AbuseIPDB » 113.2.189.134

113.2.189.134 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 14%: ?

14%

ISP	China Unicom Heilongjiang Province Network
Usage Type	Fixed Line ISP
ASN	AS4837
Domain Name	chinaunicom.cn
Country	China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 113.2.189.134

Whois 113.2.189.134

IP Abuse Reports for 113.2.189.134:

This IP address has been reported a total of 9 times from 3 distinct sources. 113.2.189.134 was first reported on June 16th 2025, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
TPI-Abuse	2025-06-18 15:26:32 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 18 11:26:02.308055 2025] [security2:error] [pid 130054:tid 130054] [client 113.2.189.134:61318] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.albrittonmcclain.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.albrittonmcclain.com"] [uri "/aspx.bak"] [unique_id "aFLaiieJ020nIvC14CRVPQAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
ghostwarriors	2025-06-18 09:20:13 (1 month ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
TPI-Abuse	2025-06-17 18:33:35 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 17 14:33:25.168244 2025] [security2:error] [pid 3651607:tid 3651607] [client 113.2.189.134:50511] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.jazziiafoundation.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.jazziiafoundation.org"] [uri "/2012.sql"] [unique_id "aFG09XRvT2MzoAvKuxZPoQAAACM"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-17 08:10:25 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 17 04:09:48.621256 2025] [security2:error] [pid 337764:tid 337790] [client 113.2.189.134:50008] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.castaspell.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.castaspell.com"] [uri "/wp.sql"] [unique_id "aFEizJVPgCTdLTTnjHycRQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
rdpguard.com	2025-06-16 14:54:57 (1 month ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
TPI-Abuse	2025-06-16 12:30:40 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 08:30:26.026535 2025] [security2:error] [pid 3708599:tid 3708599] [client 113.2.189.134:61410] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.styxtake2.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.styxtake2.com"] [uri "/local.bak"] [unique_id "aFAOYgmHbeSDzwE1xvS6EgAAABw"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 10:07:30 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 06:07:13.778895 2025] [security2:error] [pid 447408:tid 447408] [client 113.2.189.134:51186] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.msbook4kids.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.msbook4kids.com"] [uri "/user.sql"] [unique_id "aE_s0bmJRuKB-6KG7LUR2wAAAEA"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 09:28:11 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 05:28:07.074506 2025] [security2:error] [pid 1292096:tid 1292096] [client 113.2.189.134:55751] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.qosmexico.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.qosmexico.com"] [uri "/2015.bak"] [unique_id "aE_jp7gdfC4XzVvIhA3DrgAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 05:37:02 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 01:36:48.990043 2025] [security2:error] [pid 221511:tid 221511] [client 113.2.189.134:58245] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.rame-int.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rame-int.com"] [uri "/2025.bak"] [unique_id "aE-tcA_ybK1gvMXrVjeQBgAAABk"] show less	Brute-Force Bad Web Bot Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