JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 43.156.109.74

43.156.109.74 was found in our database!

This IP was reported 20 times. Confidence of Abuse is 91%: ?

91%

ISP	Asia Pacific Network Information Center, Pty. Ltd.
Usage Type	Data Center/Web Hosting/Transit
ASN	AS132203
Domain Name	apnic.net
Country	🇸🇬 Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 43.156.109.74

Whois 43.156.109.74

IP Abuse Reports for 43.156.109.74:

This IP address has been reported a total of 20 times from 18 distinct sources. 43.156.109.74 was first reported on July 17th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇪 AutosOnShow	2026-07-22 13:52:05 (3 hours ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-07-22 13:51:47.081 \|	Web App Attack
🇧🇪 voormedia	2026-07-22 08:47:59 (8 hours ago)	Accessed trap at '/.env'	Web App Attack
🇧🇷 diego	2026-07-21 11:12:26 (1 day ago)	[arem1] 2026-07-21 10:53:33, Client: 43.156.109.74, Protocol: 6, Unauthorized activity to HTTP: GET ... show more [arem1] 2026-07-21 10:53:33, Client: 43.156.109.74, Protocol: 6, Unauthorized activity to HTTP: GET /.passwd-s3fs show less	Web App Attack
🇨🇳 WMK965	2026-07-20 15:25:28 (2 days ago)	43.156.109.74 - - [20/Jul/2026:23:25:23 +0800] "GET /.passwd-s3fs HTTP/2.0" 444 0 "-" "Go-http-clien ... show more 43.156.109.74 - - [20/Jul/2026:23:25:23 +0800] "GET /.passwd-s3fs HTTP/2.0" 444 0 "-" "Go-http-client/2.0" "-" 43.156.109.74 - - [20/Jul/2026:23:25:25 +0800] "GET /.passwd-s3fs HTTP/2.0" 444 0 "-" "Go-http-client/2.0" "-" 43.156.109.74 - - [20/Jul/2026:23:25:25 +0800] "GET /.passwd-s3fs HTTP/2.0" 444 0 "-" "Go-http-client/2.0" "-" show less	Port Scan Web App Attack
🇨🇿 rawnullbyte	2026-07-20 03:26:43 (2 days ago)	🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /.passwd-s3fs 👤 Attacker IP: 43.156 ... show more 🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /.passwd-s3fs 👤 Attacker IP: 43.156.109.74 ⏰ Time: 2026-07-20 03:26:43 📡 User-Agent: Go-http-client/1.1 show less	Web App Attack
🇸🇪 nekopavel	2026-07-20 02:45:31 (2 days ago)	43.156.109.74 - - [20/Jul/2026:04:45:27 +0200]"GET /.env HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-cl ... show more 43.156.109.74 - - [20/Jul/2026:04:45:27 +0200]"GET /.env HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-client/2.0""0.000" "-""Singapore" "SG" 43.156.109.74 - - [20/Jul/2026:04:45:28 +0200]"GET /.env.backup HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-client/2.0""0.000" "-""Singapore" "SG" 43.156.109.74 - - [20/Jul/2026:04:45:30 +0200]"GET /.env.bak HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-client/2.0""0.000" "-""Singapore" "SG" ... show less	Hacking Bad Web Bot Web App Attack
🇩🇪 MBombeck	2026-07-19 23:51:22 (2 days ago)	Fail2Ban/traefik-botsearch on ops-01.bombeck.io: banned after 5 failures	Web App Attack
🇩🇪 crnpekgoz	2026-07-19 20:30:14 (2 days ago)	[Nginx] Risk=75 ASN=132203 (scanner) \| Reported by WardenIPS: https://github.com/msncakma/WardenIPS	Port Scan
🇩🇪 NewWavesApp	2026-07-19 20:26:57 (2 days ago)	(mod_security) mod_security triggered on hostname [redacted] 43.156.109.74 (SG/Singapore/-): (CF_EN ... show more (mod_security) mod_security triggered on hostname [redacted] 43.156.109.74 (SG/Singapore/-): (CF_ENABLE) show less	SQL Injection
