JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

120.55.44.159

Neutral Activity

Abuse Confidence Score

0% Low Risk

16 reports

14 reporters · latest 11 months ago

ISP: Aliyun Computing Co., LTD
Usage Type: Data Center/Web Hosting/Transit
ASN: AS37963
Domain Name: alibabacloud.com
Country: 🇨🇳 China
City: Hangzhou, Zhejiang

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

120.55.44.159 has been reported 16 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

16 from 14 distinct reporters

First reported

November 21st 2025

Most recent report

11 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Hugopvigo	2025-11-21 21:34:56 UTC · (11 months ago)	"2025-11-21 21:34:56+00:00 120.55.44.159 IP con score alto (86) detectada en el log."	Brute-Force SSH
🇧🇪 sid3windr	2025-11-21 19:55:31 UTC · (11 months ago)	SSH port scan (Tarpitted for 16m50s, wasted 1.84kB)	Port Scan SSH
🇺🇸 xmission.com	2025-11-21 19:26:04 UTC · (11 months ago)	Blocked by UFW (TCP on 2222) Source port: 62382 TTL: 46 Packet length: 40 TOS: 0x08 This report (for 120.55.44.159) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter	Port Scan
🇩🇪 kais-universum.de	2025-11-21 19:05:02 UTC · (11 months ago)	Failed login attempt detected by Fail2Ban in ssh jail	Brute-Force
🇺🇸 TPI-Abuse	2025-11-21 18:50:08 UTC · (11 months ago)	(mod_security) mod_security (id:218420) triggered by 120.55.44.159 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 21 13:50:00.537294 2025] [security2:error] [pid 12675:tid 12675] [client 120.55.44.159:46856] M ... show more (mod_security) mod_security (id:218420) triggered by 120.55.44.159 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 21 13:50:00.537294 2025] [security2:error] [pid 12675:tid 12675] [client 120.55.44.159:46856] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.212:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.212"] [uri "/hello.world"] [unique_id "aSC0WDkXGSBif8CdzJYwfwAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 masterguru	2025-11-21 18:32:00 UTC · (11 months ago)	COMODO WAF: PHP Injection Attack: I/O Stream Found. Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. (218420-124)	Hacking
🇺🇸 TPI-Abuse	2025-11-21 17:02:18 UTC · (11 months ago)	(mod_security) mod_security (id:218420) triggered by 120.55.44.159 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 21 12:02:10.499004 2025] [security2:error] [pid 1621:tid 1621] [client 120.55.44.159:33950] Mod ... show more (mod_security) mod_security (id:218420) triggered by 120.55.44.159 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 21 12:02:10.499004 2025] [security2:error] [pid 1621:tid 1621] [client 120.55.44.159:33950] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.214:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.214"] [uri "/hello.world"] [unique_id "aSCbEiMvRm22VqYqW08XEQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 RAP	2025-11-21 17:00:14 UTC · (11 months ago)	2025-11-21 17:00:14 UTC Unauthorized activity to TCP port 22. SSH	SSH
🇨🇳 Indexyz	2025-11-21 16:28:42 UTC · (11 months ago)	2025-11-22T00:28:09.094570+08:00 hostname sshd-session[342494]: Invalid user test from 120.55.44.159 port 35450 2025-11-22T00:28:20.574496+08:00 hostname sshd-session[342499]: Connection from 120.55.44.159 port 39920 on 10.66.0.230 port 22 rdomai ... show more 2025-11-22T00:28:09.094570+08:00 hostname sshd-session[342494]: Invalid user test from 120.55.44.159 port 35450 2025-11-22T00:28:20.574496+08:00 hostname sshd-session[342499]: Connection from 120.55.44.159 port 39920 on 10.66.0.230 port 22 rdomain "" 2025-11-22T00:28:20.943625+08:00 hostname sshd-session[342499]: Invalid user user from 120.55.44.159 port 39920 2025-11-22T00:28:41.292450+08:00 hostname sshd-session[342503]: Connection from 120.55.44.159 port 41904 on 10.66.0.230 port 22 rdomain "" 2025-11-22T00:28:41.512504+08:00 hostname sshd-session[342503]: Invalid user admin from 120.55.44.159 port 41904 show less	Brute-Force SSH
Anonymous	2025-11-21 16:27:23 UTC · (11 months ago)	Unauthorized connection to SSH port 22	Port Scan SSH
🇩🇪 ps-center	2025-11-21 16:16:56 UTC · (11 months ago)	C2-W: TCP-Scanner. Port: 22	Port Scan
🇺🇸 TPI-Abuse	2025-11-21 16:03:54 UTC · (11 months ago)	(mod_security) mod_security (id:218420) triggered by 120.55.44.159 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 21 11:03:48.929927 2025] [security2:error] [pid 20097:tid 20097] [client 120.55.44.159:38436] M ... show more (mod_security) mod_security (id:218420) triggered by 120.55.44.159 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 21 11:03:48.929927 2025] [security2:error] [pid 20097:tid 20097] [client 120.55.44.159:38436] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.215:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.215"] [uri "/hello.world"] [unique_id "aSCNZFgHS5nq70zRxgjh6wAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 MPL	2025-11-21 16:01:18 UTC · (11 months ago)	tcp ports: 22,2375 (10 or more attempts)	Port Scan
Anonymous	2025-11-21 15:53:24 UTC · (11 months ago)	IM360 WAF: PHP Injection Attack: I/O Stream Found MV:d allow_url_include=1 d auto_prepend_file=php://input	Web App Attack
🇺🇸 r	2025-11-21 15:50:30 UTC · (11 months ago)	Nov 21 15:50:28 vpn sshd[2504796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.55.44.159 Nov 21 15:50:30 vpn sshd[2504796]: Failed password for invalid user admin from 120.55.44.159 port 54878 ssh2 ...	Brute-Force SSH

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇹🇳 196.203.231.220

🇩🇪 193.124.20.244

🇪🇸 82.223.28.157

🇺🇸 52.146.88.12

🇺🇸 34.23.72.18

🇺🇸 17.166.232.14

🇺🇸 209.50.173.44

🇧🇪 198.235.24.254

🇮🇳 172.71.198.102

🇵🇭 122.3.166.158

🇨🇳 115.190.184.184

🇩🇪 69.5.169.48

🇨🇳 61.52.192.227

🇺🇸 50.154.196.186

🇺🇸 48.217.235.22

🇳🇱 45.156.87.34

🇺🇸 45.132.227.248

🇯🇵 43.167.198.92

🇺🇸 18.221.179.104

🇷🇺 5.166.35.202