JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 218.198.204.252

218.198.204.252 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 5%: ?

ISP	China Education and Research Network
Usage Type	University/College/School
ASN	AS4538
Domain Name	cernet.edu.cn
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 218.198.204.252

Whois 218.198.204.252

IP Abuse Reports for 218.198.204.252:

This IP address has been reported a total of 9 times from 3 distinct sources. 218.198.204.252 was first reported on March 7th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-09 00:47:30 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 20:47:23.402814 2026] [security2:error] [pid 22362:tid 22362] [client 218.198.204.252:0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:user-agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.pixacast.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.pixacast.com"] [uri "/"] [unique_id "ak7vm4UGnzgsFf5wu0bUUQAAABY"], referer: http://www.pixacast.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-04 19:41:31 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 15:41:25.448264 2026] [security2:error] [pid 1582:tid 1619] [client 218.198.204.252:34627] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|kwainet.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "kwainet.com"] [uri "/"] [unique_id "aklh5dn5XN7mRsF9SFVQggAAARg"], referer: http://kwainet.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-20 21:08:30 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 17:08:20.938639 2026] [security2:error] [pid 23606:tid 23606] [client 218.198.204.252:54358] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.thingstodonude.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.thingstodonude.com"] [uri "/"] [unique_id "ajcBRCdfs_NgqwRFg4Sm0gAAAAQ"], referer: https://www.thingstodonude.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-10 20:50:59 (4 weeks ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 16:50:53.316850 2026] [security2:error] [pid 11252:tid 11252] [client 218.198.204.252:14436] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|gardnercastle.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "gardnercastle.com"] [uri "/"] [unique_id "ainOLVPitfCtDhY4R5xU3QAAAAc"], referer: http://gardnercastle.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-07 03:48:35 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 23:48:16.375001 2026] [security2:error] [pid 1406076:tid 1406076] [client 218.198.204.252:6979] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.diceknobs.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.diceknobs.com"] [uri "/"] [unique_id "adR-gFqYOOBhrR5sXsUt2wAAABk"], referer: http://www.diceknobs.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-03-31 17:23:39 (3 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 TPI-Abuse	2026-03-22 00:09:24 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 20:09:15.505229 2026] [security2:error] [pid 30092:tid 30092] [client 218.198.204.252:34497] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.bknj2.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.bknj2.org"] [uri "/"] [unique_id "ab8zK2-yj8MnYYJfdt2V4QAAAA8"], referer: http://www.bknj2.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-16 00:27:24 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 218.198.204.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 15 20:27:16.505896 2026] [security2:error] [pid 25599:tid 25599] [client 218.198.204.252:43993] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.vitalitywebb.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.vitalitywebb.com"] [uri "/"] [unique_id "abdOZFj_uwanrQCEXAT8PwAAAAQ"], referer: http://www.vitalitywebb.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇳 liveaspankaj	2026-03-07 18:38:11 (4 months ago)	DDoS attack: 134 requests in 5m (GET / or repair.php).	DDoS Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇵🇱 176.53.159.198

🇸🇪 157.52.122.49

🇹🇭 110.164.193.195

🇧🇩 103.174.1.85

🇫🇷 85.217.140.34

🇮🇱 203.159.81.17

🇨🇳 175.43.140.18

🇪🇬 156.203.14.97

🇧🇩 103.179.127.27

🇳🇱 77.91.71.11

🇻🇳 2402:800:6173:4960:20a0:f14a:6ed9:ebab

🇺🇸 216.24.212.193

🇧🇷 205.210.31.234

🇺🇸 205.210.31.77

🇩🇪 193.124.20.226

🇨🇳 182.111.127.72

🇧🇴 131.0.197.4

🇨🇳 121.16.16.30

🇨🇳 119.125.69.184

🇺🇸 2a04:c300:400::9f