JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 223.109.252.253

223.109.252.253 was found in our database!

This IP was reported 231 times. Confidence of Abuse is 50%: ?

50%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS56046
Hostname(s)	sogouspider-223-109-252-253.crawl.sogou.com
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Nanjing, Jiangsu

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 223.109.252.253

Whois 223.109.252.253

IP Abuse Reports for 223.109.252.253:

This IP address has been reported a total of 231 times from 36 distinct sources. 223.109.252.253 was first reported on June 7th 2024, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 Sklurk	2026-06-13 12:08:56 (3 hours ago)	Web App Attack	Web App Attack
🇮🇩 soc-yk	2026-06-12 03:30:53 (1 day ago)	Type: suspicious_network_activity Risk: 72 Events: 1380 Evidence: - Persistent suspicious network a ... show more Type: suspicious_network_activity Risk: 72 Events: 1380 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified show less	Port Scan Hacking
🇮🇩 soc-yk	2026-06-10 14:06:29 (3 days ago)	Type: suspicious_network_activity Risk: 72 Events: 330 Evidence: - Persistent suspicious network ac ... show more Type: suspicious_network_activity Risk: 72 Events: 330 Evidence: - Persistent suspicious network activity detected - Repeated hostile operational behavior observed - Multi-event operational persistence identified - Threat escalation behavior observed show less	Port Scan Hacking
Anonymous	2026-06-10 12:05:54 (3 days ago)	Blocked: Reason='Suspicious traffic score=65 (review-based detection)'; Requests=3	Hacking
🇫🇷 Sklurk	2026-06-10 06:37:03 (3 days ago)	Web App Attack	Web App Attack
🇨🇦 1gz	2026-06-09 07:32:19 (4 days ago)	Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET metho ... show more Triggered Cloudflare WAF (firewallCustom) from CN. Action taken: BLOCK Protocol: HTTP/1.1 (GET method) Endpoint: /shqiperi/vllaznia-dhe-tirana-ja-sa-kushton-dhuna/170428/ UA: Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07) This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less	Bad Web Bot
🇫🇷 Sklurk	2026-06-09 05:53:27 (4 days ago)	Web App Attack	Web App Attack
🇫🇷 Sklurk	2026-06-08 00:25:12 (5 days ago)	Web App Attack	Web App Attack
Anonymous	2026-06-04 06:31:00 (1 week ago)	Double URL encoding detection.	Bad Web Bot
🇩🇪 cloudmax	2026-06-02 06:02:35 (1 week ago)	Cloudmax Protect [BOT BLOCK] - Suspicious User-Agent. Possible resource abuse, excessive requests, o ... show more Cloudmax Protect [BOT BLOCK] - Suspicious User-Agent. Possible resource abuse, excessive requests, or hacking attempt show less	Bad Web Bot
🇬🇧 Mendip_Defender	2026-06-01 00:01:54 (1 week ago)	223.109.252.253 - - [01/Jun/2026:01:01:52 +0100] "GET / HTTP/1.1" 200 4127 "-" "Sogou web spider/4.0 ... show more 223.109.252.253 - - [01/Jun/2026:01:01:52 +0100] "GET / HTTP/1.1" 200 4127 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)" ... show less	Bad Web Bot
🇺🇸 nodepile	2026-05-24 16:52:49 (2 weeks ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache/3bc01a8d4534daeed3921b53166f8497/7/5/75-11262.jpg ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host
🇺🇸 nodepile	2026-05-22 07:56:40 (3 weeks ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache/3bc01a8d4534daeed3921b53166f8497/1/_/1_2762_15.jpg ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host
🇺🇸 nodepile	2026-05-17 13:11:15 (3 weeks ago)	Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache ... show more Requests denied due to active blacklist hits (tenant=82 method=GET path=/media/catalog/product/cache/3bc01a8d4534daeed3921b53166f8497/g/0/g005.jpg ua='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36') show less	Web App Attack Exploited Host
🇺🇸 TPI-Abuse	2026-04-24 15:40:37 (1 month ago)	(mod_security) mod_security (id:210730) triggered by 223.109.252.253 (sogouspider-223-109-252-253.cr ... show more (mod_security) mod_security (id:210730) triggered by 223.109.252.253 (sogouspider-223-109-252-253.crawl.sogou.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 11:40:33.287462 2026] [security2:error] [pid 3628:tid 3628] [client 223.109.252.253:43812] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.vividlee.com\|F\|2"] [data ".bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.vividlee.com"] [uri "/2024/7/2024_Update.bak"] [unique_id "aeuO8UXzSxK4WGhgybY5DQAAADQ"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 231 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇦🇷 190.196.248.140

🇵🇱 185.16.38.31

🇷🇺 176.112.128.143

🇳🇱 85.11.167.118

🇺🇸 64.62.156.172

🇨🇳 58.56.128.190

🇺🇸 18.119.209.50

🇧🇷 177.11.196.84

🇧🇼 168.167.72.132

🇿🇦 165.165.117.11

🇵🇱 79.184.239.149

🇺🇸 64.62.156.78

🇮🇳 49.204.74.149

🇱🇹 5.181.86.46

🇺🇸 2607:f8b0:400e:c1e::120

🇺🇸 2607:f8b0:4001:c62::121

🇨🇳 221.12.37.6

🇫🇷 213.199.38.101

🇨🇿 212.102.39.12

🇫🇷 212.83.145.101