JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 124.156.166.29

124.156.166.29 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 28%: ?

28%

ISP	Asia Pacific Network Information Centre
Usage Type	Data Center/Web Hosting/Transit
ASN	AS132203
Domain Name	apnic.net
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 124.156.166.29

Whois 124.156.166.29

IP Abuse Reports for 124.156.166.29:

This IP address has been reported a total of 16 times from 9 distinct sources. 124.156.166.29 was first reported on November 6th 2025, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-07-26 02:14:17 (4 weeks ago)	Authentication failure	Brute-Force
🇺🇸 TPI-Abuse	2026-07-25 23:39:51 (4 weeks ago)	(mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 19:39:45.428989 2026] [security2:error] [pid 1928741:tid 1928741] [client 124.156.166.29:49006] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|jerusalem-temple-today.com\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "jerusalem-temple-today.com"] [uri "/index.php"] [unique_id "amVJQZOKKgTIJQz7R3ZkYQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 21:13:14 (4 weeks ago)	(mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 17:13:10.629796 2026] [security2:error] [pid 1970657:tid 1970657] [client 124.156.166.29:48058] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|homehealth101.com\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "homehealth101.com"] [uri "/php-cgi/php.exe"] [unique_id "amUm5mwsA4F3TKU9aXGKtQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-25 16:32:31 (4 weeks ago)	Failed login attempt detected by Fail2Ban in plesk-postfix jail	Brute-Force
🇺🇸 TPI-Abuse	2026-07-25 15:36:31 (4 weeks ago)	(mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 11:36:24.705767 2026] [security2:error] [pid 31291:tid 31291] [client 124.156.166.29:36304] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|thendco.com\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "thendco.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amTX-GXCPprCo-O85qDV1AAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 14:41:34 (4 weeks ago)	(mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 10:41:28.577167 2026] [security2:error] [pid 18730:tid 18730] [client 124.156.166.29:41154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "38"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|microbooty.com\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "microbooty.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amTLGPFDxsbnr90owsPGBQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-25 14:25:37 (4 weeks ago)	(mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 124.156.166.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 10:25:32.741701 2026] [security2:error] [pid 2159815:tid 2159815] [client 124.156.166.29:45794] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|ahuramazda.com\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "ahuramazda.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "amTHXBrAG4mPUS5tJQMJTgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-07-25 03:07:33 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇮🇩 xveil	2026-07-24 19:33:32 (1 month ago)	2026-07-25T02:33:29.049583 mail-honeypot postfix/submission/smtpd[9090]: warning: unknown[124.156.16 ... show more 2026-07-25T02:33:29.049583 mail-honeypot postfix/submission/smtpd[9090]: warning: unknown[124.156.166.29]: SASL PLAIN authentication failed: authentication failure ... show less	Brute-Force
🇿🇦 hostsec_za	2026-07-24 19:15:02 (1 month ago)	SMTP/IMAP Auth Attack. 36 failed logins in 24 hours.	Brute-Force
Anonymous	2026-07-24 12:28:14 (1 month ago)	Authentication failure	Brute-Force
🇬🇧 openstrike.co.uk	2026-07-24 08:03:47 (1 month ago)	8 packets to port 465	Brute-Force
🇺🇸 soreviv	2026-07-24 03:55:41 (1 month ago)	SMTP (SASL) authentication brute-force attempts detected and blocked by fail2ban.	Email Spam Brute-Force
🇮🇹 VHosting	2026-07-23 19:01:30 (1 month ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇫🇷 Sklurk	2025-11-07 20:10:05 (9 months ago)	Web App Attack	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇱 186.189.107.131

🇹🇷 185.28.62.91

🇷🇴 141.98.83.48

🇧🇷 201.32.72.104

🇪🇨 186.71.245.49

🇫🇷 185.177.72.54

🇺🇸 97.94.69.126

🇫🇷 91.196.152.107

🇮🇷 77.237.73.99

🇺🇸 66.240.223.208

🇵🇱 54.37.235.85

🇵🇪 45.191.99.141

🇨🇴 45.189.235.162

🇺🇸 20.65.194.182

🇳🇱 204.76.203.43

🇳🇱 192.253.248.251

🇦🇷 190.12.114.108

🇮🇹 172.253.12.152

🇮🇩 163.7.8.79

🇬🇧 81.19.219.209