JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.20.68

120.230.20.68 was found in our database!

This IP was reported 5 times. Confidence of Abuse is 2%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.20.68

Whois 120.230.20.68

IP Abuse Reports for 120.230.20.68:

This IP address has been reported a total of 5 times from 2 distinct sources. 120.230.20.68 was first reported on March 7th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-12 02:55:18 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 22:55:12.462837 2026] [security2:error] [pid 15484:tid 15484] [client 120.230.20.68:4879] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.15tobefit.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.15tobefit.com"] [uri "/"] [unique_id "ait1EDFPShTiB_rzQUTN4QAAAAs"], referer: http://www.15tobefit.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 17:59:33 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 13:59:28.002386 2026] [security2:error] [pid 12486:tid 12486] [client 120.230.20.68:11937] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.washburn-books.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.washburn-books.com"] [uri "/"] [unique_id "air3f_RFZGDEO3h7WvuYMAAAAAg"], referer: https://www.washburn-books.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-11 01:04:25 (3 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 21:04:17.663846 2026] [security2:error] [pid 31309:tid 31309] [client 120.230.20.68:4759] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.tcmu.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.tcmu.org"] [uri "/"] [unique_id "aioJkcFKnb2PVbeMMjB8swAAAAg"], referer: http://www.tcmu.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 20:45:23 (4 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.20.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 16:45:15.819968 2026] [security2:error] [pid 22896:tid 22896] [client 120.230.20.68:16961] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|raintechgutters.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "raintechgutters.com"] [uri "/"] [unique_id "aiCSW7blDmWEniO_oPvLdQAAAAo"], referer: http://raintechgutters.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-03-07 02:25:18 (3 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.68 2026-03-06 03 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.20.68 2026-03-06 03:33:10 / show less	Web App Attack

Showing 1 to 5 of 5 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 205.210.31.19

🇳🇬 152.32.140.20

🇮🇳 103.87.57.8

🇮🇳 72.61.229.41

🇩🇪 69.5.169.111

🇩🇪 69.5.169.63

🇩🇪 69.5.169.54

🇩🇪 69.5.169.8

🇨🇱 45.160.191.86

🇷🇺 31.173.0.46

🇫🇷 193.70.122.120

🇵🇭 180.191.171.47

🇳🇱 91.92.40.231

🇺🇸 66.132.172.102

🇳🇱 45.142.193.164

🇳🇱 34.12.77.43

🇨🇳 27.204.193.82

🇺🇸 2602:f6f6:2:dc17::1

🇮🇳 2405:201:e018:302f:7559:4d6b:9a75:97c9

🇨🇳 223.210.27.53