JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 222.138.119.137

222.138.119.137 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 4%: ?

ISP	China Unicom Henan province network
Usage Type	Fixed Line ISP
ASN	AS4837
Hostname(s)	hn.kd.ny.adsl
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Zhengzhou, Henan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 222.138.119.137

Whois 222.138.119.137

IP Abuse Reports for 222.138.119.137:

This IP address has been reported a total of 17 times from 10 distinct sources. 222.138.119.137 was first reported on October 15th 2021, and the most recent report was 4 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-26 21:25:13 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last ... show more (mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 17:25:10.060634 2026] [security2:error] [pid 14623:tid 14623] [client 222.138.119.137:51380] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|madbanana.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "madbanana.com"] [uri "/"] [unique_id "aj7uNoerwXp4Vah8uPzu_QAAAAY"], referer: http://madbanana.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 19:12:40 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last ... show more (mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 15:12:36.495588 2026] [security2:error] [pid 4271:tid 4271] [client 222.138.119.137:29657] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ralphharris.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ralphharris.org"] [uri "/"] [unique_id "aj19pFbfCCopBXDsUU_KeQAAAAs"], referer: https://ralphharris.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-25 01:27:50 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last ... show more (mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 21:27:45.744762 2026] [security2:error] [pid 23355:tid 23355] [client 222.138.119.137:57590] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|shtondo.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "shtondo.com"] [uri "/"] [unique_id "ajyEESBQfzXzWavlBkpgjAAAAA8"], referer: http://shtondo.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 22:05:23 (6 days ago)	(mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last ... show more (mod_security) mod_security (id:210831) triggered by 222.138.119.137 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 18:05:13.920941 2026] [security2:error] [pid 28633:tid 28633] [client 222.138.119.137:42472] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|depcare.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "depcare.com"] [uri "/index.html"] [unique_id "ajxUmbSQ3T5frWAlJ0DCPAAAABM"], referer: http://depcare.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-02-10 10:23:59 (4 months ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host
🇫🇷 aitenders.com	2024-11-28 10:49:55 (1 year ago)	Port probe: TCP/23	Port Scan
🇺🇸 gu-alvareza	2024-11-28 07:05:20 (1 year ago)	Multiple.Routers.GPON.formLogin.Remote.Command.Injection	SQL Injection Web App Attack
🇷🇸 Scan	2024-11-28 02:57:17 (1 year ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇳🇱 Study Bitcoin 🤗	2024-11-27 03:14:40 (1 year ago)	Port probe to tcp/81 (hosts2 name) [srv132]	Port Scan
🇷🇸 Scan	2024-11-26 05:28:11 (1 year ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 MPL	2024-11-26 04:48:35 (1 year ago)	tcp/23	Port Scan
🇺🇸 MPL	2024-11-26 03:35:53 (1 year ago)	tcp/23 (2 or more attempts)	Port Scan
🇹🇼 kk_it_man	2024-11-25 20:40:06 (1 year ago)	honey catch	Port Scan
Anonymous	2024-11-25 20:16:32 (1 year ago)	Unauthorized connection attempt on Port 2323	Port Scan Hacking Exploited Host
🇫🇷 security.rdmc.fr	2023-05-03 03:48:29 (3 years ago)	VoIP Attack proto:UDP src:1434 dst:5060	Fraud VoIP Port Scan

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.81.233.235

🇩🇪 82.165.104.147

🇲🇾 47.250.88.140

🇺🇸 44.106.253.55

🇨🇳 39.187.122.66

🇩🇪 217.154.253.251

🇬🇧 193.163.125.233

🇺🇸 143.244.165.176

🇮🇳 136.232.11.10

🇭🇰 101.32.208.70

🇺🇸 66.240.205.34

🇸🇬 52.139.198.12

🇺🇸 13.89.125.21

🇨🇴 200.119.56.213

🇺🇸 199.96.166.79

🇺🇸 45.156.129.77

🇷🇺 213.234.5.66

🇷🇺 138.124.69.150

🇺🇸 132.148.155.138

🇺🇸 118.26.109.7