JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.231.37.200

120.231.37.200 was found in our database!

This IP was reported 6 times. Confidence of Abuse is 14%: ?

14%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.231.37.200

Whois 120.231.37.200

IP Abuse Reports for 120.231.37.200:

This IP address has been reported a total of 6 times from 3 distinct sources. 120.231.37.200 was first reported on July 31st 2025, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-28 02:09:33 (21 hours ago)	(mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 22:09:25.788683 2026] [security2:error] [pid 9713:tid 9713] [client 120.231.37.200:4342] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.darrenj.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.darrenj.com"] [uri "/"] [unique_id "akCCVagEEVr0lHtZOkzxPQAAACE"], referer: http://www.darrenj.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 Peter Yu	2026-06-27 19:51:37 (1 day ago)		Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-13 18:38:04 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 14:37:58.717829 2026] [security2:error] [pid 5157:tid 5157] [client 120.231.37.200:7718] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|gre-home.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "gre-home.com"] [uri "/"] [unique_id "agTFBh5IPw_VmEgO18-HiwAAABI"], referer: http://gre-home.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-10 18:22:23 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 10 14:22:18.822232 2026] [security2:error] [pid 3067:tid 3067] [client 120.231.37.200:7714] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.brianwhitty.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.brianwhitty.com"] [uri "/"] [unique_id "agDM2mLXdaJzHwNbfsAVuAAAAAA"], referer: http://www.brianwhitty.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-22 05:02:00 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.231.37.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 01:01:52.196572 2026] [security2:error] [pid 12065:tid 12065] [client 120.231.37.200:28394] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.aares2026.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.aares2026.net"] [uri "/index.html"] [unique_id "ab93wOXrkJ56R9n4Aa869AAAAAM"], referer: https://www.aares2026.net/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-07-31 22:48:28 (10 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.231.37.200 2025-07-31 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.231.37.200 2025-07-31 12:17:53 / show less	Web App Attack

Showing 1 to 6 of 6 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 193.46.255.145

🇳🇱 176.65.148.160

🇺🇸 2602:80d:1008::13

🇵🇱 194.180.48.253

🇧🇦 188.246.73.219

🇧🇷 187.110.238.50

🇮🇹 185.197.8.122

🇮🇳 182.78.65.154

🇵🇪 179.6.39.164

🇺🇸 173.247.226.62

🇳🇱 172.71.103.114

🇨🇳 114.98.230.202

🇺🇸 104.192.205.181

🇺🇸 104.43.131.157

🇮🇳 103.151.199.176

🇳🇱 91.92.40.10

🇺🇸 50.19.186.150

🇩🇪 37.120.191.97

🇦🇺 35.244.92.160

🇦🇺 34.116.96.80