JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

43.152.240.193

Recent Activity

Abuse Confidence Score

100% Critical

31 reports

26 reporters · latest 20 hours ago

ISP: Tencent Building, Kejizhongyi Avenue
Usage Type: Data Center/Web Hosting/Transit
ASN: AS132203
Domain Name: tencent.com
Country: 🇹🇭 Thailand
City: Bangkok, Bangkok

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Example preview

Account required for the enhanced features Log in Sign up

Abuse Reports

Export reports CSV

Total reports

31 from 26 distinct reporters

First reported

November 5th 2026

Most recent report

20 hours ago

Last 60 days

Top reporter locations 🇩🇪 Germany 7 🇳🇱 Netherlands 5 🇺🇸 United States of America 5

Most common categories Web App Attack 26 Brute-Force 10 Bad Web Bot 8 Hacking 6 SSH 3

Recent reports We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 konseptit	2026-11-12 18:56:47 UTC · (20 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 43.152.240.193 (TH/Thailand/-)	SQL Injection
🇩🇪 updown.io	2026-11-12 12:31:39 UTC · (1 day ago)	{"level":"info","ts":1794486697.8113687,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"43.152.240.193","remote_port":"49352","client_ip":"43.152.240.193","proto":"HTTP/1.1","method":"GET","host":"ifrc.monitoring.hrenk ... show more {"level":"info","ts":1794486697.8113687,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"43.152.240.193","remote_port":"49352","client_ip":"43.152.240.193","proto":"HTTP/1.1","method":"GET","host":"ifrc.monitoring.hrenko.hu","uri":"/client/.env","headers":{"Connection":["keep-alive"],"Next-Action":["x"],"X-Nextjs-Request-Id":["a7ff2716"],"Cookie":["REDACTED"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"Accept-Encoding":["gzip, deflate"],"Accept":["/"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"ifrc.monitoring.hrenko.hu","ech":false}},"bytes_read":0,"user_id":"","duration":0.016264931,"size":1364,"status":401,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Status":["401 Unauthorized"],"Strict-Transport-Security":["max-age=63072000"],"Feature-Policy":["camera 'none'; microphone 'none'; usb 'none'; autoplay 'none'"],"Content-S ... show less	DDoS Attack Web App Attack
🇩🇪 big-cloud.nl	2026-11-12 08:35:57 UTC · (1 day ago)	Try to access /.git/config	Web App Attack
🇵🇱 Budyn	2026-11-12 04:06:24 UTC · (1 day ago)	[Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: idp.budyn.top \| Path: /.git/config \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 ... show more [Budyn Honeypot Sinkhole] \| Attack type: CRITICAL: ModSecurity WAF Exploit Block \| Summary: Request triggered an emulated security trap. \| Evidence: \| Host: idp.budyn.top \| Path: /.git/config \| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 \| Request: [Empty / GET Request] show less	Hacking Web App Attack
🇫🇷 Zundapper	2026-11-11 19:22:27 UTC · (1 day ago)	43.152.240.193 - - [11/Nov/2026:20:22:23 +0100] "GET /phpinfo HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 43.152.240.193 - - [11/Nov/2026:20:22:25 +0100] "GET /info HTT ... show more 43.152.240.193 - - [11/Nov/2026:20:22:23 +0100] "GET /phpinfo HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 43.152.240.193 - - [11/Nov/2026:20:22:25 +0100] "GET /info HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 43.152.240.193 - - [11/Nov/2026:20:22:26 +0100] "GET /_profiler/phpinfo HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 43.152.240.193 - - [11/Nov/2026:20:22:26 +0100] "GET /_environment HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 43.152.240.193 - - [11/Nov/2026:20:22:26 +0100] "GET /webroot/index.php/_environment HTTP/1.1" 404 178 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Web App Attack Port Scan
