JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.20.253

120.230.20.253 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 4%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.20.253

Whois 120.230.20.253

IP Abuse Reports for 120.230.20.253:

This IP address has been reported a total of 15 times from 2 distinct sources. 120.230.20.253 was first reported on March 31st 2025, and the most recent report was 5 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-26 22:13:08 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 18:13:02.537655 2026] [security2:error] [pid 18312:tid 18429] [client 120.230.20.253:5044] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.jeflis.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.jeflis.com"] [uri "/"] [unique_id "aj75br2VCng14LeCrrn8qAAAAMo"], referer: http://www.jeflis.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 21:03:11 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 17:03:03.618293 2026] [security2:error] [pid 32163:tid 32163] [client 120.230.20.253:9656] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.achildsspace.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.achildsspace.com"] [uri "/403.shtml"] [unique_id "ag9zB4Zp1FamH2nvSmO4kgAAAAQ"], referer: https://www.achildsspace.com/403.shtml show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-29 05:55:41 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 01:55:34.019250 2026] [security2:error] [pid 18518:tid 18518] [client 120.230.20.253:6126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|stbms.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "stbms.com"] [uri "/"] [unique_id "aci-1vNnsDXeZTbaVl5V_wAAAAQ"], referer: http://stbms.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-03-26 23:24:17 (3 months ago)	ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.230.20.253 2026-0 ... show more ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.230.20.253 2026-03-26 03:17:28 /favicon64.ico show less	Web App Attack
🇺🇸 TPI-Abuse	2026-03-22 05:42:35 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 01:42:30.201641 2026] [security2:error] [pid 2270:tid 2270] [client 120.230.20.253:8019] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|yourbrandhere.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "yourbrandhere.com"] [uri "/"] [unique_id "ab-BRskGWwUly9FCp8frHAAAAAI"], referer: http://yourbrandhere.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-21 22:22:08 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 18:22:02.197334 2026] [security2:error] [pid 18348:tid 18348] [client 120.230.20.253:21246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ericeschenbach.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ericeschenbach.com"] [uri "/"] [unique_id "ab8aCjVIGVqbIexD4vH_ZAAAABo"], referer: http://ericeschenbach.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-14 23:35:07 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 19:34:57.246183 2026] [security2:error] [pid 27881:tid 27881] [client 120.230.20.253:14462] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|girardonline.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "girardonline.net"] [uri "/"] [unique_id "abXwoUpuaR0-Xzw8__EquAAAAA4"], referer: http://girardonline.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-26 21:51:52 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.253 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 16:51:48.554234 2026] [security2:error] [pid 30706:tid 30706] [client 120.230.20.253:19125] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|rosawallas.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rosawallas.com"] [uri "/"] [unique_id "aXfh9KytSz0-d1T1kUjtGAAAAAE"], referer: http://rosawallas.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-10-02 22:31:39 (8 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-10-02 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-10-02 02:11:14 /favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-22 22:38:41 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-07-22 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-07-22 07:45:50 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-21 22:35:55 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-07-21 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-07-21 04:01:40 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-16 22:42:31 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-07-16 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-07-16 04:46:00 /favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-12 22:46:00 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-06-12 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-06-12 10:08:04 /favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-01 22:44:17 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-06-01 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-06-01 12:16:00 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-03-31 23:03:26 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-03-31 2 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.253 2025-03-31 23:04:15 /robots.txt show less	Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 58.210.182.18

🇩🇪 185.243.11.39

🇨🇦 172.105.15.153

🇺🇸 162.0.226.2

🇻🇳 160.191.244.158

🇳🇱 91.92.40.233

🇫🇷 51.159.110.167

🇭🇰 47.238.136.107

🇬🇧 46.37.124.20

🇧🇷 45.182.243.94

🇬🇧 45.82.76.104

🇺🇸 44.86.82.75

🇺🇸 20.127.203.209

🇺🇸 209.90.232.26

🇧🇷 205.210.31.225

🇺🇸 198.199.106.159

🇨🇳 182.151.45.136

🇺🇸 158.173.25.3

🇮🇱 79.177.155.190

🇱🇹 62.60.130.219