JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

112.193.255.9

Neutral Activity

Abuse confidence score ?

0% Low Risk

27 reports

12 reporters · latest 1 year ago

ISP	China Unicom Sichuan province network
Usage Type	Fixed Line ISP
ASN	AS4837
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Chengdu, Sichuan

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

112.193.255.9 has been reported 27 times. The most recent report is from 1 year ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 112.193.255.9

Export CSV

This IP address has been reported a total of 27 times from 12 distinct sources. 112.193.255.9 was first reported on June 6th 2024, and the most recent report was 1 year ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 kosada.com	2025-10-01 18:43:45 (1 year ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2025-09-10 08:00:48 (1 year ago)	(mod_security) mod_security (id:210350) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 10 04:00:43.066917 2025] [security2:error] [pid 17044:tid 17044] [client 112.193.255.9:24926] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/game/121220/"] [unique_id "aMEwK62aaxCDKWWbnJJhcgAAABc"], referer: https://www.renju.net/game/121220 show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 rdpguard.com	2024-10-21 00:22:23 (1 year ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
🇺🇸 TPI-Abuse	2024-10-09 03:03:50 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 08 23:03:08.615537 2024] [security2:error] [pid 7872:tid 7872] [client 112.193.255.9:12851] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.zacharyschwartzman.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.zacharyschwartzman.com"] [uri "/bbs.bak"] [unique_id "ZwXybJWLd_Z75sibqz4FDwAAADA"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-10-08 21:24:59 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 08 17:23:57.448316 2024] [security2:error] [pid 31279:tid 31279] [client 112.193.255.9:12563] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.realestateinpalmbeachflorida.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.realestateinpalmbeachflorida.com"] [uri "/root.bak"] [unique_id "ZwWi7fotsP9qsrZQPq3rPQAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-10-08 16:38:13 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 08 12:36:51.946021 2024] [security2:error] [pid 22133:tid 22133] [client 112.193.255.9:13608] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.callbobh.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.callbobh.com"] [uri "/2016.bak"] [unique_id "ZwVfo6pFjh4JTzcUTo0yHAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-10-08 15:16:16 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 08 11:15:14.649071 2024] [security2:error] [pid 20802:tid 20802] [client 112.193.255.9:12301] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.bernarrmacfadden.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bernarrmacfadden.com"] [uri "/my.sql"] [unique_id "ZwVMgq7WFMItPNQYwaAf5gAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇪🇸 10dencehispahard SL	2024-10-08 10:37:08 (2 years ago)	DoS Attack	DDoS Attack Brute-Force
🇺🇸 TPI-Abuse	2024-10-07 13:14:51 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 07 09:14:00.086135 2024] [security2:error] [pid 13320:tid 13320] [client 112.193.255.9:12582] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.birthplaceofprohockey.org\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.birthplaceofprohockey.org"] [uri "/auth.sql"] [unique_id "ZwPemOG89p1nxFpPFSxWeAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-10-07 05:43:19 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 07 01:40:06.483509 2024] [security2:error] [pid 30484:tid 30484] [client 112.193.255.9:13837] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.med-engineering.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.med-engineering.com"] [uri "/www.sql"] [unique_id "ZwN0Nhh_nAkefY6LAN4ZmQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-09-04 04:38:39 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 04 00:38:06.378315 2024] [security2:error] [pid 476:tid 476] [client 112.193.255.9:22666] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.urlpick.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.urlpick.com"] [uri "/2012.bak"] [unique_id "ZtfkLnC1aUdON01LnkK_WAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-09-02 03:28:24 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 01 23:26:48.379204 2024] [security2:error] [pid 2919:tid 2919] [client 112.193.255.9:24087] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.alternatievemedia.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.alternatievemedia.com"] [uri "/sql.sql"] [unique_id "ZtUweNTRO9hS7q9CQ9g72wAAAB8"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-09-01 18:14:04 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 01 14:12:08.720035 2024] [security2:error] [pid 28475:tid 28475] [client 112.193.255.9:23318] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.highaltitudebaking.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.highaltitudebaking.com"] [uri "/www.bak"] [unique_id "ZtSueP0C3a_gP7eL1Z7obQAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-09-01 12:49:42 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 01 08:47:07.009719 2024] [security2:error] [pid 16805:tid 16805] [client 112.193.255.9:23553] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.tanny.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.tanny.com"] [uri "/joomla.bak"] [unique_id "ZtRiS__1Vk69HOBbp9Q3fgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2024-08-31 12:11:19 (2 years ago)	(mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 112.193.255.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 31 08:10:26.519870 2024] [security2:error] [pid 22005:tid 22005] [client 112.193.255.9:23200] [client 112.193.255.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.ssion.com\|F\|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ssion.com"] [uri "/tar.sql"] [unique_id "ZtMIMikF8BdHM4k6Ez9jBwAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 2a06:4880:4000::5d

🇧🇷 205.210.31.184

🇧🇪 198.235.24.222

🇺🇸 195.184.76.181

🇳🇱 193.176.31.247

🇫🇮 147.185.133.127

🇺🇸 147.185.132.153

🇨🇳 120.48.7.234

🇨🇳 115.191.27.139

🇺🇸 67.175.6.73

🇮🇳 38.137.31.17

🇧🇪 35.241.209.115

🇬🇧 35.203.210.170

🇺🇸 216.24.219.134

🇧🇷 205.210.31.212

🇺🇸 204.217.131.187

🇺🇸 184.73.18.89

🇬🇧 176.223.161.185

🇨🇱 148.227.115.220

🇺🇸 135.136.36.116