JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.32.52.225

112.32.52.225 was found in our database!

This IP was reported 5 times. Confidence of Abuse is 13%: ?

13%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Jiaxing, Zhejiang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.32.52.225

Whois 112.32.52.225

IP Abuse Reports for 112.32.52.225:

This IP address has been reported a total of 5 times from 2 distinct sources. 112.32.52.225 was first reported on May 31st 2026, and the most recent report was 11 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-20 23:39:42 (11 hours ago)	(mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 19:39:37.565990 2026] [security2:error] [pid 6899:tid 6899] [client 112.32.52.225:36581] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.damonmarks.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.damonmarks.com"] [uri "/"] [unique_id "ajckuViZYoJwdJFYmQ_nqAAAAAU"], referer: https://www.damonmarks.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 22:25:58 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 18:25:51.696479 2026] [security2:error] [pid 30278:tid 30278] [client 112.32.52.225:35855] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|keymarketmedia.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "keymarketmedia.com"] [uri "/index.html"] [unique_id "ajMe7-NQHlNGxOfDGZJtVQAAAAs"], referer: http://keymarketmedia.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 19:30:48 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 15:30:44.626845 2026] [security2:error] [pid 16343:tid 16343] [client 112.32.52.225:36310] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|artfranz.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "artfranz.com"] [uri "/index.html"] [unique_id "aiCA5Alqn3eGdGk2fJhjAAAAAB8"], referer: http://artfranz.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-31 21:15:21 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.32.52.225 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 17:15:17.116701 2026] [security2:error] [pid 19539:tid 19539] [client 112.32.52.225:35896] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|lmffl.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "lmffl.com"] [uri "/"] [unique_id "ahyk5WyYXno2KOMBCLDnGQAAABo"], referer: http://lmffl.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 pengpeng	2026-05-31 08:38:47 (3 weeks ago)	monitor: on VM-0-7-ubuntu \| port: 40992 \| ttl: 112 script: github.com/sefinek/UFW-AbuseIPDB-Reporte ... show more monitor: on VM-0-7-ubuntu \| port: 40992 \| ttl: 112 script: github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan

Showing 1 to 5 of 5 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.25.89.103

🇳🇱 152.42.137.51

🇨🇳 61.179.73.179

🇳🇱 45.148.10.157

🇦🇷 24.232.153.182

🇺🇸 24.14.37.194

🇺🇸 216.25.89.85

🇳🇱 176.65.139.242

🇳🇱 176.65.139.215

🇺🇸 162.216.149.213

🇺🇸 162.216.149.52

🇰🇷 119.203.251.187

🇹🇼 111.70.23.251

🇷🇴 80.94.92.184

🇩🇪 69.5.169.228

🇺🇸 65.49.1.241

🇬🇧 45.198.224.46

🇺🇸 20.14.73.54

🇷🇴 2.57.121.25

🇨🇳 182.242.168.106