JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 111.225.214.205

111.225.214.205 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 46%: ?

46%

ISP	CHINANET hebei province network
Usage Type	Commercial
ASN	AS58539
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shijiazhuang, Hebei

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 111.225.214.205

Whois 111.225.214.205

IP Abuse Reports for 111.225.214.205:

This IP address has been reported a total of 31 times from 7 distinct sources. 111.225.214.205 was first reported on June 30th 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇦 1gz	2026-07-18 08:25:48 (11 hours ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /teknologji/marvel-vjen-me-super-risi-10-filma-te-rinj-me-superheronj/472385/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇬🇷 setupgr	2026-07-18 01:45:22 (18 hours ago)	(mod_security) mod_security (id:100011) triggered by 111.225.214.205 (CN/China/Hebei/Shijiazhuang/-/ ... show more (mod_security) mod_security (id:100011) triggered by 111.225.214.205 (CN/China/Hebei/Shijiazhuang/-/[AS58539 CHINATELECOM-HEBEI-LANGFANG-IDC Langfang,Hebei province, P.R.China]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Jul 18 04:45:19.460534 2026] [security2:error] [pid 1108425:tid 1108428] [remote 111.225.214.205:64157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "CN" at GEO:COUNTRY_CODE. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "62"] [id "100011"] [msg "Traffic from CN/SG blocked for ftiaxtomonosou.gr"] [hostname "ftiaxtomonosou.gr"] [uri "/%CF%84%CE%B1_%CE%B5%CE%AF%CE%B4%CE%B7_%CF%84%CE%BF%CF%85_%CE%BE%CF%8D%CE%BB%CE%BF%CF%85/%CE%BF%CE%BE%CF%85%CE%AC-%CE%B5%CF%85%CF%81%CF%89%CF%80%CE%B1%CF%8A%CE%BA%CE%AE/"] [unique_id "alrar9x611pRzQsQDrQ_7AAAAwI"] show less	Port Scan
🇨🇦 1gz	2026-07-18 00:54:21 (19 hours ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/2 (GET method) ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/2 (GET method) Endpoint: /kerko.php UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 1gz	2026-07-17 02:22:19 (1 day ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /bota/plani-si-po-i-dbon-gjermania-azilkrkuesit/289316/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 1gz	2026-07-16 03:35:52 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /shendetesi/dhimbjet-e-kyceve-ushqimet-qe-nuk-duhet-te-hani/540872/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 1gz	2026-07-16 02:41:11 (2 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /bota/apokalips-ne-stamboll-permbyten-rruget-dhe-sheshet-video/476360/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-15 21:27:13 (2 days ago)	Web App Attack	Web App Attack
🇨🇦 1gz	2026-07-15 02:49:50 (3 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /shqiperi/basha-kush-fiton-debatet-do-zgjidhet-kreu-i-frpd-/216717/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-14 21:15:23 (3 days ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 14:25:15 (4 days ago)	(mod_security) mod_security (id:210730) triggered by 111.225.214.205 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 111.225.214.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 10:25:09.075980 2026] [security2:error] [pid 2932:tid 2932] [client 111.225.214.205:59416] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|3ddatacenters.com\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "3ddatacenters.com"] [uri "/3DAINews.com"] [unique_id "alZGxWN6NmnvB_FqQ3IE3wAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 1gz	2026-07-14 01:41:39 (4 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /kerko.php UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-07-13 21:14:44 (4 days ago)	Web App Attack	Web App Attack
🇨🇦 1gz	2026-07-13 07:48:15 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /kuriozitete/6-qytetet-me-mira-per-te-jetuar-ne-njerin-prej-tyre-jane-mijera-shqiptare/488821/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇨🇦 1gz	2026-07-13 01:13:02 (5 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /foto-lajm/shkopi-i-gomes-skursen-as-te-moshuarin-fraktura-ne-koke-foto-lajm/491013/ UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-12 11:58:59 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 111.225.214.205 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210730) triggered by 111.225.214.205 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 07:58:55.001388 2026] [security2:error] [pid 20212:tid 20212] [client 111.225.214.205:54375] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|thejuniverse.org\|F\|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thejuniverse.org"] [uri "/PUBLIC/Archived/Calculus/th.com"] [unique_id "alOBfiCwsfgOpScf3FWmeQAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 62.60.130.219

🇨🇳 14.103.83.214

🇪🇸 187.33.159.66

🇨🇱 186.64.123.124

🇨🇴 185.42.21.94

🇷🇺 176.212.154.239

🇺🇸 147.185.132.111

🇳🇬 102.216.134.50

🇷🇺 95.152.63.91

🇰🇷 58.229.253.119

🇳🇱 194.135.105.208

🇺🇸 71.6.242.69

🇬🇧 35.203.211.147

🇺🇸 147.185.132.247

🇷🇺 85.92.118.47

🇳🇱 45.142.193.132

🇮🇩 34.101.220.106

🇺🇸 162.241.132.172

🇺🇸 162.240.44.39

🇸🇬 114.119.157.3