JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.229.212.65

120.229.212.65 was found in our database!

This IP was reported 22 times. Confidence of Abuse is 14%: ?

14%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.229.212.65

Whois 120.229.212.65

IP Abuse Reports for 120.229.212.65:

This IP address has been reported a total of 22 times from 5 distinct sources. 120.229.212.65 was first reported on May 23rd 2023, and the most recent report was 14 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-31 22:39:45 (14 hours ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 18:39:38.859861 2026] [security2:error] [pid 1049:tid 1049] [client 120.229.212.65:33518] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.xhumanlikerobots.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.xhumanlikerobots.com"] [uri "/"] [unique_id "apYCqlMlmDOC_pRvhDcGEQAAAAI"], referer: https://www.xhumanlikerobots.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-26 23:32:33 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 26 19:32:28.254488 2026] [security2:error] [pid 18122:tid 18122] [client 120.229.212.65:33398] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.nationalnova.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.nationalnova.com"] [uri "/"] [unique_id "ao93jFggxm7qL-gkbB5ynwAAABA"], referer: http://www.nationalnova.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2026-08-11 23:48:36 (2 weeks ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2026-07-14 21:41:33 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 17:41:29.318494 2026] [security2:error] [pid 23787:tid 23787] [client 120.229.212.65:25171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|pakistanvision.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "pakistanvision.com"] [uri "/"] [unique_id "alatCbuFACvy5Aoi4GidMgAAABk"], referer: https://pakistanvision.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-14 00:04:16 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 20:04:09.596962 2026] [security2:error] [pid 22451:tid 22451] [client 120.229.212.65:5623] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.muddypuddy.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.muddypuddy.com"] [uri "/index.html"] [unique_id "alV8-VzsxwQbd7t3culiDgAAABA"], referer: http://www.muddypuddy.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 21:35:25 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 17:35:18.146903 2026] [security2:error] [pid 30023:tid 30023] [client 120.229.212.65:25210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.ronaldagrant.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.ronaldagrant.com"] [uri "/"] [unique_id "alVaFhA3ci_NNEWRkcYE4wAAAAI"], referer: http://www.ronaldagrant.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-08 03:23:30 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 23:23:26.533011 2026] [security2:error] [pid 15290:tid 15429] [client 120.229.212.65:25544] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.financialanalyst.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.financialanalyst.org"] [uri "/"] [unique_id "ak3CrhuKak2PviL4KteiNgAAAoo"], referer: https://www.financialanalyst.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 23:21:34 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 19:21:28.627421 2026] [security2:error] [pid 19585:tid 19585] [client 120.229.212.65:19350] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|performingartsguild.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "performingartsguild.com"] [uri "/"] [unique_id "ajR9eD3jD_Kcq9_eIz6G2gAAAAw"], referer: http://performingartsguild.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-18 23:04:57 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.229.212.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 18 19:04:53.362000 2026] [security2:error] [pid 6558:tid 6558] [client 120.229.212.65:19098] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|surrenderhouse.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "surrenderhouse.com"] [uri "/index.html"] [unique_id "ajR5lb5wfdV8HsXHmtFJ6gAAAAA"], referer: http://surrenderhouse.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 exxos	2025-09-25 19:03:01 (11 months ago)	Attacks with Bad user agents	Hacking
🇨🇳 ThreatBook.io	2025-03-10 22:15:19 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.229.212.65 2025-03 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.229.212.65 2025-03-10 06:31:20 /robots.txt 2025-03-10 04:20:08 /config.json 2025-03-10 03:28:18 /config.json show less	Web App Attack
🇿🇦 IrisFlower	2023-05-27 21:18:21 (3 years ago)	Unauthorized connection attempt detected from IP address 120.229.212.65 to port 443 [J]	Port Scan Hacking
🇿🇦 IrisFlower	2023-05-27 20:38:00 (3 years ago)	Unauthorized connection attempt detected from IP address 120.229.212.65 to port 443 [J]	Port Scan Hacking
🇿🇦 IrisFlower	2023-05-27 20:26:23 (3 years ago)	Unauthorized connection attempt detected from IP address 120.229.212.65 to port 443 [J]	Port Scan Hacking
🇿🇦 IrisFlower	2023-05-26 23:31:11 (3 years ago)	Unauthorized connection attempt detected from IP address 120.229.212.65 to port 443 [J]	Port Scan Hacking

Showing 1 to 15 of 22 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇩🇪 194.88.98.113

🇳🇱 193.47.62.69

🇺🇸 172.81.132.173

🇲🇦 105.158.192.91

🇺🇸 100.29.192.96

🇸🇬 88.216.56.86

🇰🇿 5.34.16.57

🇱🇰 220.247.224.226

🇨🇳 220.181.108.84

🇳🇱 195.178.110.227

🇺🇦 195.3.128.118

🇳🇱 172.253.95.221

🇨🇳 171.8.7.8

🇺🇸 135.232.224.102

🇨🇳 111.178.163.164

🇹🇭 45.194.70.253

🇬🇧 34.142.117.111

🇺🇸 34.75.250.100

🇺🇦 31.202.186.245

🇺🇸 18.190.15.50