AbuseIPDB » 223.109.252.251
223.109.252.251
This IP was reported 288 times. Confidence of
Abuse
is 57% : ?
ISP
China Mobile Communications Corporation
Usage Type
Fixed Line ISP
ASN
AS56046
Domain Name
chinamobile.com
Country
🇨🇳
China
City
Nanjing, Jiangsu
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 223.109.252.251 :
This IP address has been reported a total of
288
times from
38 distinct
sources.
223.109.252.251 was first reported on
June 8th 2024 , and the most recent report was
9 hours ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇫🇷
Sklurk
2026-06-26 04:11:41
(9 hours ago)
Web App Attack
Web App Attack
2026-06-26 03:34:54
(10 hours ago)
Session Crossing
Hacking
🇫🇷
Sklurk
2026-06-25 04:04:59
(1 day ago)
Web App Attack
Web App Attack
2026-06-25 00:27:16
(1 day ago)
Session Crossing
Hacking
🇫🇷
Sklurk
2026-06-24 03:42:30
(2 days ago)
Web App Attack
Web App Attack
2026-06-23 17:47:07
(2 days ago)
Session Crossing
Hacking
🇫🇷
Sklurk
2026-06-23 00:50:29
(3 days ago)
Web App Attack
Web App Attack
2026-06-22 13:10:19
(4 days ago)
Session Crossing
Hacking
🇺🇸
TPI-Abuse
2026-06-21 20:18:29
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 223.109.252.251 (sogouspider-223-109-252-251.cr ...
show more
(mod_security) mod_security (id:210730) triggered by 223.109.252.251 (sogouspider-223-109-252-251.crawl.sogou.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 16:18:23.009206 2026] [security2:error] [pid 19457:tid 19457] [client 223.109.252.251:48592] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.scoutinsignia.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.scoutinsignia.com"] [uri "/insignia/WS_FTP.LOG"] [unique_id "ajhHD9OT2lh0Yq8I2Sh6KwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-21 11:13:12
(5 days ago)
Session Crossing
Hacking
🇨🇦
1gz
2026-06-21 07:17:52
(5 days ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/studenteve/
UA: Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-06-20 09:21:08
(6 days ago)
Session Crossing
Hacking
🇫🇷
Sklurk
2026-06-19 16:27:21
(6 days ago)
Web App Attack
Web App Attack
🇨🇦
1gz
2026-06-19 06:43:08
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /showbiz/whatsapp-sjell-biseda-incognito-me-ai-as-kompania-nuk-i-lexon-me-mesazhet-rritet-privatesia-e-perdoruesve/879215/
UA: Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-06-19 03:57:00
(1 week ago)
Session Crossing
Hacking
Showing 1 to
15
of 288 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: