JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 150.109.156.56

150.109.156.56 was found in our database!

This IP was reported 21 times. Confidence of Abuse is 32%: ?

32%

ISP	Tencent Building, Kejizhongyi Avenue
Usage Type	Data Center/Web Hosting/Transit
ASN	AS132203
Domain Name	tencent.com
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 150.109.156.56

Whois 150.109.156.56

IP Abuse Reports for 150.109.156.56:

This IP address has been reported a total of 21 times from 18 distinct sources. 150.109.156.56 was first reported on April 26th 2026, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 Dustin2398	2026-04-29 21:44:00 (1 month ago)	IPS Alert 1: Attempted Administrator Privilege Gain. Signature ET EXPLOIT Apache HTTP Server 2.4.49 ... show more IPS Alert 1: Attempted Administrator Privilege Gain. Signature ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2. From: 150.109.156.56:56304 protocol: TCP show less	Hacking
🇦🇹 urnilxfgbez	2026-04-27 22:45:00 (1 month ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
🇨🇿 lp	2026-04-27 12:18:41 (1 month ago)	SSH Brute force: 39 attempts were recorded from 150.109.156.56 2026-04-27T12:58:21+02:00 Invalid use ... show more SSH Brute force: 39 attempts were recorded from 150.109.156.56 2026-04-27T12:58:21+02:00 Invalid user admin from 150.109.156.56 port 52222 2026-04-27T13:00:04+02:00 Invalid user orangepi from 150.109.156.56 port 46266 2026-04-27T13:02:06+02:00 Connection closed by authenticating user root 150.109.156.56 port 59250 [preauth] 2026-04-27T13:04:05+02:00 Connection closed by authenticating user root 150.109.156.56 port 55208 [preauth] 2026-04-27T13:05:58+02:00 Connection closed by authenticating user root 150.109.156.56 port 50684 [preauth] 2026-04-27T13:08:12+02:00 Connection closed by authenticating user root 150.109.156.56 port 46514 [preauth] 2026-04-27T13:08:58+02:00 Connection closed by authenticating user root 150.109.156.56 port 44746 [preauth] 2026-04-27T13:10:57+02:00 Connection closed by authenticating user root 150.109.156.56 port 55468 [preauth] 2026-04-27T13:13:03+02:00 Invalid show less	Brute-Force SSH
🇺🇸 TPI-Abuse	2026-04-27 01:23:36 (1 month ago)	(mod_security) mod_security (id:218420) triggered by 150.109.156.56 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 150.109.156.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 21:23:28.705943 2026] [security2:error] [pid 4005:tid 4005] [client 150.109.156.56:58564] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.181:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.181"] [uri "/hello.world"] [unique_id "ae66kA5sBoFCsg0Q5KpvNQAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 KPS	2026-04-27 01:08:14 (1 month ago)	PortscanM	Port Scan
🇺🇸 TPI-Abuse	2026-04-26 20:54:04 (1 month ago)	(mod_security) mod_security (id:218420) triggered by 150.109.156.56 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:218420) triggered by 150.109.156.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 16:53:56.510415 2026] [security2:error] [pid 16943:tid 16943] [client 150.109.156.56:41892] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in\|out\|err)\|(in\|out)put\|fd\|memory\|temp\|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found\|\|192.64.150.198:80\|F\|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.198"] [uri "/hello.world"] [unique_id "ae57ZI5Vvyd9ynMaM337eAAAABs"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 mika75	2026-04-26 20:28:39 (1 month ago)	2026-04-26T20:24:32.603126+00:00 ks6.hofud.com sshd[2386539]: Invalid user admin from 150.109.156.56 ... show more 2026-04-26T20:24:32.603126+00:00 ks6.hofud.com sshd[2386539]: Invalid user admin from 150.109.156.56 port 45604 2026-04-26T20:24:33.899305+00:00 ks6.hofud.com sshd[2386539]: Connection closed by invalid user admin 150.109.156.56 port 45604 [preauth] 2026-04-26T20:26:44.301505+00:00 ks6.hofud.com sshd[2386588]: Invalid user orangepi from 150.109.156.56 port 60284 2026-04-26T20:26:49.198635+00:00 ks6.hofud.com sshd[2386588]: Connection closed by invalid user orangepi 150.109.156.56 port 60284 [preauth] 2026-04-26T20:28:38.798268+00:00 ks6.hofud.com sshd[2386717]: Connection closed by authenticating user root 150.109.156.56 port 43786 [preauth] ... show less	Brute-Force SSH
🇩🇪 formality	2026-04-26 15:53:17 (1 month ago)	Invalid user admin from 150.109.156.56 port 37866	Brute-Force SSH
🇩🇪 ghostwarriors	2026-04-26 15:50:33 (1 month ago)	Unauthorized connection attempt detected, SSH Brute-Force	Brute-Force Port Scan SSH
🇳🇱 rmvanderspek	2026-04-26 15:50:04 (1 month ago)	SSH Brute-force attempt detected.	Brute-Force SSH
🇩🇪 www.fransveldman.world	2026-04-26 15:44:54 (1 month ago)	Apr 26 15:35:20 mail sshd[2780085]: Invalid user admin from 150.109.156.56 port 58194 Apr 26 15:44:5 ... show more Apr 26 15:35:20 mail sshd[2780085]: Invalid user admin from 150.109.156.56 port 58194 Apr 26 15:44:54 mail sshd[2781277]: Invalid user orangepi from 150.109.156.56 port 50088 ... show less	Brute-Force SSH
🇨🇿 Countryman	2026-04-26 15:42:12 (1 month ago)	IPS detection: Apache.HTTP.Server.cgi-bin.Path.Traversal	Hacking
🇨🇿 Countryman	2026-04-26 15:42:12 (1 month ago)	IPS detection: Apache.HTTP.Server.cgi-bin.Path.Traversal	Hacking
🇨🇿 Countryman	2026-04-26 15:42:12 (1 month ago)	IPS detection: Apache.HTTP.Server.cgi-bin.Path.Traversal	Hacking
🇫🇷 security.rdmc.fr	2026-04-26 15:36:50 (1 month ago)	Port Scan Attack proto:TCP src:61031 dst:23	Port Scan

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 173.244.60.155

🇨🇳 60.188.58.133

🇳🇱 45.148.10.157

🇹🇼 198.235.24.86

🇩🇪 151.243.11.35

🇨🇳 112.41.182.109

🇨🇳 112.25.215.116

🇳🇱 45.148.10.151

🇹🇿 41.93.28.23

🇺🇸 34.135.95.92

🇨🇦 24.122.136.94

🇮🇳 8.231.114.164

🇧🇪 213.219.154.146

🇩🇪 213.209.159.11

🇪🇨 191.99.59.24

🇩🇪 167.94.146.42

🇮🇳 117.203.36.39

🇨🇳 106.75.26.244

🇧🇩 103.134.242.124

🇳🇱 91.92.40.4