JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.22.17

120.230.22.17 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 12%: ?

12%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.22.17

Whois 120.230.22.17

IP Abuse Reports for 120.230.22.17:

This IP address has been reported a total of 10 times from 5 distinct sources. 120.230.22.17 was first reported on May 6th 2023, and the most recent report was 8 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-02 01:12:19 (8 hours ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 01 21:12:11.213124 2026] [security2:error] [pid 31487:tid 31487] [client 120.230.22.17:20935] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|huntingforebears.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "huntingforebears.com"] [uri "/"] [unique_id "akW667aulL_4oy9y9vYGcAAAAAE"], referer: https://huntingforebears.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-28 22:52:41 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 18:52:38.282466 2026] [security2:error] [pid 6318:tid 6318] [client 120.230.22.17:20768] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.nunsunveiled.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.nunsunveiled.com"] [uri "/"] [unique_id "akGltlDSgne1H7M-0UlrrQAAAAQ"], referer: http://www.nunsunveiled.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-16 22:52:48 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 18:52:44.939452 2026] [security2:error] [pid 20139:tid 20139] [client 120.230.22.17:14085] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ic1.biz\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ic1.biz"] [uri "/index.html"] [unique_id "agj1PG1Tyyo9SW1lOvb80wAAAAc"], referer: http://ic1.biz/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-05-16 19:24:56 (1 month ago)	[SatMay1621:24:52.7771152026][security2:error][pid2931336:tid2931380][client120.230.22.17:0]ModSecur ... show more [SatMay1621:24:52.7771152026][security2:error][pid2931336:tid2931380][client120.230.22.17:0]ModSecurity:Accessdeniedwithcode403$phase2$.Matchof\"rx$http://bsalsa\\\\\\\\.com\\|\^site24x7$\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"hostingedominio.com\"][uri\"/\"][unique_id\"agjEhJpcZYxZvbix5MM64QAAAEQ\"]\,referer:https://hostingedominio.com/ show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-05-15 20:51:37 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 16:51:30.235339 2026] [security2:error] [pid 20988:tid 21043] [client 120.230.22.17:19192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.rbarw.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rbarw.com"] [uri "/"] [unique_id "ageHUrLwgG15UHUFRqwFnAAAAZQ"], referer: http://www.rbarw.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-28 01:42:15 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.22.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 27 20:42:05.689450 2026] [security2:error] [pid 18612:tid 18612] [client 120.230.22.17:9344] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.anxo.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.anxo.org"] [uri "/erro.html"] [unique_id "aaJH7Qj9_E209oVTslynygAAAAE"], referer: http://www.anxo.org/erro.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 kosada.com	2025-10-13 20:52:34 (8 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇨🇳 ThreatBook.io	2025-06-03 01:13:49 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.22.17 2025-06-02 16 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.22.17 2025-06-02 16:56:56 /Login_files/saved_resource.html 2025-06-02 19:45:57 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-02 00:53:22 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.22.17 2025-06-01 12 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.22.17 2025-06-01 12:35:41 / show less	Web App Attack
🇿🇦 IrisFlower	2023-05-06 20:16:05 (3 years ago)	Unauthorized connection attempt detected from IP address 120.230.22.17 to port 443 [J]	Port Scan Hacking

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 203.154.158.195

🇧🇷 187.94.255.130

🇨🇳 183.166.94.133

🇧🇷 149.19.175.187

🇸🇬 145.223.131.64

🇮🇳 122.187.234.59

🇸🇬 107.155.56.52

🇺🇸 94.156.149.243

🇸🇬 84.75.150.2

🇸🇬 47.236.240.99

🇸🇬 47.128.122.122

🇸🇬 43.160.219.206

🇪🇹 196.189.185.79

🇷🇴 193.32.162.84

🇺🇸 167.172.31.170

🇺🇸 165.227.209.27

🇷🇺 109.173.38.135

🇸🇬 84.75.155.186

🇱🇹 81.30.98.62

🇸🇬 43.173.179.167