JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 124.221.197.5

124.221.197.5 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 86%: ?

86%

ISP	Tencent cloud computing (Beijing) Co., Ltd.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS45090
Domain Name	tencentcloud.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 124.221.197.5

Whois 124.221.197.5

IP Abuse Reports for 124.221.197.5:

This IP address has been reported a total of 19 times from 14 distinct sources. 124.221.197.5 was first reported on September 15th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 masterguru	2026-09-16 08:05:31 (1 hour ago)	URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ... show more URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-197) show less	Hacking
🇺🇸 TPI-Abuse	2026-09-16 07:57:56 (1 hour ago)	(mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 03:57:51.012179 2026] [security2:error] [pid 13605:tid 13605] [client 124.221.197.5:41710] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crr-construction.com"] [uri "/wp-config.php.bak"] [unique_id "aqpL_zGQxldw254NtX0JHwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 masterguru	2026-09-16 07:11:20 (2 hours ago)	(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 124.221.197.5 (CN/China/-): 1 in the ... show more (modsec_5080) ModSec 5080: Infrastructure subdomain probe from 124.221.197.5 (CN/China/-): 1 in the last 3600 secs (0-195) show less	Hacking
🇺🇸 TPI-Abuse	2026-09-16 06:52:16 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 02:52:09.266167 2026] [security2:error] [pid 17853:tid 17853] [client 124.221.197.5:49582] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "staben.com"] [uri "/wp-config.php.bak"] [unique_id "aqo8mQH7bzVnBsQoPxZMWwAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 S.O.B.A. Dev.	2026-09-16 06:43:49 (2 hours ago)	Web vulnerability scanning	Brute-Force Web Spam Web App Attack
🇩🇪 raph	2026-09-16 06:16:19 (3 hours ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
Anonymous	2026-09-16 05:16:03 (4 hours ago)	Bot / scanning and/or hacking attempts: GET /wp-config.php~ HTTP/1.1	Hacking Web App Attack
🇫🇮 as211431.net	2026-09-16 05:02:18 (4 hours ago)	Triggered Cloudflare WAF (linkMaze) from CN. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (GE ... show more Triggered Cloudflare WAF (linkMaze) from CN. Action taken: LINK_MAZE_INJECTED Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-09-16 04:52:53 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 16 00:52:46.147310 2026] [security2:error] [pid 29291:tid 29374] [client 124.221.197.5:49770] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nimbll.com"] [uri "/wp-config.php.bak"] [unique_id "aqognhbu-exM7JRFiNHCQwAAAcQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 taivas.nl	2026-09-16 04:34:17 (4 hours ago)	Many_bad_calls	Web App Attack
🇺🇸 TAY	2026-09-16 04:30:27 (4 hours ago)	124.221.197.5 - - [16/Sep/2026:12:29:10 +0800] "GET /wp-config.php.save HTTP/1.1" 404 54966 "-" "Moz ... show more 124.221.197.5 - - [16/Sep/2026:12:29:10 +0800] "GET /wp-config.php.save HTTP/1.1" 404 54966 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 124.221.197.5 - - [16/Sep/2026:12:29:29 +0800] "GET /wp-config.php.swp HTTP/1.1" 404 54943 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 124.221.197.5 - - [16/Sep/2026:12:29:45 +0800] "GET /wp-config.php.old HTTP/1.1" 404 54965 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 124.221.197.5 - - [16/Sep/2026:12:30:08 +0800] "GET /wp-config.php.orig HTTP/1.1" 404 54966 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" 124.221.197.5 - - [16/Sep/2026:12:30:17 +0800] "GET /wp-config.php.txt HTTP/1.1" 404 54943 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTM ... show less	Brute-Force
🇺🇸 mnsf	2026-09-16 04:05:10 (5 hours ago)	Abuse Detected (9)	Brute-Force Web App Attack
🇬🇧 consul.to	2026-09-16 03:36:53 (5 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇿🇦 conure.sh	2026-09-16 02:59:47 (6 hours ago)	csagent: score 20.2: wp-config backup grab x2, 404 noise floor x2; 1 domain(s) in 5s	Web App Attack
🇺🇸 TPI-Abuse	2026-09-16 02:56:57 (6 hours ago)	(mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 124.221.197.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 22:56:47.850718 2026] [security2:error] [pid 27668:tid 27689] [client 124.221.197.5:60032] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mtiminis.com"] [uri "/wp-config.php.bak"] [unique_id "aqoFb5i_9Bx7D4WNUnBH4AAAAEs"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇮 147.185.133.32

🇺🇸 34.182.196.36

🇳🇱 185.242.226.61

🇳🇵 182.93.95.214

🇧🇷 177.126.90.235

🇯🇵 161.33.202.176

🇧🇷 43.164.194.198

🇺🇸 18.116.202.141

🇵🇱 194.180.49.216

🇹🇷 159.146.52.83

🇪🇬 156.221.133.58

🇮🇳 152.58.122.2

🇪🇸 137.101.6.144

🇺🇸 100.29.192.16

🇸🇬 47.84.144.173

🇩🇿 41.98.237.140

🇳🇱 34.147.88.45

🇵🇱 34.118.58.142

🇮🇪 20.13.164.162

🇹🇷 5.27.25.57