JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 104.244.75.16

104.244.75.16 was found in our database!

This IP was reported 96 times. Confidence of Abuse is 100%: ?

100%

ISP	BuyVM
Usage Type	Data Center/Web Hosting/Transit
ASN	AS53667
Domain Name	frantech.ca
Country	🇨🇭 Switzerland
City	Zurich, Zurich

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 104.244.75.16

Whois 104.244.75.16

IP Abuse Reports for 104.244.75.16:

This IP address has been reported a total of 96 times from 83 distinct sources. 104.244.75.16 was first reported on July 8th 2026, and the most recent report was 11 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇭 MWA SOC	2026-07-08 16:22:50 (11 minutes ago)		Hacking
🇹🇼 tye	2026-07-08 15:53:36 (40 minutes ago)	Wazuh Alert Evidence: 104.244.75.16 (104.244.75.16) - - [08/Jul/2026:23:53:32 +0800] "POST /cgi-bin/ ... show more Wazuh Alert Evidence: 104.244.75.16 (104.244.75.16) - - [08/Jul/2026:23:53:32 +0800] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 487 "-" "libredtail-http" show less	Web App Attack
🇺🇸 MPL	2026-07-08 15:11:48 (1 hour ago)	tcp/2375 (6 or more attempts)	Port Scan
🇦🇺 2000cn.com.au	2026-07-08 14:49:53 (1 hour ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	Web App Attack Hacking
🇺🇸 MPL	2026-07-08 13:27:30 (3 hours ago)	tcp/443 (4 or more attempts)	Port Scan
🇫🇮 NoaQT	2026-07-08 13:17:40 (3 hours ago)	2026-07-08T13:17:38.227744+00:00 ingress-1 haproxy[244]: 104.244.75.16:50734 [08/Jul/2026:13:17:38.2 ... show more 2026-07-08T13:17:38.227744+00:00 ingress-1 haproxy[244]: 104.244.75.16:50734 [08/Jul/2026:13:17:38.227] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 264/224/0/0/0 0/0 "GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 2026-07-08T13:17:38.592501+00:00 ingress-1 haproxy[244]: 104.244.75.16:50734 [08/Jul/2026:13:17:38.591] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 264/224/0/0/0 0/0 "GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 2026-07-08T13:17:38.963615+00:00 ingress-1 haproxy[244]: 104.244.75.16:50734 [08/Jul/2026:13:17:38.963] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 264/224/0/0/0 0/0 "GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 2026-07-08T13:17:39.403288+00:00 ingress-1 haproxy[244]: 104.244.75.16:50734 [08/Jul/2026:13:17:39.402] https_in~ https_in/<NOSRV> 0/-1/-1/-1/0 429 225 - - PR-- 266/226/0/0/0 0/0 "GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" ... show less	DDoS Attack
🇩🇪 defkev	2026-07-08 12:41:04 (3 hours ago)	Attempted Administrator Privilege Gain, Web Application Attack	Hacking
🇺🇸 TPI-Abuse	2026-07-08 12:26:46 (4 hours ago)	(mod_security) mod_security (id:218420) triggered by 104.244.75.16 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:218420) triggered by 104.244.75.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 08:26:40.194683 2026] [security2:error] [pid 31956:tid 31956] [client 104.244.75.16:36310] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.151.37:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.151.37"] [uri "/hello.world"] [unique_id "ak5CAGyhJYnDvReNm9-fIAAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Diskominfo Lumajang	2026-07-08 12:10:02 (4 hours ago)	Security Event Detected by SOC Diskominfo Lumajang: event=alert, hits=4	Brute-Force