🇩🇪 ut-addicted.com	2026-07-19 18:23:34 (2 days ago)	\[Sun Jul 19 20:23:32.781017 2026\] \[:error\] \[pid 22562:tid 139785832212224\] \[client 43.156.109 ... show more \[Sun Jul 19 20:23:32.781017 2026\] \[:error\] \[pid 22562:tid 139785832212224\] \[client 43.156.109.74:47246\] \[client 43.156.109.74\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 8\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/.env"\] \[unique_id "al0WJAL1GQE5hUpi1QJ58AAAAQc"\] show less	Brute-Force Web App Attack
🇩🇪 Hary74656	2026-07-19 17:19:50 (2 days ago)	[Sun Jul 19 19:19:39.238169 2026] [security2:error] [pid 141960:tid 141984] [remote 43.156.109.74:39 ... show more [Sun Jul 19 19:19:39.238169 2026] [security2:error] [pid 141960:tid 141984] [remote 43.156.109.74:39002] [client 43.156.109.74] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "78.46.107.184"] [uri "/.env"] [unique_id "al0HKx8Yx0tH2nH5cyMHvgABKwQ"] [Sun Jul 19 19:19:40.906434 2026] [security2:error] [pid 141960:tid 141985] [remote 43.156.109.74:39002] [client 43.156.109.74] ModSecurity: Access denied with code 403 (phase 2). String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .c ... show less	Web App Attack
🇧🇪 delabiemedia.be	2026-07-19 11:35:50 (3 days ago)	43.156.109.74 - - [19/Jul/2026:13:35:44 +0200] "GET /.passwd-s3fs HTTP/1.1" 404 134 "-" "Go-http-cli ... show more 43.156.109.74 - - [19/Jul/2026:13:35:44 +0200] "GET /.passwd-s3fs HTTP/1.1" 404 134 "-" "Go-http-client/1.1" 43.156.109.74 - - [19/Jul/2026:13:35:45 +0200] "GET /.env HTTP/1.1" 404 134 "-" "Go-http-client/1.1" 43.156.109.74 - - [19/Jul/2026:13:35:47 +0200] "GET /.env.backup HTTP/1.1" 404 134 "-" "Go-http-client/1.1" 43.156.109.74 - - [19/Jul/2026:13:35:48 +0200] "GET /.env.bak HTTP/1.1" 404 134 "-" "Go-http-client/1.1" 43.156.109.74 - - [19/Jul/2026:13:35:49 +0200] "GET /.env.config HTTP/1.1" 404 134 "-" "Go-http-client/1.1" ... show less	Web App Attack
🇫🇷 LRNP	2026-07-19 11:10:02 (3 days ago)	_:443 43.156.109.74 - - [19/Jul/2026:11:09:57 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Go-http-clien ... show more _:443 43.156.109.74 - - [19/Jul/2026:11:09:57 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Go-http-client/1.1" ... show less	Bad Web Bot Web App Attack
🇺🇸 SSP	2026-07-19 02:15:19 (3 days ago)	Automatically generated from firewall_v2 logs on Server_ID: MIAPX1 Category: Port Scan Occurrences ... show more Automatically generated from firewall_v2 logs on Server_ID: MIAPX1 Category: Port Scan Occurrences: 130 Unique Ports: 1 Destination Ports: 443 First Seen: 2026-07-19 01:15 UTC Last Seen: 2026-07-19 01:30 UTC show less	Port Scan
🇮🇩 Diskominfo Lumajang	2026-07-18 18:45:05 (3 days ago)	Security Event Detected by SOC Diskominfo Lumajang: event=alert, hits=3	Brute-Force

Showing 1 to 15 of 20 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 91.231.89.82

🇺🇸 71.230.72.124

🇯🇵 43.165.170.19

🇲🇽 187.154.144.166

🇳🇱 185.242.226.66

🇨🇳 171.104.143.176

🇨🇳 123.58.249.106

🇨🇦 104.207.48.39

🇷🇴 92.118.39.50

🇫🇷 91.167.56.247

🇰🇷 61.32.68.66

🇧🇷 45.238.201.193

🇧🇷 45.188.169.6

🇺🇸 34.197.70.90

🇺🇸 20.119.86.70

🇻🇳 1.52.240.18

🇰🇷 211.223.107.86

🇺🇸 195.184.76.210

🇹🇷 131.222.246.168

🇺🇸 81.30.98.204