🇧🇷 ICS Labs	2026-11-11 17:16:20 UTC · (1 day ago)	ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-11 UTC.	Brute-Force
🇧🇪 cmbplf	2026-11-11 07:29:18 UTC · (2 days ago)	206 requests with url.path *.env	Brute-Force Bad Web Bot
Anonymous	2026-11-11 04:13:27 UTC · (2 days ago)	ICONZDE WEBEXPLOIT 43.152.240.193 (43.152.240.193)	Web App Attack
🇺🇸 borgsquared	2026-11-11 02:56:45 UTC · (2 days ago)	43.152.240.193 - - [11/Nov/2026:02:56:34 +0000] "POST / HTTP/1.1" 404 140 "-" "-" 8497 "immich@docker" "http://172.19.0.3:2283" 20ms 43.152.240.193 - - [11/Nov/2026:02:56:34 +0000] "POST / HTTP/1.1" 404 140 "-" "-" 8498 "immich@docker" "http://172.19 ... show more 43.152.240.193 - - [11/Nov/2026:02:56:34 +0000] "POST / HTTP/1.1" 404 140 "-" "-" 8497 "immich@docker" "http://172.19.0.3:2283" 20ms 43.152.240.193 - - [11/Nov/2026:02:56:34 +0000] "POST / HTTP/1.1" 404 140 "-" "-" 8498 "immich@docker" "http://172.19.0.3:2283" 3ms 43.152.240.193 - - [11/Nov/2026:02:56:35 +0000] "POST / HTTP/1.1" 404 140 "-" "-" 8499 "immich@docker" "http://172.19.0.3:2283" 3ms 43.152.240.193 - - [11/Nov/2026:02:56:35 +0000] "POST / HTTP/1.1" 404 140 "-" "-" 8501 "immich@docker" "http://172.19.0.3:2283" 35ms 43.152.240.193 - - [11/Nov/2026:02:56:44 +0000] "GET /api/.env HTTP/1.1" 404 34 "-" "-" 8528 "immich@docker" "http://172.19.0.3:2283" 4ms ... show less	Brute-Force Web App Attack
🇩🇪 Mr-Money	2026-11-11 00:18:52 UTC · (2 days ago)	scenario: crowdsecurity/http-sensitive-files - events: 5	Web App Attack Hacking
🇩🇪 ghostwarriors	2026-11-10 19:20:20 UTC · (2 days ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇺🇸 Vano Ganzzz	2026-11-10 01:55:10 UTC · (3 days ago)	Triggered Cloudflare WAF (firewallManaged) from TH. Action taken: BLOCK ASN: 132203 (Tencent Building, Kejizhongyi Avenue) Protocol: HTTP/1.1 (POST method) Endpoint: / Timestamp: 2026-11-10T01:55:10Z Ray ID: a5816ef9bc9ba583 UA: Mozilla/5.0 (X11; Lin ... show more Triggered Cloudflare WAF (firewallManaged) from TH. Action taken: BLOCK ASN: 132203 (Tencent Building, Kejizhongyi Avenue) Protocol: HTTP/1.1 (POST method) Endpoint: / Timestamp: 2026-11-10T01:55:10Z Ray ID: a5816ef9bc9ba583 UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Bad Web Bot
🇩🇪 seal	2026-11-09 23:29:40 UTC · (3 days ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	SSH Brute-Force
🇿🇦 conure.sh	2026-11-09 12:14:46 UTC · (4 days ago)	csagent: score 20.5: secrets grab x2, 404 noise floor x2; 1 domain(s) in 1s	Web App Attack
🇩🇪 Florian Warncke	2026-11-08 20:30:55 UTC · (4 days ago)	Web attack: requested known exploit path (GET /.git/config) - automated report, Wazuh SIEM	Hacking Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇸 188.215.100.20

🇫🇷 185.194.178.73

🇮🇷 178.131.106.234

🇧🇷 177.8.26.243

🇱🇹 141.98.11.26

🇺🇸 109.105.210.105

🇳🇱 77.67.26.182

🇺🇸 71.129.101.59

🇳🇱 45.148.10.152

🇬🇧 35.203.210.219

🇵🇹 31.22.141.205

🇨🇦 2607:f8b0:4020:c07::125

🇳🇱 204.76.203.221

🇬🇧 195.206.182.211

🇮🇳 182.75.227.178

🇺🇸 172.190.104.231

🇺🇸 48.217.235.22

🇵🇱 45.138.12.215

🇬🇧 35.203.210.190

🇧🇪 34.38.141.52