JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 42.236.12.211

42.236.12.211 was found in our database!

This IP was reported 159 times. Confidence of Abuse is 0%: ?

ISP	China Unicom Henan province network
Usage Type	Fixed Line ISP
ASN	AS4837
Hostname(s)	hn.kd.ny.adsl
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Zhengzhou, Henan

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 42.236.12.211

Whois 42.236.12.211

IP Abuse Reports for 42.236.12.211:

This IP address has been reported a total of 159 times from 37 distinct sources. 42.236.12.211 was first reported on February 20th 2022, and the most recent report was 6 months ago.

Old Reports: The most recent abuse report for this IP address is from 6 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 gnom4ik	2026-02-20 19:43:34 (6 months ago)	ban-reviewer auto report; ip=42.236.12.211; scenario=http:scan; verdict=valid_ban; confidence=0.85; ... show more ban-reviewer auto report; ip=42.236.12.211; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=IP flagged for HTTP scanning activity (scenario: http:scan); AbuseIPDB categories include Port Scan (14) and Hacking (15), consistent with scan behavior; Decision is part of a sustained ban pattern with no recent active decisions show less	Port Scan Hacking Brute-Force
🇨🇦 Mediashaker	2026-01-30 20:19:53 (6 months ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.211 (CN/Ch ... show more (apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.211 (CN/China/hn.kd.ny.adsl) show less	Bad Web Bot
🇺🇸 TPI-Abuse	2026-01-29 11:52:18 (6 months ago)	(mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 06:52:15.167393 2026] [security2:error] [pid 31991:tid 31991] [client 42.236.12.211:61132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.arthuryeung.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.arthuryeung.net"] [uri "/"] [unique_id "aXtJ72M8VCdnI6g9dlBzGgAAAAI"], referer: http://www.arthuryeung.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-29 09:40:38 (6 months ago)	(mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 04:40:32.171061 2026] [security2:error] [pid 29238:tid 29286] [client 42.236.12.211:62051] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|boracayglobal.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "boracayglobal.org"] [uri "/"] [unique_id "aXsrECs7D0kWZw13Cc8hgwAAAUk"], referer: http://boracayglobal.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-29 09:09:37 (6 months ago)	(mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 04:09:34.311548 2026] [security2:error] [pid 21754:tid 21754] [client 42.236.12.211:9335] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|richobservatory.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "richobservatory.com"] [uri "/"] [unique_id "aXsjzk8yqEZAkNVe8xSx7wAAAAI"], referer: http://richobservatory.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-29 08:00:45 (6 months ago)	(mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 03:00:42.763672 2026] [security2:error] [pid 9048:tid 9048] [client 42.236.12.211:27030] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|bernardtardy.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "bernardtardy.com"] [uri "/"] [unique_id "aXsTquuAXY1z840UDJ8NfgAAAAY"], referer: http://bernardtardy.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-29 07:20:23 (6 months ago)	(mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 02:20:18.235935 2026] [security2:error] [pid 19184:tid 19184] [client 42.236.12.211:15249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.yuichiro.us\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.yuichiro.us"] [uri "/"] [unique_id "aXsKMgQopbhkqpNe-xa81AAAAAg"], referer: https://www.yuichiro.us/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-01-28 23:58:44 (6 months ago)	ThreatBook Intelligence: IDC more details on http://threatbook.io/ip/42.236.12.211 2026-01-28 05:30: ... show more ThreatBook Intelligence: IDC more details on http://threatbook.io/ip/42.236.12.211 2026-01-28 05:30:15 /dfdfd show less	Web App Attack
🇺🇸 TPI-Abuse	2026-01-26 15:52:31 (7 months ago)	(mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:210831) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 10:52:26.758547 2026] [security2:error] [pid 22979:tid 22979] [client 42.236.12.211:61929] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|renjunews.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "renjunews.com"] [uri "/"] [unique_id "aXeNuoh7NQ4j_rkQ02lm-gAAAAE"], referer: https://renjunews.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-10-11 09:22:33 (10 months ago)	(mod_security) mod_security (id:225170) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 30 ... show more (mod_security) mod_security (id:225170) triggered by 42.236.12.211 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 11 05:22:29.740534 2025] [security2:error] [pid 26370:tid 26370] [client 42.236.12.211:22255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)\|\|www.kengarysp.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.kengarysp.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aOoh1deAnG95pBW-C-zPFQAAAAs"], referer: https://www.kengarysp.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 rh24	2025-10-05 08:32:04 (10 months ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.211 (CN/Ch ... show more (apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.211 (CN/China/hn.kd.ny.adsl) show less	Bad Web Bot
🇨🇳 ThreatBook.io	2025-10-02 23:09:55 (10 months ago)	ThreatBook Intelligence: Zombie,IDC more details on https://threatbook.io/ip/42.236.12.211 2025-10-0 ... show more ThreatBook Intelligence: Zombie,IDC more details on https://threatbook.io/ip/42.236.12.211 2025-10-02 01:10:26 /dfdfd show less	Web App Attack
Anonymous	2025-09-25 11:08:01 (11 months ago)	Excessive crawling/scraping	Hacking Brute-Force
🇩🇪 rh24	2025-08-28 14:53:59 (11 months ago)	(apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.211 (CN/Ch ... show more (apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.211 (CN/China/hn.kd.ny.adsl) show less	Bad Web Bot
🇹🇷 rtbh.com.tr	2025-08-16 20:08:16 (1 year ago)	list.rtbh.com.tr report: tcp/0	Brute-Force

Showing 1 to 15 of 159 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇩 202.155.157.112

🇻🇪 201.249.87.201

🇩🇪 165.227.173.41

🇮🇩 163.7.4.169

🇳🇱 160.119.71.92

🇺🇸 153.75.245.149

🇪🇸 79.116.236.232

🇺🇸 76.81.71.226

🇺🇸 66.99.48.136

🇬🇧 45.82.76.116

🇩🇪 8.211.24.197

🇮🇳 223.190.87.173

🇺🇸 209.38.69.12

🇦🇷 200.63.111.101

🇰🇷 175.203.57.19

🇺🇸 172.68.174.104

🇻🇳 171.252.152.237

🇨🇳 121.235.174.13

🇺🇸 104.28.233.73

🇨🇳 101.96.230.94