JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 106.75.148.180

106.75.148.180 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 54%: ?

54%

ISP	Shanghai UCloud Information Technology Company Limited
Usage Type	Fixed Line ISP
ASN	AS58466
Hostname(s)	sender0050.lwq22.cn
Domain Name	ucloud.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 106.75.148.180

Whois 106.75.148.180

IP Abuse Reports for 106.75.148.180:

This IP address has been reported a total of 16 times from 12 distinct sources. 106.75.148.180 was first reported on July 3rd 2026, and the most recent report was 17 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-07-30 02:06:56 (17 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.l ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.lwq22.cn): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 aks4226	2026-07-29 16:01:18 (1 day ago)	Attacking common web applications. (n01)	Web App Attack
🇵🇱 Budyn	2026-07-28 00:14:13 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: URI: / \| UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇫🇷 masterguru	2026-07-27 10:58:19 (3 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.l ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.lwq22.cn): 2 in the last 3600 secs (0-196) show less	Hacking
🇫🇷 masterguru	2026-07-27 04:02:53 (3 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.l ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.lwq22.cn): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 Epimetheus	2026-07-24 22:54:29 (5 days ago)	Unauthorized access attempts: [GET] / UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, ... show more Unauthorized access attempts: [GET] / UA: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 show less	Web App Attack
🇦🇺 FireGuard Server	2026-07-24 12:00:07 (6 days ago)	Blocked by os-abuseipdb; 10 hits, proto=tcp, ports=443	Port Scan Hacking
🇫🇷 masterguru	2026-07-24 05:39:28 (6 days ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.l ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.lwq22.cn): 1 in the last 3600 secs (0-195) show less	Hacking
🇫🇷 masterguru	2026-07-23 01:08:22 (1 week ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.l ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 106.75.148.180 (CN/China/sender0050.lwq22.cn): 2 in the last 3600 secs (0-196) show less	Hacking
🇨🇦 Blinker73	2026-07-23 00:10:16 (1 week ago)	2026-07-22T20:10 kernel: OUT= SRC=106.75.148.180 LEN=60 TOS=0x00 PREC=0x00 TTL=36 ID=8005 DF P ... show more 2026-07-22T20:10 kernel: OUT= SRC=106.75.148.180 LEN=60 TOS=0x00 PREC=0x00 TTL=36 ID=8005 DF PROTO=TCP SPT=65254 DPT=82 WINDOW=1412 RES=0x00 SYN URGP=0 2026-07-22T20:10 kernel: OUT= SRC=106.75.148.180 LEN=60 TOS=0x00 PREC=0x00 TTL=36 ID=8006 DF PROTO=TCP SPT=65254 DPT=82 WINDOW=1412 RES=0x00 SYN URGP=0 2026-07-22T20:10 kernel: OUT= SRC=106.75.148.180 LEN=60 TOS=0x00 PREC=0x00 TTL=36 ID=8007 DF PROTO=TCP SPT=65254 DPT=82 WINDOW=1412 RES=0x00 SYN URGP= show less	Port Scan
🇦🇺 paulshipley.com.au	2026-07-14 23:25:55 (2 weeks ago)	[Wed Jul 15 09:25:54.572846 2026] [security2:error] [pid 303642] [client 106.75.148.180:39598] [clie ... show more [Wed Jul 15 09:25:54.572846 2026] [security2:error] [pid 303642] [client 106.75.148.180:39598] [client 106.75.148.180] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/"] [unique_id "albFgiEArHo_Y1_i5r-wywAAAAs"] ... show less	Web App Attack
🇨🇦 dispensight	2026-07-12 13:04:29 (2 weeks ago)	SecureLeaf CTI: recon path (ngrok-tagged). 1 req against help.dispensight.cloud (e.g. /favicon.ico). ... show more SecureLeaf CTI: recon path (ngrok-tagged). 1 req against help.dispensight.cloud (e.g. /favicon.ico). Defensive report; verified infra. show less	Port Scan
🇺🇸 HamSammich	2026-07-07 08:00:44 (3 weeks ago)	Automated sensor: 2 HTTP connection/probe attempts on port(s) 80 over the last 24h (latest 2026-07-0 ... show more Automated sensor: 2 HTTP connection/probe attempts on port(s) 80 over the last 24h (latest 2026-07-07T08:00Z). show less	Brute-Force Web App Attack
Anonymous	2026-07-05 15:14:14 (3 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇮🇩 hermawan	2026-07-03 20:23:54 (3 weeks ago)	[Sat Jul 04 03:23:49.208452 2026] [security2:error] [pid 593854:tid 140643648091840] [client 106.75. ... show more [Sat Jul 04 03:23:49.208452 2026] [security2:error] [pid 593854:tid 140643648091840] [client 106.75.148.180:13058] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "utf-8" at REQUEST_HEADERS:Accept-Charset. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "380"] [id "440015"] [msg "Bot Accept-Charset utf-8"] [data "Matched Data: utf-8 found within REQUEST_HEADERS:Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3 request_line = GET / HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "akgaVeEuCpDgW8hc88jknAABFgw"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[593882] [89O0s/p8mEo] [akgaVeEuCpDgW8hc88jknAABFgw] keep_alive=[1] [2026-07-04 03:23:49.208464] [R:akgaVeEuCpDgW8hc88jknAABFgw] UA:'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'text/html,application/xhtml+xml,application/xml;q=0.9 ... show less	Email Spam Hacking

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 20.199.183.73

🇺🇸 2a09:bac1:76e0:1048::11:1b1

🇩🇪 213.209.159.108

🇵🇱 194.180.48.31

🇧🇷 191.240.98.163

🇧🇷 167.250.160.139

🇨🇳 123.245.84.87

🇵🇭 119.92.76.210

🇨🇳 118.196.79.21

🇺🇸 74.94.234.151

🇧🇷 54.20.55.22

🇵🇰 39.35.229.177

🇩🇪 3.69.148.159

🇨🇳 218.23.95.14

🇨🇳 182.138.158.23

🇮🇩 182.13.96.107

🇵🇭 154.18.197.35

🇺🇸 136.108.44.153

🇨🇳 123.245.84.112

🇨🇳 117.15.88.76