JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.21.123

120.230.21.123 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 3%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.21.123

Whois 120.230.21.123

IP Abuse Reports for 120.230.21.123:

This IP address has been reported a total of 15 times from 4 distinct sources. 120.230.21.123 was first reported on January 25th 2022, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-11 02:02:52 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 22:02:43.557924 2026] [security2:error] [pid 4995:tid 4995] [client 120.230.21.123:5114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.barryschiller.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.barryschiller.com"] [uri "/"] [unique_id "alGkQ7PDrz-aZ8x6RqpmSwAAAAc"], referer: http://www.barryschiller.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-17 13:47:43 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 09:47:38.989372 2026] [security2:error] [pid 5050:tid 5058] [client 120.230.21.123:29514] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|evolutionaryethics.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "evolutionaryethics.com"] [uri "/"] [unique_id "ajKlesw3CdEGHXPRGq88qwAAAII"], referer: http://evolutionaryethics.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-08 04:19:01 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 00:18:50.504761 2026] [security2:error] [pid 10972:tid 10972] [client 120.230.21.123:1062] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|circlehealthcaregroup.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "circlehealthcaregroup.com"] [uri "/"] [unique_id "aiZCqtLBfXv2mebV9CqLjgAAABI"], referer: https://circlehealthcaregroup.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 20:16:07 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 16:16:00.363088 2026] [security2:error] [pid 24131:tid 24221] [client 120.230.21.123:9328] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ardentsi.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ardentsi.com"] [uri "/index.php"] [unique_id "ahSuAMukxLxiheCzBM3KFgAAAQg"], referer: http://ardentsi.com/index.php show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-25 23:23:52 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 19:23:44.930416 2026] [security2:error] [pid 28128:tid 28146] [client 120.230.21.123:6027] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|trust-more.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "trust-more.com"] [uri "/"] [unique_id "ae1NAOtgmfusBUSsRmucDwAAAE8"], referer: http://trust-more.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-03-17 21:28:45 (4 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 TPI-Abuse	2026-02-28 03:55:37 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 27 22:55:28.274461 2026] [security2:error] [pid 31881:tid 31885] [client 120.230.21.123:13913] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.reattaforsale.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.reattaforsale.com"] [uri "/"] [unique_id "aaJnMJGmIXVIZUZgIcFcHAAAAMI"], referer: http://www.reattaforsale.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-16 02:22:25 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 21:22:17.446111 2026] [security2:error] [pid 4798:tid 4798] [client 120.230.21.123:31190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|rajabarber.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rajabarber.com"] [uri "/"] [unique_id "aZJ_WcU55SRskte1Z4s7mgAAABA"], referer: https://rajabarber.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-27 21:12:29 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 27 16:12:24.897988 2026] [security2:error] [pid 30423:tid 30423] [client 120.230.21.123:7611] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.glassicannex.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.glassicannex.org"] [uri "/"] [unique_id "aXkqOHxT9o4cBBzYEwxJ2wAAAB4"], referer: http://www.glassicannex.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-25 23:10:22 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.123 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 25 18:10:17.218601 2026] [security2:error] [pid 2539445:tid 2539464] [client 120.230.21.123:11419] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.potterpuppetpals.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.potterpuppetpals.com"] [uri "/"] [unique_id "aXai2S3qxWnqC4fScCgw9AAAARA"], referer: https://www.potterpuppetpals.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-10-12 22:22:30 (9 months ago)	ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.230.21.123 2025-1 ... show more ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.230.21.123 2025-10-12 07:12:24 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-03-31 22:42:57 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.21.123 2025-03 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.21.123 2025-03-31 10:38:18 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2025-03-21 22:45:52 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.21.123 2025-03 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.21.123 2025-03-21 10:53:21 / 2025-03-21 09:57:53 / 2025-03-21 17:42:11 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2025-03-19 22:36:42 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.21.123 2025-03 ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.21.123 2025-03-19 08:04:41 /config.json show less	Web App Attack
🇿🇦 IrisFlower	2022-01-25 03:07:59 (4 years ago)	Unauthorized connection attempt detected from IP address 120.230.21.123 to port 443 [J]	Port Scan Hacking

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 193.176.31.200

🇨🇳 175.10.38.108

🇨🇳 106.12.120.171

🇭🇰 101.32.1.25

🇷🇴 80.94.92.179

🇳🇱 34.13.141.249

🇩🇪 213.209.159.231

🇩🇴 186.120.179.222

🇺🇸 143.198.68.190

🇨🇳 123.187.243.243

🇫🇷 91.231.89.207

🇫🇷 91.231.89.129

🇪🇸 37.152.142.176

🇬🇧 35.203.211.37

🇺🇸 34.148.20.210

🇬🇧 2a00:1450:4009:c01::12e

🇮🇳 2401:4900:8fd1:a015:ec4e:5437:a57c:1f1

🇨🇳 175.30.48.136

🇸🇪 155.212.39.40

🇸🇬 145.223.131.49