🇨🇦 hpg	2026-07-08 12:09:24 (4 hours ago)	13 invalid SSH login attempts from 104.244.75.16 in the last 1.7 hours	Brute-Force SSH
🇬🇧 Mark Relf	2026-07-08 10:56:34 (5 hours ago)	2026-07-08T11:56:30.088484 webhost1 sshd-session[759132]: pam_unix(sshd:auth): authentication failur ... show more 2026-07-08T11:56:30.088484 webhost1 sshd-session[759132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.75.16 2026-07-08T11:56:31.800275 webhost1 sshd-session[759132]: Failed password for invalid user admin from 104.244.75.16 port 40534 ssh2 2026-07-08T11:56:33.542450 webhost1 sshd-session[759132]: Connection closed by invalid user admin 104.244.75.16 port 40534 [preauth] ... show less	Brute-Force SSH
🇬🇧 2MP	2026-07-08 10:56:29 (5 hours ago)	2026-07-08T10:51:24.051312+00:00 ubuntu sshd[841394]: Invalid user admin from 104.244.75.16 port 432 ... show more 2026-07-08T10:51:24.051312+00:00 ubuntu sshd[841394]: Invalid user admin from 104.244.75.16 port 43296 2026-07-08T10:51:24.081697+00:00 ubuntu sshd[841394]: Failed password for invalid user admin from 104.244.75.16 port 43296 ssh2 2026-07-08T10:53:54.859623+00:00 ubuntu sshd[930011]: Invalid user orangepi from 104.244.75.16 port 39564 2026-07-08T10:53:54.886166+00:00 ubuntu sshd[930011]: Failed password for invalid user orangepi from 104.244.75.16 port 39564 ssh2 2026-07-08T10:56:28.791387+00:00 ubuntu sshd[1020036]: Failed password for root from 104.244.75.16 port 48550 ssh2 ... show less	Brute-Force SSH
🇮🇹 mediarama.com	2026-07-08 10:55:29 (5 hours ago)	Banned by Fail2Ban	Web App Attack
🇨🇿 ICT KnTl	2026-07-08 10:54:46 (5 hours ago)	[Wed Jul 08 12:54:44.967699 2026] [php7:error] [pid 1106779:tid 1106779] [client 104.244.75.16:36578 ... show more [Wed Jul 08 12:54:44.967699 2026] [php7:error] [pid 1106779:tid 1106779] [client 104.244.75.16:36578] script '/var/www/html/index.php' not found or unable to stat [Wed Jul 08 12:54:45.727907 2026] [php7:error] [pid 1106779:tid 1106779] [client 104.244.75.16:36578] script '/var/www/html/index.php' not found or unable to stat [Wed Jul 08 12:54:46.106263 2026] [php7:error] [pid 1106779:tid 1106779] [client 104.244.75.16:36578] script '/var/www/html/index.php' not found or unable to stat ... show less	Web App Attack
🇺🇸 yzfdude1	2026-07-08 10:49:27 (5 hours ago)	Jul 8 04:49:25 b146-InstructorB sshd[263322]: Invalid user orangepi from 104.244.75.16 port 44490 J ... show more Jul 8 04:49:25 b146-InstructorB sshd[263322]: Invalid user orangepi from 104.244.75.16 port 44490 Jul 8 04:49:25 b146-InstructorB sshd[263322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.244.75.16 Jul 8 04:49:26 b146-InstructorB sshd[263322]: Failed password for invalid user orangepi from 104.244.75.16 port 44490 ssh2 ... show less	Brute-Force SSH

Showing 1 to 15 of 96 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇭 41.242.115.83

🇺🇾 201.217.155.130

🇧🇷 177.86.123.112

🇳🇱 172.94.9.136

🇸🇬 172.69.176.30

🇨🇿 146.70.129.28

🇺🇸 143.42.1.189

🇨🇳 120.48.50.133

🇬🇧 89.34.96.151

🇺🇸 74.125.80.151

🇺🇸 68.235.46.153

🇩🇪 64.89.163.142

🇳🇱 51.158.205.203

🇨🇴 45.167.250.45

🇧🇪 34.156.183.234

🇺🇸 20.169.107.49

🇮🇳 4.247.131.205

🇲🇽 177.245.233.151

🇧🇷 177.34.168.137

🇺🇸 91.230.168.42