JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 106.75.147.172

106.75.147.172 was found in our database!

This IP was reported 274 times. Confidence of Abuse is 31%: ?

31%

ISP	Shanghai UCloud Information Technology Company Limited
Usage Type	Fixed Line ISP
ASN	AS58466
Domain Name	ucloud.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 106.75.147.172

Whois 106.75.147.172

IP Abuse Reports for 106.75.147.172:

This IP address has been reported a total of 274 times from 73 distinct sources. 106.75.147.172 was first reported on May 6th 2021, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-07-27 21:26:14 (2 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 2 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 2 in the last 3600 secs (0-196) show less	Hacking
🇨🇦 lakered	2026-07-27 02:54:58 (2 days ago)	Detectors: [NGINX] \| Reasons: Nginx: Default server trap hit \| Evidence: High-Criminality-Signature ... show more Detectors: [NGINX] \| Reasons: Nginx: Default server trap hit \| Evidence: High-Criminality-Signature (p0f::64:0::mss*1,9:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.91), OS-Signature-Mismatch (UA:Windows/p0f:Linux) \| UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 \| TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:20090m) show less	Port Scan Exploited Host
🇫🇷 masterguru	2026-07-27 01:43:48 (2 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 1 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-07-24 05:00:14 (5 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 1 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 Rom74	2026-07-23 17:04:14 (6 days ago)	[Thu Jul 23 19:04:09.438111 2026] [security2:error] [pid 3577164:tid 130339550758592] [remote 106.75 ... show more [Thu Jul 23 19:04:09.438111 2026] [security2:error] [pid 3577164:tid 130339550758592] [remote 106.75.147.172:25324] [client 106.75.147.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nextcloud.ton-espace.com"] [uri "/"] [unique_id "amJJiVF-TF7hknxF09j72AAAQgs"] [Thu Jul 23 19:04:11.738907 2026] [security2:error] [pid 3577161:tid 130339592722112] [remote 106.75.147.172:25838] [client 106.75.147.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Excee ... show less	Web App Attack
🇫🇷 masterguru	2026-07-23 16:23:17 (6 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 2 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.147.172 (CN/China/-): 2 in the last 3600 secs (0-196) show less	Hacking
🇦🇺 paulshipley.com.au	2026-07-14 23:25:55 (2 weeks ago)	[Wed Jul 15 09:25:54.904195 2026] [security2:error] [pid 306725] [client 106.75.147.172:65214] [clie ... show more [Wed Jul 15 09:25:54.904195 2026] [security2:error] [pid 306725] [client 106.75.147.172:65214] [client 106.75.147.172] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "shop.levellapromotions.co.nz"] [uri "/"] [unique_id "albFgv8W0GaDhOwQ1kZWTwAAAAQ"] ... show less	Web App Attack
🇺🇸 xmission.com	2026-07-05 12:13:34 (3 weeks ago)	Blocked by UFW (TCP on 443) Source port: 5142 TTL: 43 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 443) Source port: 5142 TTL: 43 Packet length: 60 TOS: 0x08 This report (for 106.75.147.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 xmission.com	2026-07-05 03:07:03 (3 weeks ago)	Blocked by UFW (TCP on 80) Source port: 50132 TTL: 43 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 50132 TTL: 43 Packet length: 60 TOS: 0x08 This report (for 106.75.147.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 xmission.com	2026-07-04 07:11:43 (3 weeks ago)	Blocked by UFW (TCP on 80) Source port: 46882 TTL: 43 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 80) Source port: 46882 TTL: 43 Packet length: 60 TOS: 0x08 This report (for 106.75.147.172) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇬🇧 UKFast Security	2021-08-27 19:52:22 (4 years ago)	WordPress XML RPC POST Brute Force Attack	Web App Attack
Anonymous	2021-08-27 18:21:17 (4 years ago)	POST_FAIL on WP_XMLRPC, BF_DETECTED	Hacking Brute-Force Web App Attack
🇨🇦 Lagserv.com	2021-08-27 14:15:02 (4 years ago)	XMLRPC brute force	Web Spam Blog Spam Brute-Force Web App Attack
🇺🇸 SleepyHosting	2021-08-27 14:01:51 (4 years ago)	(mod_security) mod_security (id:400010) triggered by 106.75.147.172 (CN/China/-): 5 in the last 3600 ... show more (mod_security) mod_security (id:400010) triggered by 106.75.147.172 (CN/China/-): 5 in the last 3600 secs show less	Brute-Force
🇩🇪 OiledAmoeba	2021-08-27 10:33:40 (4 years ago)	Aug 27 16:33:39 wordpress wordpress(www.ruhnke.cloud)[19683]: Blocked authentication attempt for adm ... show more Aug 27 16:33:39 wordpress wordpress(www.ruhnke.cloud)[19683]: Blocked authentication attempt for admin from 106.75.147.172 show less	Hacking Brute-Force Web App Attack

Showing 1 to 15 of 274 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 115.190.203.247

🇺🇿 62.164.148.87

🇬🇧 35.203.210.33

🇨🇳 218.61.251.3

🇦🇿 188.253.208.163

🇳🇱 172.94.9.229

🇫🇷 104.29.151.66

🇧🇬 79.124.59.78

🇧🇷 45.187.174.180

🇳🇱 45.148.10.157

🇳🇱 45.148.10.151

🇲🇿 197.219.210.94

🇩🇪 194.187.176.214

🇵🇪 190.223.60.209

🇨🇴 190.99.153.254

🇮🇶 169.224.70.228

🇨🇳 114.104.153.51

🇹🇷 94.154.43.146

🇱🇹 84.15.181.228

🇱🇹 62.60.130.228