AbuseIPDB » 113.2.189.142

113.2.189.142 was found in our database!

This IP was reported 14 times. Confidence of Abuse is 22%: ?

22%

ISP	China Unicom Heilongjiang Province Network
Usage Type	Fixed Line ISP
ASN	AS4837
Domain Name	chinaunicom.cn
Country	China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 113.2.189.142

Whois 113.2.189.142

IP Abuse Reports for 113.2.189.142:

This IP address has been reported a total of 14 times from 5 distinct sources. 113.2.189.142 was first reported on June 16th 2025, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
rtbh.com.tr	2025-06-21 20:07:16 (4 weeks ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
rtbh.com.tr	2025-06-20 20:07:16 (4 weeks ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
rtbh.com.tr	2025-06-20 00:07:14 (1 month ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
rtbh.com.tr	2025-06-19 20:07:15 (1 month ago)	list.rtbh.com.tr report: tcp/0	Brute-Force
TPI-Abuse	2025-06-18 15:26:33 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 18 11:25:54.159626 2025] [security2:error] [pid 128508:tid 128508] [client 113.2.189.142:61198] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.albrittonmcclain.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.albrittonmcclain.com"] [uri "/2021.bak"] [unique_id "aFLagpUB3z6a3lY_g4AlVAAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
ghostwarriors	2025-06-18 09:20:08 (1 month ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
TPI-Abuse	2025-06-17 18:33:29 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 17 14:33:23.215480 2025] [security2:error] [pid 3651592:tid 3651592] [client 113.2.189.142:50117] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.jazziiafoundation.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.jazziiafoundation.org"] [uri "/2010.sql"] [unique_id "aFG08zNW54iE1OzY2KzRLQAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-06-17 16:00:22 (1 month ago)	Ports: 80,443; Direction: 0; Trigger: LF_MODSEC	Brute-Force SSH
TPI-Abuse	2025-06-17 08:10:42 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 17 04:09:45.511207 2025] [security2:error] [pid 337768:tid 337881] [client 113.2.189.142:53568] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.castaspell.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.castaspell.com"] [uri "/2025.bak"] [unique_id "aFEiybYSPMvZqNKy0it1ugAAAQU"] show less	Brute-Force Bad Web Bot Web App Attack
rdpguard.com	2025-06-16 14:54:57 (1 month ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
TPI-Abuse	2025-06-16 12:30:45 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 08:30:24.207443 2025] [security2:error] [pid 3705858:tid 3705858] [client 113.2.189.142:60460] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.styxtake2.com|F|2"] [data ".0.0.1.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.styxtake2.com"] [uri "/127.0.0.1.bak"] [unique_id "aFAOYO7F3KcjlqZHlhUBnQAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 10:07:23 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 06:06:59.440252 2025] [security2:error] [pid 446117:tid 446117] [client 113.2.189.142:53677] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.msbook4kids.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.msbook4kids.com"] [uri "/2018.bak"] [unique_id "aE_sw4i1JavEY-BW_H1rMwAAABo"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 09:28:30 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 05:28:13.902819 2025] [security2:error] [pid 1294823:tid 1294823] [client 113.2.189.142:62693] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.qosmexico.com|F|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.qosmexico.com"] [uri "/tar.bak"] [unique_id "aE_jrf9h4knQNzx0WxQ2NAAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 05:36:55 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210730) triggered by 113.2.189.142 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 01:36:42.616867 2025] [security2:error] [pid 219125:tid 219125] [client 113.2.189.142:57969] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.rame-int.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rame-int.com"] [uri "/2014.sql"] [unique_id "aE-taqLqBk9Io7T6NlPbGQAAAA8"] show less	Brute-Force Bad Web Bot Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