JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 152.32.175.134

152.32.175.134 was found in our database!

This IP was reported 2 times. Confidence of Abuse is 0%: ?

ISP	UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
Usage Type	Data Center/Web Hosting/Transit
ASN	AS135377
Domain Name	ucloud.cn
Country	🇭🇰 Hong Kong
City	Hong Kong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 152.32.175.134

Whois 152.32.175.134

IP Abuse Reports for 152.32.175.134:

This IP address has been reported a total of 2 times from 1 distinct source. 152.32.175.134 was first reported on April 6th 2026, and the most recent report was 2 months ago.

Old Reports: The most recent abuse report for this IP address is from 2 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ihatescambodians	2026-04-06 18:11:00 (2 months ago)	Confirmed active phishing infrastructure hosted on this IP. The server responds on port 9999 with ... show more Confirmed active phishing infrastructure hosted on this IP. The server responds on port 9999 with a working endpoint used for credential harvesting: http://152.32.175.134:9999/users/sign_in Behavior indicates this is a backend component of a phishing operation rather than a simple static page. The host returns HTTP 200 responses and is actively serving malicious login interfaces. show less	Web App Attack Phishing
🇺🇸 ihatescambodians	2026-04-06 16:46:00 (2 months ago)	Confirmed phishing and C2 infrastructure. - Active phishing backend observed: http://152.32.175. ... show more Confirmed phishing and C2 infrastructure. - Active phishing backend observed: http://152.32.175.134:9999/users/sign_in (HTTP 200) - Response headers indicate active application backend: Server: nginx Set-Cookie: _gitlab_session X-Gitlab-Meta present - Network traffic evidence shows CONNECT tunnel activity: 17.23.18.34:443 (proxy-style communication) - Associated with coordinated malicious cluster across subnet: 154.85.56.0/21 (previously 154.85.60.0/24) - Reused SSH fingerprint across nodes indicates centralized control. - Infrastructure used for impersonation phishing (government services) and potential banking trojan delivery. This is not a single compromised host but part of an organized C2 cluster. show less	Phishing Hacking

Showing 1 to 2 of 2 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇭 209.99.189.174

🇺🇸 132.196.99.64

🇨🇳 106.75.163.239

🇲🇲 103.59.163.133

🇬🇧 45.82.76.127

🇬🇧 209.97.183.43

🇧🇷 205.210.31.253

🇺🇸 205.210.31.106

🇹🇷 185.67.33.193

🇮🇩 182.8.225.218

🇧🇷 177.125.163.247

🇨🇮 160.154.84.190

🇨🇳 115.190.203.239

🇨🇳 106.58.173.254

🇯🇵 92.113.142.203

🇱🇹 81.30.98.62

🇸🇬 43.156.239.194

🇧🇷 205.210.31.212

🇷🇴 193.46.255.86

🇮🇶 185.166.25.150