JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.22.164

120.230.22.164 was found in our database!

This IP was reported 8 times. Confidence of Abuse is 9%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.22.164

Whois 120.230.22.164

IP Abuse Reports for 120.230.22.164:

This IP address has been reported a total of 8 times from 3 distinct sources. 120.230.22.164 was first reported on February 26th 2026, and the most recent report was 2 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 2 weeks ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-13 06:47:20 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 02:47:12.866498 2026] [security2:error] [pid 28767:tid 28767] [client 120.230.22.164:6845] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|rocketbattle.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rocketbattle.org"] [uri "/"] [unique_id "alSJ8FsLSp4ztKOWYNfk_gAAAAw"], referer: http://rocketbattle.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 21:39:24 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 17:39:17.130588 2026] [security2:error] [pid 26328:tid 26328] [client 120.230.22.164:12022] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.etudesoftware.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.etudesoftware.com"] [uri "/"] [unique_id "aix8hfaDh5ivPX-UEwlNhAAAABc"], referer: http://www.etudesoftware.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-31 21:29:20 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 17:29:14.656235 2026] [security2:error] [pid 5411:tid 5411] [client 120.230.22.164:2795] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.banyonsbookdoctor.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.banyonsbookdoctor.com"] [uri "/"] [unique_id "ahyoKrWNdYRhl0_FIx-aRQAAAAk"], referer: http://www.banyonsbookdoctor.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-05-30 01:49:04 (1 month ago)	[SatMay3003:48:48.8090202026][security2:error][pid152357:tid152533][client120.230.22.164:0]ModSecuri ... show more [SatMay3003:48:48.8090202026][security2:error][pid152357:tid152533][client120.230.22.164:0]ModSecurity:Accessdeniedwithcode403$phase2$.Matchof\"rx$http://bsalsa\\\\\\\\.com\\|\^site24x7$\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"executivekotech.com\"][uri\"/\"][unique_id\"ahpCAKsmN5C0Id0qAivV7wAAAIk\"]\,referer:https://executivekotech.com/ show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-21 20:03:44 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 16:03:41.068773 2026] [security2:error] [pid 21445:tid 21445] [client 120.230.22.164:14625] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|digifonics.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "digifonics.com"] [uri "/"] [unique_id "ag9lHTIkndmX3w4jrIGpXQAAABc"], referer: http://digifonics.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-11 21:29:52 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 17:29:45.512210 2026] [security2:error] [pid 7972:tid 7995] [client 120.230.22.164:11675] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.eagletons.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.eagletons.com"] [uri "/"] [unique_id "agJKSb11Ctfbgq-rXs88VwAAAVU"], referer: http://www.eagletons.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-05-10 23:16:08 (2 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.22.164 2026-05-10 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.22.164 2026-05-10 13:47:12 /sitemap.xml show less	Web App Attack
🇺🇸 TPI-Abuse	2026-02-26 20:57:25 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 26 15:57:20.989549 2026] [security2:error] [pid 670:tid 670] [client 120.230.22.164:16616] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|blaslandsporthorses.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "blaslandsporthorses.com"] [uri "/"] [unique_id "aaCzsMg6iOF8_jFiJlNWpAAAAAY"], referer: http://blaslandsporthorses.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 8 of 8 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 202.29.242.115

🇺🇸 134.122.125.153

🇺🇦 78.30.248.186

🇦🇷 200.114.97.74

🇺🇸 198.211.98.224

🇫🇷 62.171.174.52

🇺🇸 3.91.61.197

🇧🇷 186.207.193.95

🇨🇳 180.97.220.181

🇵🇱 176.53.159.198

🇫🇷 173.249.35.161

🇺🇸 108.166.147.227

🇰🇷 49.162.255.210

🇳🇱 45.148.10.152

🇳🇱 45.142.193.169

🇬🇧 31.14.254.4

🇮🇩 103.188.177.46

🇰🇷 61.32.68.66

🇺🇸 20.163.60.205

🇷🇴 2.57.121.25