JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 27.21.28.252

27.21.28.252 was found in our database!

This IP was reported 42 times. Confidence of Abuse is 92%: ?

92%

ISP	CHINANET Hubei province network
Usage Type	Fixed Line ISP
ASN	AS4134
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Wuhan, Hubei

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 27.21.28.252

Whois 27.21.28.252

IP Abuse Reports for 27.21.28.252:

This IP address has been reported a total of 42 times from 20 distinct sources. 27.21.28.252 was first reported on August 7th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇷 mail.avx.gr	2026-08-21 17:33:46 (1 day ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 27.21.28.252 - - [15/Aug/2026:13:05:51 +0300] "GE ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 27.21.28.252 - - [15/Aug/2026:13:05:51 +0300] "GET /.env HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0" show less	Web App Attack
🇨🇭 4server	2026-08-18 10:58:12 (4 days ago)	[TueAug1812:58:05.6751132026][security2:error][pid2975481:tid2975774][client27.21.28.252:0]ModSecuri ... show more [TueAug1812:58:05.6751132026][security2:error][pid2975481:tid2975774][client27.21.28.252:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"465\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"www.marcionetti.es\"][uri\"/.env\"][unique_id\"aoQ6vSrS4TUOffT3Wa6PzAAAABg\"] show less	Hacking Web App Attack
🇬🇧 consul.to	2026-08-18 07:24:37 (4 days ago)	Web attack/malicious scanning detected	Web App Attack
🇫🇷 bazter.pro	2026-08-17 20:07:15 (4 days ago)	Auto-Ban [2026-08-17 23:07:15]: CRITICAL: .env attack [Paths: 11] \| Details: Exploit trap paths: /.e ... show more Auto-Ban [2026-08-17 23:07:15]: CRITICAL: .env attack [Paths: 11] \| Details: Exploit trap paths: /.env \| Sensitive files/paths: /.env \| 404 errors (14): /users/sign_in, /login/, /.env, /telescope, /geoserver/rest/about/version.json, /, /a1b2c3d4e5f6-not-found, /login/index.php, /_ignition/health-check, /_debugbar/open (and 1 more) show less	Web App Attack Hacking
🇺🇸 TPI-Abuse	2026-08-17 19:07:17 (4 days ago)	(mod_security) mod_security (id:210492) triggered by 27.21.28.252 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 27.21.28.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 15:07:14.078896 2026] [security2:error] [pid 3565:tid 3565] [client 27.21.28.252:60452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.blackriverarc.org"] [uri "/.env"] [unique_id "aoNb4r0KlANi5wcsMvYCGwAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 s@ch@	2026-08-17 11:00:01 (5 days ago)	Jail: plesk-modsecurity \| Web application attack (Plesk ModSecurity)	Web App Attack
🇺🇸 TPI-Abuse	2026-08-17 04:04:30 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 27.21.28.252 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 27.21.28.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 00:04:26.326110 2026] [security2:error] [pid 14086:tid 14086] [client 27.21.28.252:52140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.marykaydesign.net"] [uri "/.env"] [unique_id "aoKISqmf1FFWsrxkbItGQAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-08-17 00:42:36 (5 days ago)	Multiple WAF Violations	Web App Attack
🇩🇪 LRob	2026-08-16 20:13:27 (5 days ago)	Credential and secrets file probing \| req: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App ... show more Credential and secrets file probing \| req: /.env \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0 show less	Hacking Web App Attack
Anonymous	2026-08-16 15:43:03 (6 days ago)	Bot / scanning and/or hacking attempts: PATCH / HTTP/1.1, GET /_ignition/health-check HTTP/1.1, GET ... show more Bot / scanning and/or hacking attempts: PATCH / HTTP/1.1, GET /_ignition/health-check HTTP/1.1, GET /geoserver/rest/about/version.json HTTP/1.1, GET /wp-login.php HTTP/1.1, GET /login/index.php HTTP/1.1, GET /openbaar-vervoer-op-terschelling/ HTTP/1.1, GET /geoserver/web/ HTTP/1.1, GET /login/ HTTP/1.1, GET / HTTP/1.1, GET /telescope HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-08-15 23:13:33 (6 days ago)	Probing\(3\) HTTP Ports ...	Bad Web Bot Web App Attack
🇩🇪 ddobko	2026-08-15 18:16:20 (1 week ago)		Bad Web Bot Web App Attack
Anonymous	2026-08-15 16:20:05 (1 week ago)	\| [Dangerous/China] Aggressive IP 27.21.28.252 (~30 hits). Type: DoS Defender- Web server 400 error ... show more \| [Dangerous/China] Aggressive IP 27.21.28.252 (~30 hits). Type: DoS Defender- Web server 400 error code show less	Web App Attack Hacking SQL Injection
🇫🇷 mail.avx.gr	2026-08-15 10:05:52 (1 week ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 27.21.28.252 - - [15/Aug/2026:13:05:51 +0300] "GE ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 27.21.28.252 - - [15/Aug/2026:13:05:51 +0300] "GET /.env HTTP/2.0" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-14 23:07:34 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 27.21.28.252 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 27.21.28.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 14 19:07:26.876862 2026] [security2:error] [pid 15077:tid 15077] [client 27.21.28.252:60150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.sitexpress.es"] [uri "/.env"] [unique_id "an-fruGlHrBUazQMhzaYcAAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 42 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.68.163.132

🇳🇱 34.187.58.163

🇨🇳 222.212.91.18

🇰🇷 221.161.150.151

🇫🇷 217.182.253.249

🇮🇳 203.193.168.136

🇹🇼 198.235.24.102

🇩🇪 187.13.9.5

🇺🇸 172.217.106.209

🇦🇷 170.155.12.8

🇺🇸 139.144.239.72

🇨🇳 115.63.246.154

🇰🇪 102.0.27.152

🇺🇸 43.166.245.172

🇨🇦 20.151.141.175

🇭🇰 8.218.114.99

🇺🇸 2607:f8b0:4023:100d::12e

🇧🇪 198.235.24.218

🇪🇬 197.120.50.182

🇧🇷 191.6.126.81