JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.23.41

120.230.23.41 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 4%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.23.41

Whois 120.230.23.41

IP Abuse Reports for 120.230.23.41:

This IP address has been reported a total of 15 times from 2 distinct sources. 120.230.23.41 was first reported on May 1st 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-13 20:50:31 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 16:50:28.109809 2026] [security2:error] [pid 10674:tid 10674] [client 120.230.23.41:7895] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.jmnr.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.jmnr.net"] [uri "/"] [unique_id "alVPlILy4VkBFUcGNDzBwgAAAAw"], referer: https://www.jmnr.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 20:30:16 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 16:30:12.711538 2026] [security2:error] [pid 22558:tid 22558] [client 120.230.23.41:2505] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|davidwoodard.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "davidwoodard.com"] [uri "/"] [unique_id "aiMx1MyrCIfK2MwnLXO3kwAAAAk"], referer: https://davidwoodard.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 20:01:14 (1 month ago)	(mod_security) mod_security (id:949110) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:949110) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 16:01:09.319514 2026] [security2:error] [pid 19836:tid 19836] [client 120.230.23.41:2429] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "pmg-zolphy.com"] [uri "/"] [unique_id "aiMrBRi-2LCfxypINfCHRQAAAAM"], referer: http://pmg-zolphy.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 22:43:47 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 18:43:40.737693 2026] [security2:error] [pid 5892:tid 5892] [client 120.230.23.41:1076] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.36quant.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.36quant.com"] [uri "/index.html"] [unique_id "ag45HB4TUviCLlQhbHz7_gAAAAw"], referer: http://www.36quant.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-17 21:35:54 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 17 17:35:50.062009 2026] [security2:error] [pid 26323:tid 26323] [client 120.230.23.41:1169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.line2.biz\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.line2.biz"] [uri "/.403.html"] [unique_id "ago0tlGbfZy9l8ICMZOl1AAAAAQ"], referer: https://www.line2.biz/.403.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-05 22:17:19 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 05 17:17:11.808272 2026] [security2:error] [pid 8157:tid 8157] [client 120.230.23.41:5349] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|ansrplus.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ansrplus.net"] [uri "/"] [unique_id "aYUW5_Mrxb0M-MdbGuRPPQAAAAQ"], referer: http://ansrplus.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-26 03:18:04 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 25 22:18:00.567966 2026] [security2:error] [pid 6323:tid 6323] [client 120.230.23.41:7938] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.intothebigempty.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.intothebigempty.com"] [uri "/"] [unique_id "aXbc6GKmV-L3HPR39P_HfgAAAAU"], referer: http://www.intothebigempty.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-20 22:35:01 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.23.41 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 20 17:34:40.888399 2026] [security2:error] [pid 28618:tid 28618] [client 120.230.23.41:6622] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.ridefilmsinc.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.ridefilmsinc.com"] [uri "/"] [unique_id "aXADAI2j7PwD37v3LcuXjAAAAAo"], referer: http://www.ridefilmsinc.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-07-17 23:03:57 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.23.41 2025-07-17 20 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.23.41 2025-07-17 20:11:07 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-07-16 23:06:53 (11 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.23.41 2025-07-16 10 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.230.23.41 2025-07-16 10:32:24 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-26 23:13:02 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05-26 13:57:11 /favicon.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-06 23:21:24 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05-06 04:09:45 /robots.txt 2025-05-06 02:11:07 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-04 23:18:08 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05-04 21:29:31 /portal.html show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-03 23:13:57 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05-03 05:55:46 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-01 23:27:33 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.23.41 2025-05-01 04:59:42 / show less	Web App Attack

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 103.203.37.130

🇩🇪 82.39.212.212

🇭🇰 8.217.33.44

🇦🇷 186.13.24.118

🇸🇬 185.200.116.41

🇳🇱 157.245.69.32

🇩🇪 104.207.54.116

🇫🇷 82.65.40.170

🇺🇸 69.164.245.165

🇩🇪 69.5.169.151

🇩🇪 69.5.169.55

🇯🇵 8.216.6.133

🇦🇷 200.89.159.59

🇵🇱 176.53.159.198

🇨🇳 117.133.78.132

🇨🇳 112.254.127.213

🇧🇬 79.124.62.230

🇺🇸 64.62.197.89

🇺🇸 64.62.197.87

🇺🇸 64.23.217.254