JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 59.36.149.104

59.36.149.104 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 60%: ?

60%

ISP	CHINANET Guangdong province network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 59.36.149.104

Whois 59.36.149.104

IP Abuse Reports for 59.36.149.104:

This IP address has been reported a total of 28 times from 10 distinct sources. 59.36.149.104 was first reported on June 25th 2026, and the most recent report was 2 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-17 11:15:51 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 07:15:45.483841 2026] [security2:error] [pid 716578:tid 716578] [client 59.36.149.104:52479] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "title28.com"] [uri "/.env"] [unique_id "aloO4cxg6Zqy1CWmp1CATwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 10:43:28 (2 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 06:43:22.181485 2026] [security2:error] [pid 11069:tid 11069] [client 59.36.149.104:46785] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "colorwize.com"] [uri "/.env.production"] [unique_id "aloHSsGUacXAN9ZgNLbDSwAAABU"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 09:40:48 (3 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 05:40:14.959903 2026] [security2:error] [pid 586513:tid 586513] [client 59.36.149.104:45788] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "savingspools.com"] [uri "/.env"] [unique_id "aln4friYUSIEf3ZVrHuVIAAAABc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 09:09:16 (4 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 05:09:07.464060 2026] [security2:error] [pid 523256:tid 523256] [client 59.36.149.104:43606] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.psychoatomicpower.theknowledgemaster.com"] [uri "/.env"] [unique_id "alnxM_YOfhI1xlOW8P9j6gAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-07-17 07:40:44 (5 hours ago)	Excessive 404/403 errors	Brute-Force
🇺🇸 TPI-Abuse	2026-07-17 05:44:12 (7 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 01:44:07.532828 2026] [security2:error] [pid 1023608:tid 1023608] [client 59.36.149.104:33624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sub-sea9gas.com"] [uri "/.env.local"] [unique_id "alnBJz-RwnKKmvgM7_2D1wAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 05:10:27 (8 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 01:10:22.039286 2026] [security2:error] [pid 12394:tid 12394] [client 59.36.149.104:47891] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.scottwithers.scottwithers.xyz"] [uri "/.env.test"] [unique_id "alm5PsLtIbCYRI-6F6cUBQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 03:15:08 (10 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 23:15:00.242152 2026] [security2:error] [pid 192417:tid 192422] [client 59.36.149.104:58051] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pflagabq.org"] [uri "/.env"] [unique_id "almeNMMezeqK_9H7akaD2AAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 LRob	2026-07-17 02:01:09 (11 hours ago)	CrowdSec: crowdsecurity/http-probing \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 ... show more CrowdSec: crowdsecurity/http-probing \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran; +https://silvyxran.love; show less	Port Scan Web App Attack
🇩🇪 iNetWorker	2026-07-17 00:23:10 (13 hours ago)	trolling for resource vulnerabilities	Web App Attack
🇮🇹 mediarama.com	2026-07-16 22:39:28 (14 hours ago)	Banned by Fail2Ban	Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 20:04:46 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 16:04:39.243215 2026] [security2:error] [pid 20936:tid 20936] [client 59.36.149.104:36565] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bradmackenzie.com"] [uri "/.env.development"] [unique_id "alk5Vy2y1ur6o5u8WLM41AAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 19:30:43 (17 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 15:30:33.378937 2026] [security2:error] [pid 17540:tid 17540] [client 59.36.149.104:42879] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ontrek.com"] [uri "/backup/.env"] [unique_id "alkxWeooYgJ_J0ufxHk4twAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 18:58:59 (18 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 14:58:55.452724 2026] [security2:error] [pid 792:tid 792] [client 59.36.149.104:33613] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greenmountainfeeds.com"] [uri "/.env.tmp"] [unique_id "alkp726g40M_Q9d9g8iXQQAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 18:26:43 (19 hours ago)	(mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 59.36.149.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 14:26:35.750345 2026] [security2:error] [pid 31857:tid 31857] [client 59.36.149.104:48449] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "djmrmusic.com"] [uri "/app/.env"] [unique_id "alkiW__nKPAQ0YTtu4lD4wAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 193.148.57.33

🇧🇷 181.191.148.134

🇰🇷 180.71.9.31

🇸🇪 171.25.158.74

🇵🇰 144.48.132.102

🇦🇪 2.49.145.212

🇬🇧 194.50.235.136

🇩🇪 193.148.56.148

🇧🇷 191.184.209.186

🇳🇱 185.93.89.79

🇺🇸 184.105.247.204

🇨🇳 180.167.128.202

🇺🇸 104.243.35.45

🇨🇬 102.141.46.210

🇳🇱 91.92.40.37

🇱🇹 45.227.254.170

🇧🇼 41.79.32.206

🇧🇷 20.226.26.5

🇺🇸 2604:a880:400:d1:0:4:a538:9001

🇮🇩 222.124.177.148