JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 111.225.214.162

111.225.214.162 was found in our database!

This IP was reported 45 times. Confidence of Abuse is 66%: ?

66%

ISP	CHINANET hebei province network
Usage Type	Commercial
ASN	AS58539
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shijiazhuang, Hebei

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 111.225.214.162

Whois 111.225.214.162

IP Abuse Reports for 111.225.214.162:

This IP address has been reported a total of 45 times from 12 distinct sources. 111.225.214.162 was first reported on July 1st 2026, and the most recent report was 13 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-07-18 06:50:36 (13 hours ago)	Web App Attack	Web App Attack
🇬🇷 setupgr	2026-07-18 04:12:35 (15 hours ago)	(mod_security) mod_security (id:100011) triggered by 111.225.214.162 (CN/China/Hebei/Shijiazhuang/-/ ... show more (mod_security) mod_security (id:100011) triggered by 111.225.214.162 (CN/China/Hebei/Shijiazhuang/-/[AS58539 CHINATELECOM-HEBEI-LANGFANG-IDC Langfang,Hebei province, P.R.China]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Jul 18 07:12:33.800872 2026] [security2:error] [pid 1028142:tid 1028151] [remote 111.225.214.162:48012] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "CN" at GEO:COUNTRY_CODE. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "62"] [id "100011"] [msg "Traffic from CN/SG blocked for ftiaxtomonosou.gr"] [hostname "ftiaxtomonosou.gr"] [uri "/403.shtml"] [unique_id "alr9MdTt9MMKy92gdBbsLgABTAM"] show less	Port Scan
🇨🇦 1gz	2026-07-18 03:46:46 (16 hours ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /kerko.php UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 1gz	2026-07-17 10:47:54 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: / UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Mobile Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-17 06:43:53 (1 day ago)	Web App Attack	Web App Attack
🇨🇦 1gz	2026-07-17 02:19:30 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /bota/233-shpirt-ne-bord-del-videoja-e-tmerrit-nga-avioni-qe-piloti-hero-e-uli-ne-aren-me-miser-video/476076/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-16 06:41:07 (2 days ago)	Web App Attack	Web App Attack
🇨🇦 1gz	2026-07-16 03:21:29 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /shqiperi/koronavirusi-rama-shpall-planin-financiar-me-7-pika-kujt-do-ti-pergjysmohet-paga/513109/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-15 06:15:46 (3 days ago)	Web App Attack	Web App Attack
🇨🇦 1gz	2026-07-15 02:55:12 (3 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /kerko.php UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-14 19:30:21 (4 days ago)	(mod_security) mod_security (id:210730) triggered by 111.225.214.162 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 111.225.214.162 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 15:30:17.578547 2026] [security2:error] [pid 13643:tid 13643] [client 111.225.214.162:15145] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.chrisbilder.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.chrisbilder.com"] [uri "/boot/data_sets/mammals.dat"] [unique_id "alaOSehYGsim5alJq00o3wAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 1gz	2026-07-14 07:49:22 (4 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /bota/tragjike-trupi-i-biznesmenit-33-vjecare-gjendet-pa-koke-ne-apartamentin-luksoz-foto-lajm/532169/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-14 06:12:44 (4 days ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 04:52:08 (4 days ago)	(mod_security) mod_security (id:210730) triggered by 111.225.214.162 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 111.225.214.162 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 00:52:01.709442 2026] [security2:error] [pid 31860:tid 31873] [client 111.225.214.162:38943] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|vtweaversguild.org\|F\|2"] [data ".lucienne-repweave.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vtweaversguild.org"] [uri "/workshops/www.lucienne-repweave.com"] [unique_id "alXAcYTi9JV_LQHAyVcmnwAAAQk"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 1gz	2026-07-13 08:07:02 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /kerko.php UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot

Showing 1 to 15 of 45 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 195.178.110.227

🇳🇱 45.148.10.157

🇺🇸 20.124.120.10

🇭🇰 152.32.174.171

🇺🇸 98.91.19.109

🇳🇱 77.83.39.26

🇯🇵 38.207.137.202

🇧🇷 20.197.192.193

🇩🇪 194.88.98.93

🇦🇷 190.244.39.224

🇩🇪 178.104.238.129

🇰🇷 175.203.23.245

🇩🇪 167.94.146.57

🇳🇬 152.32.141.2

🇩🇪 69.5.169.103

🇨🇷 186.177.88.108

🇺🇸 172.253.9.210

🇺🇸 81.30.98.193

🇳🇱 45.148.10.239

🇮🇹 34.154.170.60