JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.230.28.52

120.230.28.52 was found in our database!

This IP was reported 9 times. Confidence of Abuse is 4%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.230.28.52

Whois 120.230.28.52

IP Abuse Reports for 120.230.28.52:

This IP address has been reported a total of 9 times from 2 distinct sources. 120.230.28.52 was first reported on February 24th 2025, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-08-30 07:57:34 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 03:57:29.861771 2026] [security2:error] [pid 648:tid 675] [client 120.230.28.52:8265] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.guitarmans.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.guitarmans.com"] [uri "/"] [unique_id "apPiaWcxz3Q2f8tZ0IMztQAAAJU"], referer: http://www.guitarmans.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-08-18 22:56:14 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 18:56:07.089820 2026] [security2:error] [pid 25947:tid 25947] [client 120.230.28.52:8380] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|grapplerunion.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "grapplerunion.com"] [uri "/"] [unique_id "aoTjBwHW4BUT0JVkr_I0yAAAAAQ"], referer: https://grapplerunion.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-19 18:38:14 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 19 14:38:08.553527 2026] [security2:error] [pid 14342:tid 14342] [client 120.230.28.52:6299] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|decisionsciencebooks.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "decisionsciencebooks.com"] [uri "/"] [unique_id "agyuEHkaFblpr--UXO7zygAAAAA"], referer: http://decisionsciencebooks.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 23:14:10 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 19:14:03.088115 2026] [security2:error] [pid 8212:tid 8212] [client 120.230.28.52:8878] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|wadenelson.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "wadenelson.com"] [uri "/"] [unique_id "ac74O57DmtSuBNKNpTmzGAAAABA"], referer: http://wadenelson.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-18 19:11:11 (7 months ago)	(mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.230.28.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 18 14:11:04.191782 2026] [security2:error] [pid 16029:tid 16029] [client 120.230.28.52:10346] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|lakewyliehairsalon.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "lakewyliehairsalon.com"] [uri "/"] [unique_id "aW0wSLMa3XdNpCySw3e7LwAAABI"], referer: http://lakewyliehairsalon.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-07-31 22:15:02 (1 year ago)	ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.230.28.52 2025-07 ... show more ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.230.28.52 2025-07-31 02:04:10 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-06-11 22:22:03 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.28.52 2025-06- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.28.52 2025-06-11 07:16:05 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-03-01 22:25:44 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.28.52 2025-03- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.28.52 2025-03-01 20:52:09 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-02-24 22:20:30 (1 year ago)	ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.28.52 2025-02- ... show more ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/120.230.28.52 2025-02-24 08:59:20 / show less	Web App Attack

Showing 1 to 9 of 9 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 218.189.69.157

🇺🇸 198.12.115.18

🇩🇪 135.125.226.143

🇸🇮 102.220.161.28

🇷🇴 92.118.39.14

🇵🇰 72.255.52.38

🇨🇳 58.17.128.7

🇬🇧 35.203.210.125

🇬🇧 31.14.254.114

🇷🇴 2.57.122.150

🇨🇳 220.161.52.149

🇳🇱 213.177.179.160

🇰🇷 211.106.133.202

🇦🇷 181.8.128.4

🇺🇦 176.103.15.144

🇭🇰 165.154.224.160

🇫🇷 91.231.89.87

🇺🇸 74.122.123.168

🇱🇹 62.60.130.253

🇹🇼 36.233.174.136