JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.239.147.248

120.239.147.248 was found in our database!

This IP was reported 7 times. Confidence of Abuse is 5%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.239.147.248

Whois 120.239.147.248

IP Abuse Reports for 120.239.147.248:

This IP address has been reported a total of 7 times from 2 distinct sources. 120.239.147.248 was first reported on May 5th 2025, and the most recent report was 21 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-11 03:29:17 (21 hours ago)	(mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 23:29:09.427955 2026] [security2:error] [pid 20922:tid 20922] [client 120.239.147.248:5391] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|circlehealthcaregroup.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "circlehealthcaregroup.com"] [uri "/"] [unique_id "alG4hYbx4siuX_hsbondYwAAAAQ"], referer: http://circlehealthcaregroup.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 08:42:54 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 10 04:42:48.653199 2026] [security2:error] [pid 28322:tid 28335] [client 120.239.147.248:32773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.plumberw9.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.plumberw9.com"] [uri "/index.html"] [unique_id "alCwiD2pfZdg4nmMwARVCwAAAAo"], referer: https://www.plumberw9.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-10 00:38:46 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 20:38:38.222389 2026] [security2:error] [pid 22023:tid 22023] [client 120.239.147.248:5381] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.fonzies.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.fonzies.net"] [uri "/"] [unique_id "alA_DtarangFHv_UhtTCXgAAABQ"], referer: http://www.fonzies.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 23:24:30 (6 days ago)	(mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 19:24:26.071097 2026] [security2:error] [pid 13588:tid 13588] [client 120.239.147.248:5517] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.thingstodonude.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.thingstodonude.com"] [uri "/"] [unique_id "akrnqsRA5Os5ufy6e1x1HQAAABI"], referer: http://www.thingstodonude.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-02 04:52:15 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.239.147.248 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 00:52:09.634312 2026] [security2:error] [pid 24575:tid 24575] [client 120.239.147.248:5605] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.rocketbattle.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rocketbattle.org"] [uri "/"] [unique_id "akXueb7GF_e7oUvabBBJRwAAAAc"], referer: https://www.rocketbattle.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-11-24 00:11:40 (7 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.147.248 2025-11-23 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.147.248 2025-11-23 11:35:54 /static/img/facio.ico show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-05 00:22:12 (1 year ago)	ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/120.239.147.248 2025-05-04 2 ... show more ThreatBook Intelligence: Mobile more details on http://threatbook.io/ip/120.239.147.248 2025-05-04 20:16:26 /portal.html show less	Web App Attack

Showing 1 to 7 of 7 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 2001:41d0:33d:9200::402

🇷🇺 194.85.210.40

🇩🇪 188.40.230.41

🇸🇬 111.119.194.113

🇫🇷 62.210.246.122

🇩🇪 45.135.141.15

🇩🇪 43.228.157.9

🇳🇱 204.76.203.231

🇷🇴 185.100.84.174

🇮🇳 159.65.150.202

🇺🇸 103.143.231.24

🇫🇮 83.97.78.224

🇺🇸 73.80.162.93

🇺🇸 65.49.1.135

🇰🇷 59.16.212.232

🇺🇸 47.251.140.69

🇺🇸 34.193.146.178

🇺🇸 2607:f8b0:4001:c79::12d

🇰🇷 211.40.167.121

🇧🇷 205.210.31.218