JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 222.92.223.252

222.92.223.252 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 13%: ?

13%

ISP	CHINANET BACKBONE
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.com.cn
Country	🇨🇳 China
City	Zhangjiagang, Jiangsu

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 222.92.223.252

Whois 222.92.223.252

IP Abuse Reports for 222.92.223.252:

This IP address has been reported a total of 16 times from 3 distinct sources. 222.92.223.252 was first reported on June 4th 2025, and the most recent report was 16 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-08 02:25:19 (16 hours ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 22:25:14.039942 2026] [security2:error] [pid 14411:tid 14411] [client 222.92.223.252:35393] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|pointandshootfilm.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "pointandshootfilm.com"] [uri "/"] [unique_id "ak21CssUGoHDNPzIbVkV_AAAAAw"], referer: http://pointandshootfilm.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 12:23:52 (6 days ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 08:23:44.233886 2026] [security2:error] [pid 1560:tid 1560] [client 222.92.223.252:27191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.davesastro.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.davesastro.com"] [uri "/"] [unique_id "akZYUO6bInsFGS8-pGjw0QAAABQ"], referer: http://www.davesastro.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-19 22:20:21 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 18:20:17.180536 2026] [security2:error] [pid 27085:tid 27085] [client 222.92.223.252:8154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.praemiumtech.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.praemiumtech.com"] [uri "/index.php"] [unique_id "ajXAobwdBEYg06El3Lut1wAAAAM"], referer: http://www.praemiumtech.com/index.php show less	Brute-Force Bad Web Bot Web App Attack
🇦🇺 paulshipley.com.au	2026-06-16 16:27:13 (3 weeks ago)	[Wed Jun 17 02:27:12.756345 2026] [security2:error] [pid 270483] [client 222.92.223.252:28110] [clie ... show more [Wed Jun 17 02:27:12.756345 2026] [security2:error] [pid 270483] [client 222.92.223.252:28110] [client 222.92.223.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ccideas.com.au"] [uri "/"] [unique_id "ajF5YCutmc3yMVMTwmYdwQAAAAA"], referer: https://ccideas.com.au// ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 23:09:37 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 19:09:31.225714 2026] [security2:error] [pid 1046:tid 1046] [client 222.92.223.252:60725] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.styxwetworld.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.styxwetworld.com"] [uri "/index.php"] [unique_id "ag4_K6yLQX2UJneSANigcAAAAAA"], referer: http://www.styxwetworld.com/index.php show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-13 20:14:06 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 16:14:01.632821 2026] [security2:error] [pid 32711:tid 32711] [client 222.92.223.252:41325] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|daos.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "daos.org"] [uri "/"] [unique_id "agTbicyR365GaaIL7nO5NwAAAAg"], referer: https://daos.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-05-06 01:25:26 (2 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2026-05-05 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2026-05-05 06:04:07 /dfdfd show less	Web App Attack
🇺🇸 TPI-Abuse	2026-04-03 02:32:36 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 22:32:28.912188 2026] [security2:error] [pid 14026:tid 14026] [client 222.92.223.252:3407] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|zazuza.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "zazuza.com"] [uri "/"] [unique_id "ac8mvL2RZrdQUDenAtywHAAAAAM"], referer: http://zazuza.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-26 23:13:21 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 18:13:16.708469 2026] [security2:error] [pid 25301:tid 25301] [client 222.92.223.252:40342] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.awl-v.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.awl-v.com"] [uri "/"] [unique_id "aaDTjLyqQ0q4cRiKN7A3PgAAAAw"], referer: http://www.awl-v.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-01 21:04:11 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 16:04:08.166180 2026] [security2:error] [pid 25152:tid 25152] [client 222.92.223.252:55008] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.osbyink.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.osbyink.com"] [uri "/"] [unique_id "aX-_yHTAVwHnGnKL2wp3kAAAAA4"], referer: http://www.osbyink.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-24 22:15:26 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 222.92.223.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 24 17:15:19.025871 2026] [security2:error] [pid 23791:tid 23791] [client 222.92.223.252:34678] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|misscharlottemusic.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "misscharlottemusic.com"] [uri "/"] [unique_id "aXVEdwW0mAwAoOJ3RCb1mgAAAAU"], referer: https://misscharlottemusic.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-08-04 23:53:17 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-08-04 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-08-04 15:41:57 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-29 23:38:36 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-07-29 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-07-29 13:48:52 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-23 23:46:55 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-07-23 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-07-23 02:18:21 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-18 23:49:23 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-07-18 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/222.92.223.252 2025-07-18 08:24:01 /config.json show less	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 20.220.226.39

🇺🇸 135.233.97.43

🇨🇦 85.217.149.72

🇨🇱 69.6.227.153

🇱🇹 45.227.254.170

🇳🇱 45.148.10.141

🇧🇷 20.226.16.12

🇵🇰 182.191.77.164

🇫🇷 163.172.60.23

🇺🇸 150.107.38.131

🇧🇪 2a00:1450:400c:c02::12b

🇧🇪 198.235.24.228

🇩🇪 150.241.113.163

🇰🇷 118.39.219.45

🇫🇷 91.231.89.85

🇩🇪 69.5.169.217

🇮🇩 43.243.142.42

🇿🇲 41.63.62.103

🇬🇧 35.203.210.128

🇺🇸 20.168.124.105