JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.221.13.87

120.221.13.87 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 42%: ?

42%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Qingdao, Shandong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.221.13.87

Whois 120.221.13.87

IP Abuse Reports for 120.221.13.87:

This IP address has been reported a total of 28 times from 9 distinct sources. 120.221.13.87 was first reported on January 13th 2023, and the most recent report was 7 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 xmission.com	2026-08-23 17:31:20 (7 hours ago)	Blocked by UFW (TCP on 23) Source port: 59622 TTL: 38 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 23) Source port: 59622 TTL: 38 Packet length: 60 TOS: 0x08 This report (for 120.221.13.87) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇫🇷 security.rdmc.fr	2026-08-23 10:31:20 (14 hours ago)	Port Scan Attack proto:TCP src:49387 dst:23	Port Scan
🇩🇪 David Ferneding	2026-08-22 00:57:02 (2 days ago)	Blocked by UFW (TCP on 23) Source port: 7814 TTL: 43 Packet length: 60 TOS: 0x04 This report (for 1 ... show more Blocked by UFW (TCP on 23) Source port: 7814 TTL: 43 Packet length: 60 TOS: 0x04 This report (for 120.221.13.87) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇧🇾 stroytrest	2026-08-18 19:31:58 (5 days ago)	2026-08-18T22:31:58.174660+03:00 gate kernel: [636637.871695] nftables: JAIL-TELNET IN=wan OUT= MAC= ... show more 2026-08-18T22:31:58.174660+03:00 gate kernel: [636637.871695] nftables: JAIL-TELNET IN=wan OUT= MAC= SRC=120.221.13.87 DST=xxx.xxx.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=60563 DF PROTO=TCP SPT=64915 DPT=23 WINDOW=29200 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇺🇸 xmission.com	2026-08-15 12:56:06 (1 week ago)	Blocked by UFW (TCP on 23) Source port: 59748 TTL: 40 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 23) Source port: 59748 TTL: 40 Packet length: 60 TOS: 0x08 This report (for 120.221.13.87) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇫🇷 vtchost.com	2026-08-14 16:08:12 (1 week ago)	2026-08-14T18:08:10.881935+02:00 vmi3491693 kernel: [687560.130470] PORTSCAN: IN=eth0 OUT= MAC=00:50 ... show more 2026-08-14T18:08:10.881935+02:00 vmi3491693 kernel: [687560.130470] PORTSCAN: IN=eth0 OUT= MAC=00:50:56:66:3e:63:c0:69:11:b3:a9:ed:08:00 SRC=120.221.13.87 DST=169.58.138.2 LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=47071 DF PROTO=TCP SPT=34936 DPT=23 WINDOW=14120 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇫🇷 security.rdmc.fr	2026-08-14 03:01:02 (1 week ago)	Port Scan Attack proto:TCP src:20796 dst:23	Port Scan
🇺🇸 xmission.com	2026-08-13 20:03:17 (1 week ago)	Blocked by UFW (TCP on 23) Source port: 30183 TTL: 40 Packet length: 60 TOS: 0x08 This report (for ... show more Blocked by UFW (TCP on 23) Source port: 30183 TTL: 40 Packet length: 60 TOS: 0x08 This report (for 120.221.13.87) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Hacking Brute-Force
🇨🇦 DRI	2026-08-13 06:44:49 (1 week ago)	Unsolicited TCP traffic on Honeypot, srcport=54812 dstport=23	Port Scan Hacking
🇺🇸 TPI-Abuse	2026-06-21 01:30:18 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.221.13.87 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.221.13.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 20 21:30:12.441101 2026] [security2:error] [pid 27862:tid 27862] [client 120.221.13.87:41205] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.frightlibrary.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.frightlibrary.org"] [uri "/"] [unique_id "ajc-pNph_IKb0HdqF1qbUAAAAAI"], referer: http://www.frightlibrary.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇷🇸 Scan	2024-04-30 07:11:27 (2 years ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇷🇸 Scan	2024-04-13 02:12:33 (2 years ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇷🇸 Scan	2024-04-12 01:11:38 (2 years ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇷🇸 Scan	2024-04-10 11:26:41 (2 years ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇷🇸 Scan	2024-04-09 07:56:20 (2 years ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking

Showing 1 to 15 of 28 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇪 185.99.6.88

🇻🇪 181.208.65.238

🇻🇪 153.51.224.70

🇨🇳 153.0.195.252

🇫🇷 88.176.80.23

🇺🇸 66.132.172.153

🇬🇧 62.60.130.253

🇲🇦 41.141.64.243

🇺🇸 34.125.233.225

🇺🇸 34.125.25.70

🇩🇪 8.209.105.49

🇷🇴 2.57.121.112

🇦🇺 216.226.77.30

🇺🇸 205.210.31.98

🇦🇷 191.84.255.171

🇺🇸 167.172.238.224

🇧🇷 131.72.123.141

🇨🇳 111.228.38.90

🇮🇶 65.20.153.146

🇳🇱 45.148.10.183