JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

155.2.216.2

Neutral Activity

Abuse Confidence Score

0% Low Risk

62 reports

18 reporters · latest 4 months ago

ISP: VPN Consumer Tokyo, Japan
Usage Type: Data Center/Web Hosting/Transit
ASN: AS212238
Domain Name: vpnconsumer.com
Country: 🇯🇵 Japan
City: Tokyo, Tokyo

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

155.2.216.2 has been reported 62 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

62 from 18 distinct reporters

First reported

April 21st 2025

Most recent report

4 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇯🇵 demonsword	2026-07-01 11:52:04 UTC · (4 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: www.cloudflare.com:443	Open Proxy Port Scan
🇺🇸 TPI-Abuse	2026-06-22 03:12:10 UTC · (4 months ago)	(mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 23:12:05.872355 2026] [security2:error] [pid 27929:tid 27956] [client 155.2.216.2:0] ModSecuri ... show more (mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 23:12:05.872355 2026] [security2:error] [pid 27929:tid 27956] [client 155.2.216.2:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|mindgardens.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mindgardens.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "ajioBa8Xt7Q7rySykjWVuwAAAZg"] show less	Brute-Force Bad Web Bot Web App Attack
🇯🇵 demonsword	2026-06-21 11:17:30 UTC · (4 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: cloudflare.com:443	Open Proxy Port Scan
🇺🇸 TPI-Abuse	2026-06-07 11:25:01 UTC · (5 months ago)	(mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 07:24:56.477932 2026] [security2:error] [pid 11798:tid 11798] [client 155.2.216.2:0] ModSecuri ... show more (mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 07:24:56.477932 2026] [security2:error] [pid 11798:tid 11798] [client 155.2.216.2:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|upskirtcrazy.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "upskirtcrazy.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "aiVVCOylVkpB3lZS-K947gAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-05-24 13:50:39 UTC · (5 months ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 155.2.216.2 (JP/Japan/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 155.2.216.2 - - [24/May/2026:15:50:34 +0200] "GET /.env HTTP/1.1" 403 146 "-" ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 155.2.216.2 (JP/Japan/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 155.2.216.2 - - [24/May/2026:15:50:34 +0200] "GET /.env HTTP/1.1" 403 146 "-" "python-requests/2.26.0" "155.2.216.2" host=abruzzotour.it show less	Port Scan
🇯🇵 SentinalX by uzumaru	2026-05-22 06:28:16 UTC · (5 months ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: icanhazip.com:443	Open Proxy Port Scan
🇳🇱 BlueWire Hosting	2026-05-20 21:30:24 UTC · (5 months ago)	Probing websites for vulnerabilities	Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 10:54:16 UTC · (5 months ago)	(mod_security) mod_security (id:210492) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 06:54:13.077756 2026] [security2:error] [pid 3839:tid 3968] [client 155.2.216.2:54537] ModSecu ... show more (mod_security) mod_security (id:210492) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 06:54:13.077756 2026] [security2:error] [pid 3839:tid 3968] [client 155.2.216.2:54537] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stephanietobola.com"] [uri "/.env"] [unique_id "agb7VXupFPP7_xe8IfV6JAAAAQw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Carsten	2026-05-04 04:23:34 UTC · (6 months ago)	GET [vendor/phpunit/phpunit/phpunit.xsd]	Port Scan
🇺🇸 Starburst SysOp Team	2026-05-02 21:16:44 UTC · (6 months ago)	(mod_security-custom) mod_security (id:210730) triggered by 155.2.216.2 (JP/Japan/Tokyo/Shibuya City/-/[AS212238 CDNEXT]): 1 in the last 3600 secs (0-srv1)	Hacking
🇩🇪 FeG Deutschland	2026-05-02 21:05:16 UTC · (6 months ago)	Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124	Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-05-02 16:19:09 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 12:19:05.852528 2026] [security2:error] [pid 585:tid 585] [client 155.2.216.2:26619] ModSecuri ... show more (mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 12:19:05.852528 2026] [security2:error] [pid 585:tid 585] [client 155.2.216.2:26619] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|northmyrtlebeachcondos.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "northmyrtlebeachcondos.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afYj-Us9uK9nBXPoRldVBgAAAB0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-02 15:05:35 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 11:05:30.834081 2026] [security2:error] [pid 22987:tid 22987] [client 155.2.216.2:31153] ModSe ... show more (mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 11:05:30.834081 2026] [security2:error] [pid 22987:tid 22987] [client 155.2.216.2:31153] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.cubbylure.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cubbylure.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afYSun1wDyq6Ah_Mgr9ACgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-02 11:53:38 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 07:53:33.823635 2026] [security2:error] [pid 28167:tid 28167] [client 155.2.216.2:53223] ModSe ... show more (mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 07:53:33.823635 2026] [security2:error] [pid 28167:tid 28167] [client 155.2.216.2:53223] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.britanniapilates.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.britanniapilates.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afXlvbZlZJ5Rgoff561YJQAAACE"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-02 11:01:16 UTC · (6 months ago)	(mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 07:01:13.228766 2026] [security2:error] [pid 6285:tid 6285] [client 155.2.216.2:37635] ModSecu ... show more (mod_security) mod_security (id:210730) triggered by 155.2.216.2 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 07:01:13.228766 2026] [security2:error] [pid 6285:tid 6285] [client 155.2.216.2:37635] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|psychicangelreader.com\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "psychicangelreader.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "afXZeWw5hAnMW8y8Ka91lAAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 16 to 30 of 62 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇹🇼 111.70.49.181

🇺🇸 104.168.56.82

🇸🇪 92.34.131.5

🇰🇷 221.162.46.22

🇺🇸 216.73.217.139

🇨🇴 190.131.214.114

🇮🇩 103.112.5.35

🇺🇸 98.168.100.72

🇯🇴 94.249.89.106

🇮🇹 79.55.180.145

🇺🇸 70.184.163.235

🇺🇸 66.80.28.244

🇺🇸 206.189.191.93

🇬🇧 188.240.59.56

🇧🇷 172.69.11.214

🇳🇱 77.67.26.59

🇺🇸 66.80.28.221

🇵🇱 54.38.52.18

🇦🇷 31.40.212.77

🇺🇸 2001:5a8:453c:8e00:e87c:161f:fbac:7c2c