JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 109.252.121.152

109.252.121.152 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 81%: ?

81%

ISP	Moscow Local Telephone Network (OAO MGTS)
Usage Type	Fixed Line ISP
ASN	AS25513
Hostname(s)	109-252-121-152.nat.spd-mgts.ru
Domain Name	spd-mgts.ru
Country	🇷🇺 Russian Federation
City	Moscow, Moscow

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 109.252.121.152

Whois 109.252.121.152

IP Abuse Reports for 109.252.121.152:

This IP address has been reported a total of 36 times from 15 distinct sources. 109.252.121.152 was first reported on August 24th 2026, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Site.eu	2026-08-31 01:52:37 (3 hours ago)	Excessive multi-domain requests	Brute-Force
🇫🇷 Stara	2026-08-30 22:57:28 (6 hours ago)	Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kinesk ... show more Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kineskinja) show less	Hacking Brute-Force Web App Attack
🇳🇱 pixelXp	2026-08-30 18:43:09 (11 hours ago)	Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 de ... show more Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: Array - show less	Web Spam
🇳🇱 WeCloudit-Anti-Abuse	2026-08-30 14:36:01 (15 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-probing	Web App Attack Hacking
🇧🇾 lns.bz	2026-08-30 04:57:11 (1 day ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 TPI-Abuse	2026-08-29 22:44:57 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 109.252.121.152 (109-252-121-152.nat.spd-mgts.r ... show more (mod_security) mod_security (id:210730) triggered by 109.252.121.152 (109-252-121-152.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 18:44:51.048262 2026] [security2:error] [pid 32704:tid 32709] [client 109.252.121.152:2940] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.teritemme.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.teritemme.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apNg41-xvlueOfWBslRN9wAAAMM"], referer: https://www.teritemme.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-08-29 19:31:11 (1 day ago)	20 attempts against mh-misbehave-ban on yeti	Brute-Force Bad Web Bot Web App Attack
🇳🇱 pixelXp	2026-08-29 17:24:35 (1 day ago)	Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 de ... show more Reason:10 (Web Spam), Via: jasperjaspers.nl/index-ajax.php, Message: detectSuspiciousPost count:6 details: Array - show less	Web Spam
🇺🇸 TPI-Abuse	2026-08-29 09:42:46 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 109.252.121.152 (109-252-121-152.nat.spd-mgts.r ... show more (mod_security) mod_security (id:210730) triggered by 109.252.121.152 (109-252-121-152.nat.spd-mgts.ru): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 29 05:42:41.032743 2026] [security2:error] [pid 22286:tid 22286] [client 109.252.121.152:2202] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|jabbosjingles.danged.com\|F\|2"] [data ".pkg_sourcerer.sys.ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jabbosjingles.danged.com"] [uri "/language/en-GB/en-GB.pkg_sourcerer.sys.ini"] [unique_id "apKpkT52VL_7zfUMq2zfVwAAAAM"], referer: https://jabbosjingles.danged.com/administrator/manifests/packages/pkg_sourcerer.xml show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-08-29 06:22:31 (1 day ago)	[SatAug2908:22:29.7070252026][security2:error][pid3718020:tid3718096][client109.252.121.152:0]ModSec ... show more [SatAug2908:22:29.7070252026][security2:error][pid3718020:tid3718096][client109.252.121.152:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"scrspace.com\"][uri\"/templates/gridbox/library/icons/material/material.css\"][unique_id\"apJ6pRlIot_927ZXLssW0wAAAIY\"] show less	Port Scan Brute-Force Web App Attack
🇳🇱 Savvii	2026-08-29 02:21:04 (2 days ago)	20 attempts against mh-misbehave-ban on ethyl	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-08-29 00:49:47 (2 days ago)	20 attempts against mh-misbehave-ban on crop	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-08-28 21:30:10 (2 days ago)	20 attempts against mh-misbehave-ban on storm	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Savvii	2026-08-28 16:06:37 (2 days ago)	20 attempts against mh-misbehave-ban on pea	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Site.eu	2026-08-28 10:52:08 (2 days ago)	Excessive multi-domain requests	Brute-Force

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇺 176.210.21.247

🇿🇲 41.63.62.103

🇧🇷 200.219.200.16

🇩🇪 196.251.121.125

🇺🇸 195.184.76.114

🇮🇳 106.222.230.247

🇧🇷 69.6.222.101

🇩🇪 69.5.169.231

🇱🇹 62.60.130.201

🇵🇭 61.9.8.223

🇩🇪 57.129.47.135

🇰🇷 49.162.255.210

🇳🇱 45.148.10.152

🇧🇪 34.140.74.73

🇨🇦 20.151.10.161

🇨🇦 4.204.224.164

🇧🇪 198.235.24.137

🇬🇧 195.96.139.123

🇨🇳 115.218.59.125

🇻🇳 103.200.23.107