JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 14.109.228.4

14.109.228.4 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 100%: ?

100%

ISP	CHINANET Chongqing Province Network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	cta.cq.cn
Country	🇨🇳 China
City	Chongqing, Chongqing

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 14.109.228.4

Whois 14.109.228.4

IP Abuse Reports for 14.109.228.4:

This IP address has been reported a total of 28 times from 24 distinct sources. 14.109.228.4 was first reported on July 21st 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-22 01:05:57 (1 hour ago)	(mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 21:05:49.597306 2026] [security2:error] [pid 104200:tid 104200] [client 14.109.228.4:21642] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.53:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.53"] [uri "/hello.world"] [unique_id "amAXbeivS-WwT67Gs_uq6gAAACQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-22 00:50:42 (2 hours ago)	(mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 20:50:35.564589 2026] [security2:error] [pid 98871:tid 98871] [client 14.109.228.4:45897] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.168:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.168"] [uri "/hello.world"] [unique_id "amAT2-eDRCRm5RfyDz8iRQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇷🇺 Selckie	2026-07-22 00:22:35 (2 hours ago)	SSH Brute-Force (triggered by 14.109.228.4)	SSH Brute-Force
🇳🇱 tpjg	2026-07-22 00:17:24 (2 hours ago)	Automated: 15 requests with error status in 120s window from 14.109.228.4. Evidence: /lib/phpunit/ph ... show more Automated: 15 requests with error status in 120s window from 14.109.228.4. Evidence: /lib/phpunit/phpunit/Util/PHP/eval-stdin.php:404,/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/phpunit/Util/PHP/eval-stdin.php:404,/phpunit/src/Util/PHP/eval-stdin.php:404,/phpunit/phpunit/Util/PHP/eval-stdin.php:404,/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/vendor/phpunit/phpunit/LICENSE/eval-stdin.php:404,/vendor/phpunit/Util/PHP/eval-stdin.php:404,/vendor/phpunit/src/Util/PHP/eval-stdin.php:404,/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php:404,/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php:404,/hello.world:404,/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh:404,/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh:404 show less	Web App Attack
🇿🇦 updown.io	2026-07-22 00:05:54 (2 hours ago)	2026-07-22T00:05:10.174667+00:00 cap.updn.io sshd[1753699]: Invalid user orangepi from 14.109.228.4 ... show more 2026-07-22T00:05:10.174667+00:00 cap.updn.io sshd[1753699]: Invalid user orangepi from 14.109.228.4 port 56043 2026-07-22T00:05:10.178891+00:00 cap.updn.io sshd[1753699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.109.228.4 2026-07-22T00:05:12.565044+00:00 cap.updn.io sshd[1753699]: Failed password for invalid user orangepi from 14.109.228.4 port 56043 ssh2 2026-07-22T00:05:52.076478+00:00 cap.updn.io sshd[1755155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.109.228.4 user=root 2026-07-22T00:05:53.559777+00:00 cap.updn.io sshd[1755155]: Failed password for root from 14.109.228.4 port 53808 ssh2 ... show less	Brute-Force SSH
🇦🇹 urnilxfgbez	2026-07-21 22:45:00 (4 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-07-21 22:38:07 (4 hours ago)	Blocked by firewall on hugin [23/tcp] \| Rule: AbuseIPDB \| SPT: 37946 \| TTL: 52 \| LEN: 40 \| TOS: 0x00 ... show more Blocked by firewall on hugin [23/tcp] \| Rule: AbuseIPDB \| SPT: 37946 \| TTL: 52 \| LEN: 40 \| TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan IoT Targeted
🇬🇧 djboddington	2026-07-21 21:57:59 (4 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	Web App Attack Hacking
🇪🇸 yvoictra	2026-07-21 20:29:21 (6 hours ago)	14.109.228.4 - - [21/Jul/2026:22:29:14 +0200] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+aut ... show more 14.109.228.4 - - [21/Jul/2026:22:29:14 +0200] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 162 "-" "libredtail-http" 14.109.228.4 - - [21/Jul/2026:22:29:16 +0200] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "libredtail-http" 14.109.228.4 - - [21/Jul/2026:22:29:17 +0200] "GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "libredtail-http" 14.109.228.4 - - [21/Jul/2026:22:29:18 +0200] "GET /vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "libredtail-http" 14.109.228.4 - - [21/Jul/2026:22:29:20 +0200] "GET /vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 162 "-" "libredtail-http" ... show less	Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 18:20:17 (8 hours ago)	(mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 14:20:09.746167 2026] [security2:error] [pid 7611:tid 7661] [client 14.109.228.4:51720] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.44:443\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.44"] [uri "/hello.world"] [unique_id "al-4WUvhcc9lYkoRq-v8SAAAAcw"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇷 Threat.live	2026-07-21 17:35:02 (9 hours ago)	Threat.live: Brute Force	Brute-Force
🇺🇸 TPI-Abuse	2026-07-21 17:16:42 (9 hours ago)	(mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:218420) triggered by 14.109.228.4 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 13:16:35.777480 2026] [security2:error] [pid 23163:tid 23163] [client 14.109.228.4:29927] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.104:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.104"] [uri "/hello.world"] [unique_id "al-pc8I7BCzpJNiwZVLmqQAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 WMK965	2026-07-21 17:11:36 (9 hours ago)	14.109.228.4 - - [22/Jul/2026:01:11:18 +0800] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e ... show more 14.109.228.4 - - [22/Jul/2026:01:11:18 +0800] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 154 "-" "-" "-" 14.109.228.4 - - [22/Jul/2026:01:11:31 +0800] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 154 "-" "-" "-" 14.109.228.4 - - [22/Jul/2026:01:11:35 +0800] "POST /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 444 0 "-" "libredtail-http" "-" show less	Port Scan Web App Attack
🇵🇱 mkey	2026-07-21 16:40:02 (10 hours ago)	Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS ... show more Verified scan activity detected by local IDS/firewall correlation. SCAN: HIGHRISK_SINGLEPORT \| PORTS=22 \| HITS=2 \| IPSET=ADD \| FIRST=2026-07-21 18:35:01 \| LAST=2026-07-21 18:35:01. Last seen 2026-07-21 18:35:01. show less	Port Scan
🇩🇪 seal	2026-07-21 14:06:29 (12 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-cve-2021-41773	SSH Brute-Force

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.138

🇺🇸 192.155.88.231

🇫🇷 91.196.152.204

🇺🇸 216.255.50.94

🇧🇷 205.210.31.248

🇭🇰 199.45.154.189

🇦🇷 181.45.46.144

🇺🇸 162.216.149.38

🇿🇦 102.217.79.204

🇹🇷 94.154.43.183

🇨🇳 60.166.82.134

🇺🇸 43.153.113.127

🇺🇸 204.217.131.79

🇬🇧 193.32.209.253

🇧🇷 189.35.210.239

🇨🇳 183.62.127.90

🇧🇷 179.34.71.233

🇵🇱 176.53.159.197

🇨🇳 106.75.12.106

🇺🇸 65.49.1.32