JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.102.36.220

112.102.36.220 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 12%: ?

12%

ISP	CHINANET HEILONGJIANG PROVINCE NETWORK
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Harbin, Heilongjiang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.102.36.220

Whois 112.102.36.220

IP Abuse Reports for 112.102.36.220:

This IP address has been reported a total of 16 times from 10 distinct sources. 112.102.36.220 was first reported on May 19th 2024, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-27 21:02:12 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 112.102.36.220 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 112.102.36.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 17:02:04.989483 2026] [security2:error] [pid 29537:tid 29554] [client 112.102.36.220:45385] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.aeaus.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.aeaus.com"] [uri "/index.html"] [unique_id "akA6TE1d3bJy8LvzjJDcNQAAAMw"], referer: https://www.aeaus.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-05-25 19:14:35 (1 month ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 MPL	2026-03-25 21:24:49 (3 months ago)	tcp/86 (3 or more attempts)	Port Scan
🇺🇸 micropedro	2026-03-25 20:37:31 (3 months ago)	4 incidents: port scanning. First: 2026-03-25 16:37, Last: 2026-03-25 16:37 UTC. Triggers: non-publi ... show more 4 incidents: port scanning. First: 2026-03-25 16:37, Last: 2026-03-25 16:37 UTC. Triggers: non-public-port,firewall-tcp. show less	Port Scan
Anonymous	2026-03-25 13:53:53 (3 months ago)	Brute force. Port:82	Brute-Force
🇺🇸 MPL	2026-03-25 13:10:11 (3 months ago)	tcp ports: 86,85 (4 or more attempts)	Port Scan
🇺🇸 MPL	2026-03-24 09:50:49 (3 months ago)	tcp/84 (2 or more attempts)	Port Scan
🇺🇸 MPL	2026-03-24 06:48:04 (3 months ago)	tcp/84	Port Scan
🇬🇧 Nov	2026-03-24 01:01:30 (3 months ago)	Unauthorized Kerberos access attempt (tcp/88)	Port Scan
🇺🇸 xmission.com	2026-03-23 12:11:28 (3 months ago)	Blocked by UFW (TCP on 86) Source port: 23035 TTL: 44 Packet length: 44 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 86) Source port: 23035 TTL: 44 Packet length: 44 TOS: 0x08 This report (for 112.102.36.220) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 MPL	2026-03-23 01:46:04 (3 months ago)	tcp/85	Port Scan
🇫🇷 centurion	2026-03-23 00:57:38 (3 months ago)	Unauthorized attempt on uptime [84/tcp] Source port: 16383 TTL: 40 Packet length: 44 TOS: 0x00 https ... show more Unauthorized attempt on uptime [84/tcp] Source port: 16383 TTL: 40 Packet length: 44 TOS: 0x00 https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-03-22 10:31:51 (3 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇮🇹 VHosting	2026-03-01 13:21:56 (3 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 TPI-Abuse	2025-09-16 21:07:04 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 112.102.36.220 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210350) triggered by 112.102.36.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 16 17:06:13.264359 2025] [security2:error] [pid 17213:tid 17213] [client 112.102.36.220:55507] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/tournament/130/game/84640"] [unique_id "aMnRRQHDke5krD2ewSwSSQAAAFY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.137

🇺🇸 185.117.225.72

🇳🇱 195.178.110.26

🇬🇧 154.16.44.142

🇮🇳 103.127.30.137

🇨🇳 58.19.77.133

🇱🇺 46.151.182.161

🇺🇸 147.185.132.210

🇺🇸 143.42.1.84

🇰🇷 121.136.93.86

🇺🇸 104.43.131.157

🇧🇩 103.31.10.115

🇺🇸 65.49.20.72

🇮🇳 20.204.97.153

🇬🇧 195.206.182.210

🇳🇱 173.194.170.123

🇮🇩 125.162.180.154

🇲🇽 122.8.184.56

🇭🇰 118.26.37.247

🇨🇳 115.55.198.46