JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 123.6.49.16

123.6.49.16 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 74%: ?

74%

ISP	China Unicom Henan province network
Usage Type	Fixed Line ISP
ASN	AS4837
Hostname(s)	hn.kd.ny.adsl
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Zhengzhou, Henan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 123.6.49.16

Whois 123.6.49.16

IP Abuse Reports for 123.6.49.16:

This IP address has been reported a total of 28 times from 20 distinct sources. 123.6.49.16 was first reported on July 13th 2026, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇺 Mga Admin	2026-09-01 22:20:12 (15 hours ago)	[Wed Sep 02 05:20:11.596930 2026] [authz_core:error] [pid 2970424:tid 2970540] [client 123.6.49.16:1 ... show more [Wed Sep 02 05:20:11.596930 2026] [authz_core:error] [pid 2970424:tid 2970540] [client 123.6.49.16:18913] AH01630: client denied by server configuration: /etc/httpd/htdocs ... show less	Web App Attack
🇺🇸 cwytech	2026-09-01 12:57:45 (1 day ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.	Bad Web Bot Web App Attack
🇺🇸 nodepile	2026-08-31 21:52:34 (1 day ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/ ua='Mozilla/5.0 (Linux; An ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/ ua='Mozilla/5.0 (Linux; Android 11; CPH2185) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36') show less	Web App Attack Exploited Host
🇨🇿 ddw	2026-08-30 13:55:36 (2 days ago)	Access Violation Attempts - Multiple 403 Forbidden responses.	Hacking Bad Web Bot Web App Attack
🇦🇺 Bay13	2026-08-30 05:07:25 (3 days ago)	CrowdSec:custom/http-probing	Web App Attack
🇵🇱 Budyn	2026-08-29 18:57:50 (3 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: jira.sweetpuddingtrap.online \| URI: /backup.sql \| UA: Mozilla/5.0 (Linux; Android 11; V2055A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Mobile Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-08-29 11:54:18 (4 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: www.dont-eat-the-pudding.xyz \| URI: /backup.sql \| UA: Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36 \| BODY: [Empty / GET Request] show less	Hacking Web App Attack
🇬🇷 setupgr	2026-08-29 04:58:37 (4 days ago)	(mod_security) mod_security (id:100011) triggered by 123.6.49.16 (CN/China/Henan/Zhengzhou/-/[AS4837 ... show more (mod_security) mod_security (id:100011) triggered by 123.6.49.16 (CN/China/Henan/Zhengzhou/-/[AS4837 CHINA169-BACKBONE CHINA UNICOM China169 Backbone]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Aug 29 07:58:32.597279 2026] [security2:error] [pid 156892:tid 156944] [client 123.6.49.16:56391] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "CN" at GEO:COUNTRY_CODE. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "62"] [id "100011"] [msg "Traffic from CN/SG blocked for ftiaxtomonosou.gr"] [hostname "ftiaxtomonosou.gr"] [uri "/"] [unique_id "apJm-Cnzwn9qihpQGgO4jQAAAAo"] show less	Port Scan
🇺🇸 cwytech	2026-08-28 07:24:34 (5 days ago)	Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.	Bad Web Bot Web App Attack
🇵🇱 Budyn	2026-08-22 10:10:33 (1 week ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.definitelynotahoneypot.top \| URI: /.env \| UA: Mozilla/5.0 (Linux; Android 10; HUAWEI P30 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.105 Mobile Safari/537.36 \| BODY: [Empty / GET Request] show less	Bad Web Bot Web App Attack
🇩🇪 klaus_ph	2026-08-20 04:07:59 (1 week ago)	123.6.49.16 - - [19/Aug/2026:02:52:56 +0200] "GET /favicon.ico HTTP/1.1" 404 448 "-" "Mozilla/5.0 (W ... show more 123.6.49.16 - - [19/Aug/2026:02:52:56 +0200] "GET /favicon.ico HTTP/1.1" 404 448 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.3904.108 Safari/537.36" ... show less	Bad Web Bot
🇦🇺 FireGuard Server	2026-08-18 02:45:19 (2 weeks ago)	Blocked by os-abuseipdb; 3 hits, proto=tcp, ports=443	Port Scan Hacking
🇮🇪 Coolnagour	2026-08-18 02:10:32 (2 weeks ago)	bot entered honeypot	Web App Attack
🇨🇳 primal	2026-08-15 15:24:01 (2 weeks ago)	Automated attack traffic against a WordPress site: automated bot traffic, failed JavaScript challeng ... show more Automated attack traffic against a WordPress site: automated bot traffic, failed JavaScript challenge at CDN edge (1x). Blocked by CDN/WAF/application security layers. Total 1 hits in last 30 days. show less	Bad Web Bot
🇺🇸 ambor	2026-08-14 10:58:54 (2 weeks ago)	Honeypot access: Web shell access attempt. Path: /cmd.php	Hacking Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 172.71.134.91

🇷🇺 62.152.59.17

🇺🇸 34.228.104.231

🇸🇬 8.222.222.43

🇮🇷 5.237.112.250

🇷🇴 193.32.162.84

🇭🇰 154.83.15.101

🇧🇩 103.30.29.202

🇨🇦 85.217.149.68

🇧🇬 79.124.62.218

🇸🇬 47.84.116.158

🇸🇬 47.84.99.194

🇳🇱 45.148.10.157

🇸🇬 8.219.230.44

🇷🇺 5.165.146.194

🇩🇪 5.100.16.36

🇻🇳 160.250.181.123

🇳🇬 102.91.93.116

🇵🇰 101.53.233.46

🇫🇷 91.231.89.233