JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

221.225.195.13

Neutral Activity

Abuse Confidence Score

0% Low Risk

3 reports

1 reporter · latest 4 months ago

ISP: CHINANET jiangsu province network
Usage Type: Fixed Line ISP
ASN: AS140292
Domain Name: chinatelecom.cn
Country: 🇨🇳 China
City: Nanjing, Jiangsu

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

221.225.195.13 has been reported 3 times. The most recent report is from 4 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

3 from 1 distinct reporter

First reported

June 14th 2026

Most recent report

4 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-29 21:19:59 UTC · (4 months ago)	(mod_security) mod_security (id:210831) triggered by 221.225.195.13 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 17:19:54.850726 2026] [security2:error] [pid 21927:tid 21927] [client 221.225.195.13:19127] ... show more (mod_security) mod_security (id:210831) triggered by 221.225.195.13 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 17:19:54.850726 2026] [security2:error] [pid 21927:tid 21927] [client 221.225.195.13:19127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|psychologists-omega.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "psychologists-omega.com"] [uri "/"] [unique_id "akLheoePXkL7X-cU1fxcywAAAAE"], referer: http://psychologists-omega.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 22:19:18 UTC · (4 months ago)	(mod_security) mod_security (id:210831) triggered by 221.225.195.13 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 18:19:13.133355 2026] [security2:error] [pid 15476:tid 15476] [client 221.225.195.13:18530] ... show more (mod_security) mod_security (id:210831) triggered by 221.225.195.13 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 18:19:13.133355 2026] [security2:error] [pid 15476:tid 15476] [client 221.225.195.13:18530] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.watonga.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.watonga.com"] [uri "/index.html"] [unique_id "ajsGYUF0iCVm96wzaUkXoQAAAAo"], referer: http://www.watonga.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-14 22:42:45 UTC · (4 months ago)	(mod_security) mod_security (id:210831) triggered by 221.225.195.13 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 18:42:37.933483 2026] [security2:error] [pid 6178:tid 6178] [client 221.225.195.13:20850] M ... show more (mod_security) mod_security (id:210831) triggered by 221.225.195.13 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 18:42:37.933483 2026] [security2:error] [pid 6178:tid 6178] [client 221.225.195.13:20850] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|northfultonneurology.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "northfultonneurology.com"] [uri "/"] [unique_id "ai8uXfKAm-bwKo03tlMYmwAAAA0"], referer: http://northfultonneurology.com/ show less	Brute-Force Bad Web Bot Web App Attack

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇸🇪 217.208.90.253

🇺🇸 157.230.191.111

🇳🇱 86.38.187.215

🇳🇱 109.160.32.163

🇬🇧 35.203.211.140

🇺🇸 34.22.50.240

🇧🇪 198.235.24.173

🇺🇸 191.101.241.242

🇧🇷 45.228.35.83

🇦🇺 2400:6180:10:200::f6a8:c000

🇺🇸 209.85.221.172

🇦🇱 81.26.206.252

🇷🇴 80.94.92.128

🇨🇳 223.107.72.234

🇺🇸 170.106.84.136

🇺🇸 162.216.150.179

🇨🇳 120.48.52.177

🇫🇷 85.217.140.53

🇹🇬 156.38.83.208

🇨🇳 116.172.93.48