JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 112.49.185.81

112.49.185.81 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 4%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Jiaxing, Zhejiang

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 112.49.185.81

Whois 112.49.185.81

IP Abuse Reports for 112.49.185.81:

This IP address has been reported a total of 10 times from 2 distinct sources. 112.49.185.81 was first reported on April 19th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-10 00:56:13 (2 days ago)	(mod_security) mod_security (id:949110) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 20:56:07.902671 2026] [security2:error] [pid 1798:tid 1798] [client 112.49.185.81:31930] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "akistech.com"] [uri "/"] [unique_id "alBDJ3Vsq3JsPT_7ZJlejAAAAAI"], referer: https://akistech.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 22:32:14 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 18:32:08.990511 2026] [security2:error] [pid 3985:tid 4031] [client 112.49.185.81:32575] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.nimbll.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.nimbll.com"] [uri "/"] [unique_id "ak7P6EElpB7GpWW2Yzdk8gAAAAI"], referer: https://www.nimbll.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 00:44:28 (3 weeks ago)	(mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 20:44:24.404630 2026] [security2:error] [pid 6694:tid 6694] [client 112.49.185.81:32099] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|albertawaterjet.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "albertawaterjet.com"] [uri "/"] [unique_id "ajM_aNt2_BajigD4e6ZBFgAAAAI"], referer: http://albertawaterjet.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-16 22:56:14 (3 weeks ago)	(mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 18:56:09.711100 2026] [security2:error] [pid 20245:tid 20245] [client 112.49.185.81:31902] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|gowithevergreen.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "gowithevergreen.com"] [uri "/"] [unique_id "ajHUiU_FjSH6_2dPyooREAAAAAY"], referer: http://gowithevergreen.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-27 01:21:30 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 112.49.185.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 20:21:26.279113 2026] [security2:error] [pid 21586:tid 21586] [client 112.49.185.81:30182] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.swhowell.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.swhowell.com"] [uri "/"] [unique_id "aaDxlu4JUPEVZYUA9Q7RYgAAAAk"], referer: http://www.swhowell.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-08-05 23:28:54 (11 months ago)	ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-08-05 05: ... show more ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-08-05 05:33:38 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-08-01 23:35:21 (11 months ago)	ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-08-01 10: ... show more ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-08-01 10:18:40 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-31 23:27:05 (11 months ago)	ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-07-31 12: ... show more ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-07-31 12:38:40 /favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-04 23:37:40 (1 year ago)	ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-06-04 06: ... show more ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-06-04 06:42:00 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2025-04-19 00:21:12 (1 year ago)	ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-04-18 05: ... show more ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/112.49.185.81 2025-04-18 05:35:30 /static/img/facio.ico show less	Web App Attack

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 152.32.200.213

🇹🇭 202.29.232.119

🇹🇭 202.29.228.248

🇨🇳 183.57.241.253

🇯🇵 172.104.100.117

🇺🇸 162.216.150.250

🇺🇸 162.216.150.132

🇹🇭 159.192.97.182

🇺🇸 151.245.32.125

🇨🇳 124.117.195.58

🇨🇳 112.24.8.123

🇺🇸 97.74.236.4

🇺🇸 66.132.195.113

🇳🇱 45.153.34.149

🇭🇰 43.104.36.67

🇧🇪 34.52.167.103

🇺🇸 3.236.194.139

🇺🇸 3.228.129.134

🇬🇧 2a06:4880::23

🇧🇷 205.210.31.216