JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.20.104.124

157.20.104.124 was found in our database!

This IP was reported 93 times. Confidence of Abuse is 100%: ?

100%

ISP	Kuroit.com
Usage Type	Data Center/Web Hosting/Transit
ASN	AS136557
Hostname(s)	124.104.20.157.sg.kuroit.com
Domain Name	kuroit.com
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.20.104.124

Whois 157.20.104.124

IP Abuse Reports for 157.20.104.124:

This IP address has been reported a total of 93 times from 68 distinct sources. 157.20.104.124 was first reported on August 7th 2026, and the most recent report was 22 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TIScore	2026-08-20 10:59:03 (22 hours ago)	Automated web attack / probing. Signals: WordPress install scan; Unexpected path. Last path: /wp-jso ... show more Automated web attack / probing. Signals: WordPress install scan; Unexpected path. Last path: /wp-json/batch/v1 show less	Hacking Web App Attack
🇩🇪 factor1	2026-08-20 10:29:15 (22 hours ago)	CrowdSec at thor Reports Abuse	Web App Attack
🇪🇸 alferez	2026-08-20 08:32:26 (1 day ago)	wp2shell bug exploit	Hacking Exploited Host Web App Attack
🇩🇪 yvoictra	2026-08-20 07:18:00 (1 day ago)	Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/http-cve-probing	Web App Attack
🇳🇱 Webhoster	2026-08-20 06:51:16 (1 day ago)	{"transaction":{"timestamp":"2026/08/20 06:51:15","unix_timestamp":1787208675315866196,"id":"aWwFKMf ... show more {"transaction":{"timestamp":"2026/08/20 06:51:15","unix_timestamp":1787208675315866196,"id":"aWwFKMfNHpqxTGli","client_ip":"172.16.16.11","client_port":0,"host_ip":"","host_port":0,"server_id":"timvdberg.dev","request":{"method":"POST","protocol":"HTTP/1.1","uri":"/wp-json/batch/v1","http_version":"","headers":{"accept":["application/json"],"accept-encoding":["gzip, br"],"cdn-loop":["cloudflare; loops=1"],"cf-connecting-ip":["157.20.104.124"],"cf-ipcountry":["SG"],"cf-ray":["a2df77e9cc5cb5a9-SIN"],"cf-visitor":["{\"scheme\":\"https\"}"],"content-length":["16"],"content-type":["application/json"],"host":["timvdberg.dev"],"user-agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"],"x-forwarded-for":["157.20.104.124, 104.22.66.246"],"x-forwarded-host":["timvdberg.dev"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["61b1335f2deb"],"x-real-ip":["104.22.66.246"]},"body":"","files":null,"args ... show less	Hacking Web App Attack
🇺🇸 wbsouza	2026-08-20 03:23:55 (1 day ago)	CrowdSec: infra/bad-path-probe — automated firewall drops on self-hosted IDS sensor	Hacking
🇦🇺 afleventoffice.com.au	2026-08-19 20:00:28 (1 day ago)	POST /wp-json/batch/v1 HTTP/1.1	Web App Attack
🇭🇺 miszterx.hu	2026-08-19 10:53:24 (1 day ago)	XORP (haproxy): 2x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_ipt ... show more XORP (haproxy): 2x HTTP 404/403/500 or handshake failure in 24h. Automated report from log_check_iptables_generator.sh (xorp.hu) show less	Web App Attack
Anonymous	2026-08-19 07:07:04 (2 days ago)	Automated web scanner. Requested suspicious paths: /wp-json/batch/v1. UTC: 2026-08-19 06:28:49.	Web App Attack
🇵🇱 sefinek.net	2026-08-19 06:55:19 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from SG. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (G ... show more Triggered Cloudflare WAF (firewallCustom) from SG. Action: MANAGED_CHALLENGE \| Protocol: HTTP/1.1 (GET) \| Endpoint: / \| UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 raph	2026-08-19 05:48:10 (2 days ago)	[Wordpress] crawler /wp-admin/, /wp-content/, etc.	Bad Web Bot Web App Attack
🇩🇪 findlab	2026-08-19 05:00:01 (2 days ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇫🇷 mrcrassi	2026-08-19 04:57:03 (2 days ago)	Triggered Cloudflare WAF (firewallManaged) from SG. Action taken: BLOCK Protocol: HTTP/1.1 (POST met ... show more Triggered Cloudflare WAF (firewallManaged) from SG. Action taken: BLOCK Protocol: HTTP/1.1 (POST method) Endpoint: / UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇩🇪 yvoictra	2026-08-19 04:54:21 (2 days ago)	Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/http-cve-probing	Web App Attack
🇵🇱 Budyn	2026-08-18 22:23:30 (2 days ago)	Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. ... show more Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: nominatim.budyn.wtf \| URI: /wp-json/batch/v1 \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 \| BODY: {"requests": []} show less	Bad Web Bot Web App Attack

Showing 1 to 15 of 93 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇦 194.242.100.88

🇺🇦 188.191.72.182

🇺🇦 78.26.151.191

🇺🇸 47.234.138.49

🇺🇸 34.139.196.66

🇺🇸 24.119.36.250

🇱🇻 5.240.240.167

🇺🇸 3.130.168.2

🇺🇸 2001:470:1:332::180

🇺🇸 195.184.76.195

🇷🇺 176.210.38.213

🇳🇱 160.119.66.51

🇨🇦 85.217.149.66

🇺🇸 47.89.193.63

🇷🇺 46.163.138.154

🇫🇮 45.66.193.247

🇨🇳 36.142.47.38

🇨🇦 35.183.184.164

🇨🇳 27.16.230.185

🇺🇸 20.168.121.1