AbuseIPDB » 42.81.15.104
42.81.15.104
This IP was reported 10 times. Confidence of
Abuse
is 58% : ?
ISP
CHINANET TIANJIN PROVINCE NETWORK
Usage Type
Fixed Line ISP
ASN
AS58542
Domain Name
chinatelecom.cn
Country
🇨🇳
China
City
Tianjin, Tianjin
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 42.81.15.104 :
This IP address has been reported a total of
10
times from
9 distinct
sources.
42.81.15.104 was first reported on
October 19th 2026 , and the most recent report was
1 day ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇷
ipfyx
2026-10-21 03:10:02
(1 day ago)
Port scanning
Port Scan
🇳🇱
soverin
2026-10-20 05:34:56
(2 days ago)
Network scan on port 443
Email Spam
🇩🇪
DasDuo
2026-10-20 05:04:59
(2 days ago)
Attempt on port 2222 - potential remote access / brute-force attempt. Blocked by firewall (unsolicit ...
show more
Attempt on port 2222 - potential remote access / brute-force attempt. Blocked by firewall (unsolicited inbound, no prior outbound connection).
show less
Port Scan
🇫🇷
ipfyx
2026-10-20 03:10:02
(2 days ago)
Port scanning
Port Scan
🇨🇳
Peter Yu
2026-10-20 02:24:09
(2 days ago)
Bad Web Bot
Web App Attack
2026-10-20 01:04:02
(2 days ago)
Bot / scanning and/or hacking attempts: POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/% ...
show more
Bot / scanning and/or hacking attempts: POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 23:29:02
(2 days ago)
(mod_security) mod_security (id:218420) triggered by 42.81.15.104 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:218420) triggered by 42.81.15.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 19:28:55.148259 2026] [security2:error] [pid 11661:tid 11661] [client 42.81.15.104:33508] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.193:443|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.193"] [uri "/hello.world"] [unique_id "atanty72Oxy5mqce1e0qtAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
iStitch07
2026-10-19 21:53:37
(2 days ago)
[R] SSH Brute-force
Brute-Force
SSH
🇫🇷
security.rdmc.fr
2026-10-19 20:40:54
(2 days ago)
Port Scan Attack proto:TCP src:61705 dst:23
Port Scan
🇺🇸
decisionconcepts
2026-10-19 19:21:31
(2 days ago)
42.81.15.104 - - [19/Oct/2026:12:21:25 -0700] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e ...
show more
42.81.15.104 - - [19/Oct/2026:12:21:25 -0700] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 226 "-" "libredtail-http"
42.81.15.104 - - [19/Oct/2026:12:21:30 -0700] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 226 "-" "libredtail-http"
show less
Brute-Force
SSH
Showing 1 to
10
of 10 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: