JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.21.37

120.230.21.37 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 2%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.21.37

Whois 120.230.21.37

IP Abuse Reports for 120.230.21.37:

This IP address has been reported a total of 11 times from 5 distinct sources. 120.230.21.37 was first reported on May 14th 2023, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-17 04:16:46 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 00:16:40.193053 2026] [security2:error] [pid 4449:tid 4449] [client 120.230.21.37:11757] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.vitality-webb.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.vitality-webb.com"] [uri "/"] [unique_id "ajIfqMvgPAzfdYMJlgl8eAAAAAs"], referer: http://www.vitality-webb.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-25 22:15:13 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 18:15:09.899232 2026] [security2:error] [pid 27683:tid 27683] [client 120.230.21.37:4755] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.wardellbrown.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.wardellbrown.com"] [uri "/"] [unique_id "ahTJ7Us8ri5MLGsdIm2DHQAAABI"], referer: https://www.wardellbrown.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 19:59:08 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 15:59:02.240184 2026] [security2:error] [pid 6697:tid 6697] [client 120.230.21.37:6610] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|harmonyexpos.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "harmonyexpos.com"] [uri "/index.html"] [unique_id "ag4ShmoUKid71x2yP5fTUwAAAAE"], referer: http://harmonyexpos.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-03-20 19:03:17 (3 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇺🇸 TPI-Abuse	2026-03-17 12:02:57 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 08:02:49.890859 2026] [security2:error] [pid 7017:tid 7017] [client 120.230.21.37:5330] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.beirutbazar.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.beirutbazar.com"] [uri "/"] [unique_id "ablC6RsCPJpzsOLkCXSM7AAAAAo"], referer: http://www.beirutbazar.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-16 00:29:13 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.21.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 15 19:29:09.343365 2026] [security2:error] [pid 13632:tid 13632] [client 120.230.21.37:7343] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.televisonic.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.televisonic.com"] [uri "/"] [unique_id "aZJk1ZKAqUe8PpoVYZ9SBQAAAAo"], referer: http://www.televisonic.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2025-09-30 02:17:23 (9 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇨🇳 ThreatBook.io	2025-07-22 22:47:02 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.21.37 2025-07-22 19 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.21.37 2025-07-22 19:45:21 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-16 22:52:49 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.21.37 2025-07-16 08 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.21.37 2025-07-16 08:34:28 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-20 22:51:35 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.21.37 2025-06-20 02 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.21.37 2025-06-20 02:30:00 /favicon.ico 2025-06-20 00:54:59 / show less	Web App Attack
🇿🇦 IrisFlower	2023-05-14 20:25:24 (3 years ago)	Unauthorized connection attempt detected from IP address 120.230.21.37 to port 443 [J]	Port Scan Hacking

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 2607:f8b0:4004:c07::127

🇬🇭 196.44.99.170

🇧🇷 189.89.14.30

🇦🇷 149.78.44.100

🇦🇷 149.78.35.23

🇬🇧 83.135.56.114

🇹🇷 31.58.246.14

🇺🇸 2607:f8b0:4004:c07::12c

🇨🇳 219.136.144.191

🇦🇷 149.78.56.52

🇦🇷 149.78.39.10

🇹🇼 111.70.32.6

🇨🇳 106.75.144.60

🇲🇦 102.50.250.77

🇺🇸 66.132.195.42

🇸🇬 43.173.175.160

🇪🇸 196.196.150.5

🇬🇧 193.163.125.225

🇦🇷 149.78.55.66

🇦🇷 149.78.43.32