JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 221.13.134.6

221.13.134.6 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 11%: ?

11%

ISP	China Unicom Henan Province Network
Usage Type	Fixed Line ISP
ASN	AS4837
Hostname(s)	hn.kd.smx.adsl
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Zhengzhou, Henan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 221.13.134.6

Whois 221.13.134.6

IP Abuse Reports for 221.13.134.6:

This IP address has been reported a total of 19 times from 3 distinct sources. 221.13.134.6 was first reported on March 31st 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-30 23:55:33 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 19:55:28.739632 2026] [security2:error] [pid 12001:tid 12001] [client 221.13.134.6:60196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.anchor07.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.anchor07.com"] [uri "/"] [unique_id "akRXcGKKGSMkUvjJY4vOvgAAAAQ"], referer: http://www.anchor07.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 23:34:35 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 19:34:27.324850 2026] [security2:error] [pid 4442:tid 4442] [client 221.13.134.6:42716] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.saimedo.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.saimedo.com"] [uri "/"] [unique_id "aiyXg6OvH3BBSJVFsjmrEQAAAA4"], referer: http://www.saimedo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-24 21:27:52 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 24 17:27:48.267368 2026] [security2:error] [pid 10020:tid 10020] [client 221.13.134.6:33584] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|crixbot.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "crixbot.com"] [uri "/"] [unique_id "ahNtVL6EncKKdlfQCrMAugAAAA0"], referer: http://crixbot.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-05-15 22:28:16 (1 month ago)	ThreatBook Intelligence: Mobile,vpn_proxy more details on https://threatbook.io/ip/221.13.134.6 2026 ... show more ThreatBook Intelligence: Mobile,vpn_proxy more details on https://threatbook.io/ip/221.13.134.6 2026-05-15 02:17:30 /favicon.ico show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 21:43:33 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 17:43:24.287282 2026] [security2:error] [pid 12271:tid 12271] [client 221.13.134.6:19102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|thechoiceint.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "thechoiceint.com"] [uri "/"] [unique_id "agZB_NF6zrv59JM6GbPEsAAAAAY"], referer: http://thechoiceint.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-12 20:32:06 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 16:31:58.217845 2026] [security2:error] [pid 16530:tid 16530] [client 221.13.134.6:14178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|amgtr.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "amgtr.com"] [uri "/"] [unique_id "agOOPvlNZcH7Wa8-sDKVbgAAABk"], referer: http://amgtr.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-04 04:04:19 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 00:04:15.068619 2026] [security2:error] [pid 32395:tid 32395] [client 221.13.134.6:26002] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.myhomeflyer.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.myhomeflyer.com"] [uri "/"] [unique_id "adCNv6zCEFG6US7s8DA6lAAAAB4"], referer: http://www.myhomeflyer.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-03-30 22:24:18 (3 months ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/221.13.134.6 2026-0 ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/221.13.134.6 2026-03-30 07:08:25 / show less	Web App Attack
🇨🇳 ThreatBook.io	2026-03-24 22:28:41 (3 months ago)	ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/221.13.134.6 2026-0 ... show more ThreatBook Intelligence: Zombie,Scanner more details on https://threatbook.io/ip/221.13.134.6 2026-03-24 00:21:45 / show less	Web App Attack
🇭🇰 18bit.cn	2026-03-19 10:31:53 (3 months ago)	WAF Interception: CC Attack - Blocked due to frequency control / CC protection / anti-hotlinking pol ... show more WAF Interception: CC Attack - Blocked due to frequency control / CC protection / anti-hotlinking policy. Triggers: rate limiting, download abuse, or adaptive frequency control rule. \| Total attacks detected today: 2 show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-02 01:42:33 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 01 20:42:28.748882 2026] [security2:error] [pid 29807:tid 29807] [client 221.13.134.6:36255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.beach98.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.beach98.com"] [uri "/index.html"] [unique_id "aaTrBIsSertgodG37xJSyAAAAAU"], referer: https://www.beach98.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-29 20:46:46 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 221.13.134.6 (hn.kd.smx.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 15:46:39.830253 2026] [security2:error] [pid 4089331:tid 4089331] [client 221.13.134.6:23357] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ccbank.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ccbank.net"] [uri "/"] [unique_id "aXvHL-ACdaoxSQLmJprKNgAAAAg"], referer: https://ccbank.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-12-16 22:29:50 (6 months ago)	ThreatBook Intelligence: vpn_proxy,Gateway more details on https://threatbook.io/ip/221.13.134.6 202 ... show more ThreatBook Intelligence: vpn_proxy,Gateway more details on https://threatbook.io/ip/221.13.134.6 2025-12-16 01:41:20 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-11-21 22:33:19 (7 months ago)	ThreatBook Intelligence: vpn_proxy,Gateway more details on https://threatbook.io/ip/221.13.134.6 202 ... show more ThreatBook Intelligence: vpn_proxy,Gateway more details on https://threatbook.io/ip/221.13.134.6 2025-11-21 14:22:04 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-10-07 22:09:36 (8 months ago)	ThreatBook Intelligence: vpn_proxy,Gateway more details on https://threatbook.io/ip/221.13.134.6 202 ... show more ThreatBook Intelligence: vpn_proxy,Gateway more details on https://threatbook.io/ip/221.13.134.6 2025-10-07 02:19:56 /sitemap.xml show less	Web App Attack

Showing 1 to 15 of 19 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 192.95.10.202

🇸🇬 114.119.139.107

🇺🇸 216.24.210.129

🇷🇸 212.200.112.248

🇧🇪 198.235.24.199

🇹🇼 180.177.202.235

🇧🇷 179.191.65.130

🇫🇷 176.139.16.144

🇭🇰 152.32.239.90

🇮🇹 95.210.105.202

🇳🇱 85.11.167.11

🇰🇬 80.72.181.17

🇺🇸 68.207.224.247

🇺🇸 65.25.85.184

🇰🇷 59.26.208.242

🇬🇧 45.61.173.86

🇯🇵 20.210.91.17

🇰🇿 5.251.131.52

🇰🇿 5.188.253.98

🇰🇷 211.105.229.237