JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.227.195.216

112.227.195.216 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 11%: ?

11%

ISP	China Unicom Shandong province network
Usage Type	Fixed Line ISP
ASN	AS4837
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Qingdao, Shandong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.227.195.216

Whois 112.227.195.216

IP Abuse Reports for 112.227.195.216:

This IP address has been reported a total of 8 times from 3 distinct sources. 112.227.195.216 was first reported on May 7th 2026, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-28 23:09:52 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 19:09:35.998034 2026] [security2:error] [pid 32285:tid 32285] [client 112.227.195.216:44859] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|marianozaro.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "marianozaro.com"] [uri "/"] [unique_id "apIVLwmuIgSbJ60e2yCOgAAAABM"], referer: https://marianozaro.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇦 1gz	2026-07-11 02:44:36 (1 month ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: CHALLENGE Protocol: HTTP/2 (GET met ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: CHALLENGE Protocol: HTTP/2 (GET method) Endpoint: / UA: User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-09 08:50:13 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 04:49:56.107169 2026] [security2:error] [pid 9405:tid 9405] [client 112.227.195.216:64223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.solcargomiami.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.solcargomiami.com"] [uri "/"] [unique_id "ak9gtEjFC_YIw4BmzG3ZqQAAAAQ"], referer: https://www.solcargomiami.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 00:44:41 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 20:44:24.561562 2026] [security2:error] [pid 6600:tid 6600] [client 112.227.195.216:38495] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.radionicships.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.radionicships.com"] [uri "/"] [unique_id "ak2daKC4e4rTpZmVyjebLAAAAAs"], referer: http://www.radionicships.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-23 01:25:38 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 21:25:24.395696 2026] [security2:error] [pid 5824:tid 5824] [client 112.227.195.216:60532] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|wildlifetaxidermy.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "wildlifetaxidermy.com"] [uri "/"] [unique_id "ahECBPxjDuE_QfpVYWOB7QAAAAA"], referer: http://wildlifetaxidermy.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 20:59:17 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 16:59:04.248346 2026] [security2:error] [pid 15811:tid 15811] [client 112.227.195.216:28653] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|albertawaterjet.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "albertawaterjet.com"] [uri "/"] [unique_id "ag4gmOH2ydioed3Pgg7a1wAAAAY"], referer: http://albertawaterjet.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-13 19:09:41 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 112.227.195.216 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 15:09:23.585284 2026] [security2:error] [pid 20049:tid 20049] [client 112.227.195.216:39764] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|casaluzislamujeres.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "casaluzislamujeres.com"] [uri "/"] [unique_id "agTMY4PyzyrLSwdBVj5-MAAAAA0"], referer: https://casaluzislamujeres.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-05-07 01:32:55 (3 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/112.227.195.216 2026-05-06 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/112.227.195.216 2026-05-06 00:39:45 /robots.txt show less	Web App Attack

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 195.184.76.219

🇺🇸 185.224.143.61

🇲🇽 177.249.175.153

🇺🇸 172.253.214.20

🇬🇧 86.20.162.9

🇺🇸 35.254.172.192

🇬🇧 35.203.211.43

🇮🇳 2404:6800:4013:800::127

🇰🇷 210.222.217.202

🇨🇭 209.99.185.168

🇫🇮 193.32.204.199

🇧🇷 187.33.136.172

🇳🇱 185.93.89.21

🇺🇸 172.171.233.230

🇬🇧 167.172.58.216

🇹🇷 159.146.21.251

🇬🇧 151.225.173.45

🇺🇸 136.227.243.73

🇨🇳 123.245.85.27

🇨🇳 112.46.213.21