JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 111.166.154.42

111.166.154.42 was found in our database!

This IP was reported 6 times. Confidence of Abuse is 16%: ?

16%

ISP	China Unicom Tianjin province network
Usage Type	Fixed Line ISP
ASN	AS4837
Hostname(s)	dns42.online.tj.cn
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Tianjin, Tianjin

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 111.166.154.42

Whois 111.166.154.42

IP Abuse Reports for 111.166.154.42:

This IP address has been reported a total of 6 times from 2 distinct sources. 111.166.154.42 was first reported on July 6th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-09 04:04:47 (11 hours ago)	(mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the l ... show more (mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 00:04:42.580462 2026] [security2:error] [pid 18238:tid 18238] [client 111.166.154.42:31399] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.mtalame.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.mtalame.com"] [uri "/"] [unique_id "ak8d2rYSl6L6bx-M-ZWBiAAAAAA"], referer: http://www.mtalame.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 paulshipley.com.au	2026-07-08 06:58:44 (1 day ago)	[Wed Jul 08 16:58:43.239381 2026] [security2:error] [pid 357355] [client 111.166.154.42:30225] [clie ... show more [Wed Jul 08 16:58:43.239381 2026] [security2:error] [pid 357355] [client 111.166.154.42:30225] [client 111.166.154.42] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/"] [unique_id "ak31IxRXsK_9hyqVwW51bwAAAAQ"], referer: https://levellapromotions.com.au/ ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 21:59:21 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the l ... show more (mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 17:59:18.579049 2026] [security2:error] [pid 21107:tid 21107] [client 111.166.154.42:30982] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|mimrg.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "mimrg.net"] [uri "/"] [unique_id "ak12ts0DxlC_FPY448rjVQAAAAE"], referer: https://mimrg.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-07 00:12:53 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the l ... show more (mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 20:12:46.156120 2026] [security2:error] [pid 28628:tid 28628] [client 111.166.154.42:31255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|tyning.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "tyning.com"] [uri "/"] [unique_id "akxEfkLuM1zpkkTkQ2_hkwAAAAc"], referer: http://tyning.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 23:44:38 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the l ... show more (mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 19:44:33.557737 2026] [security2:error] [pid 14113:tid 14113] [client 111.166.154.42:30889] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|cortesinsulation.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cortesinsulation.com"] [uri "/"] [unique_id "akw94XJLdlRKvp15zTJeNQAAAA8"], referer: http://cortesinsulation.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-06 19:32:15 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the l ... show more (mod_security) mod_security (id:210831) triggered by 111.166.154.42 (dns42.online.tj.cn): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 15:32:09.449827 2026] [security2:error] [pid 8853:tid 8853] [client 111.166.154.42:31552] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|seizetheseason.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "seizetheseason.com"] [uri "/"] [unique_id "akwCuRQ5GE96jVYB9DxvNAAAABU"], referer: http://seizetheseason.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 6 of 6 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.150.181

🇨🇭 152.67.72.223

🇻🇳 123.16.22.84

🇰🇷 121.1.80.17

🇺🇸 104.152.52.241

🇺🇸 104.152.52.228

🇺🇸 104.152.52.128

🇺🇸 104.152.52.110

🇺🇸 103.234.62.84

🇧🇷 2804:3bf0:ddb5:5301:48b8:a828:b178:bac3

🇸🇬 194.61.41.25

🇺🇸 174.68.57.247

🇺🇸 172.236.228.38

🇭🇰 156.225.1.34

🇺🇸 104.152.52.206

🇺🇸 104.29.158.232

🇳🇱 91.92.40.200

🇷🇺 77.223.122.29

🇺🇸 66.132.224.224

🇺🇸 66.132.195.56