JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.254.242.52

112.254.242.52 was found in our database!

This IP was reported 6 times. Confidence of Abuse is 5%: ?

ISP	China Unicom Shandong province network
Usage Type	Fixed Line ISP
ASN	AS4837
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Qingdao, Shandong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.254.242.52

Whois 112.254.242.52

IP Abuse Reports for 112.254.242.52:

This IP address has been reported a total of 6 times from 2 distinct sources. 112.254.242.52 was first reported on February 15th 2026, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-03 20:30:44 (7 hours ago)	(mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 16:30:30.355929 2026] [security2:error] [pid 30866:tid 30866] [client 112.254.242.52:32838] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|indie100.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "indie100.com"] [uri "/"] [unique_id "aiCO5j5eQw7iGVOHTLzM1QAAAA0"], referer: https://indie100.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 21:32:20 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 17:32:04.446580 2026] [security2:error] [pid 21778:tid 21778] [client 112.254.242.52:54401] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.mooseled.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.mooseled.com"] [uri "/"] [unique_id "ageQ1L8UMp6lJ1dc3MMzAgAAAAk"], referer: https://www.mooseled.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 18:35:26 (3 weeks ago)	(mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:35:09.684405 2026] [security2:error] [pid 32175:tid 32175] [client 112.254.242.52:27292] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ramseysgalleryofstuff.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ramseysgalleryofstuff.com"] [uri "/"] [unique_id "agDP3abgdodOO3SzShJJoQAAAAE"], referer: http://ramseysgalleryofstuff.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 22:16:38 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 112.254.242.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 18:16:20.557146 2026] [security2:error] [pid 16258:tid 16258] [client 112.254.242.52:53280] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.thenowhere-men.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.thenowhere-men.com"] [uri "/"] [unique_id "ac7qtNlUdZUmZM3WywuCbgAAAAA"], referer: http://www.thenowhere-men.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-04-01 22:18:47 (2 months ago)	ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/112.254.242.52 2026-04-0 ... show more ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/112.254.242.52 2026-04-01 16:02:52 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2026-02-15 22:16:29 (3 months ago)	ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/112.254.242.52 2026-02-1 ... show more ThreatBook Intelligence: Dynamic IP more details on http://threatbook.io/ip/112.254.242.52 2026-02-15 20:06:37 / show less	Web App Attack

Showing 1 to 6 of 6 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.83.114.88

🇨🇳 203.76.241.18

🇺🇸 195.184.76.122

🇳🇱 192.142.24.66

🇺🇸 172.234.17.170

🇨🇳 112.109.194.122

🇱🇹 77.90.185.238

🇩🇪 69.5.169.47

🇱🇺 64.89.161.56

🇰🇪 41.89.128.6

🇧🇷 200.232.114.71

🇦🇷 186.139.129.76

🇳🇱 185.226.197.47

🇺🇦 176.119.25.48

🇩🇪 165.154.138.79

🇺🇸 162.216.149.242

🇨🇳 121.40.84.227

🇨🇳 111.228.62.104

🇨🇳 111.170.34.11

🇫🇮 111.88.215.223