linking to a .cn domain (dsrzzi.jetgq.cn). Email headers confirm 101.47.21.12 as the authenticated sending host (SPF pass). The mailer identified itself as Foxmail 6.13 [cn]. Received headers show routing through asp-relay-spacemail.jellyfish.systems before delivery. DKIM passed on the sending domain, suggesting an organized infrastructure reusing legitimate relay paths. Category: Phishing / Spam Sending domain: nmxtfz.info Payload domain: dsrzzi.jetgq.cn X-mailer: Foxmail 6, 13, 102, 15 [cn] Target: Italian recipient, impersonated service in Japanese show less	Email Spam Phishing
🇺🇸 octageeks.com	2026-03-20 04:07:59 (2 months ago)	Wordpress malicious attack:[octablocked]	Web App Attack
🇫🇷 bigorre.org	2026-03-19 10:34:16 (2 months ago)	Unidentified crawling: not a self-announced bot in user-agent	Bad Web Bot
🇦🇺 MAGIC	2026-03-19 01:03:03 (2 months ago)	VM5 Bad user agents ignoring web crawling rules. Draing bandwidth	DDoS Attack Bad Web Bot
🇫🇷 polido	2026-03-18 13:32:36 (2 months ago)	Unauthorized connection attempt to port 443 from 101.47.21.12	Port Scan
🇺🇸 ipblock.com	2026-03-18 08:06:00 (2 months ago)	IPBlock protected site ID [3192-af][s=06]. Exploit request, vulnerability probe.	Hacking Bad Web Bot Web App Attack
🇺🇸 gui-ying233	2026-03-18 06:41:05 (2 months ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-03-18 05:37:36 (2 months ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-03-18 04:05:42 (2 months ago)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0. ... show more Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 show less	Bad Web Bot
🇺🇸 gui-ying233	2026-03-18 01:48:52 (2 months ago)	Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Vers ... show more Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/180.1 show less	Bad Web Bot
🇫🇷 chrisj	2026-03-11 16:01:18 (3 months ago)	2026-03-11T16:00:58.672551+00:00 www.diamondaviators.net throttler[2449908]: Throttle IP 101.47.21.1 ... show more 2026-03-11T16:00:58.672551+00:00 www.diamondaviators.net throttler[2449908]: Throttle IP 101.47.21.12 with 25 denials ... show less	Bad Web Bot
Anonymous	2026-02-26 17:59:40 (3 months ago)	Automated report (2026-02-26T12:59:40-05:00). Nesting attack detected.	Hacking

Showing 1 to 15 of 23 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.26

🇧🇷 191.235.101.61

🇻🇳 171.231.193.186

🇺🇸 166.88.178.207

🇸🇬 152.42.227.173

🇫🇷 2a02:c207:2276:1600::1

🇨🇳 222.86.118.35

🇺🇸 216.26.224.50

🇩🇪 213.209.159.238

🇹🇼 198.235.24.17

🇬🇧 195.140.214.25

🇬🇧 193.163.125.110

🇮🇪 108.130.184.228

🇨🇦 85.217.149.73

🇨🇱 68.211.177.55

🇸🇬 47.84.102.158

🇬🇧 35.203.210.185

🇰🇷 220.82.247.216

🇨🇭 209.99.191.19

🇳🇱 151.243.177.120