JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.239.26.14

120.239.26.14 was found in our database!

This IP was reported 11 times. Confidence of Abuse is 4%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS56040
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.239.26.14

Whois 120.239.26.14

IP Abuse Reports for 120.239.26.14:

This IP address has been reported a total of 11 times from 3 distinct sources. 120.239.26.14 was first reported on May 27th 2025, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-13 22:16:39 (1 day ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 18:16:31.883550 2026] [security2:error] [pid 1550:tid 1550] [client 120.239.26.14:10402] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.spirits66.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.spirits66.com"] [uri "/"] [unique_id "alVjvxbz1FB1fbl-45lnXgAAABE"], referer: http://www.spirits66.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-21 09:03:15 (3 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 05:03:08.957002 2026] [security2:error] [pid 32049:tid 32049] [client 120.239.26.14:7257] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.partybusesflint.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.partybusesflint.com"] [uri "/"] [unique_id "ajeozDMufMrU0fRz5D1xjQAAAAU"], referer: http://www.partybusesflint.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-12 21:11:40 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 17:11:33.404679 2026] [security2:error] [pid 25440:tid 25440] [client 120.239.26.14:12216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|instituteofscience.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "instituteofscience.com"] [uri "/"] [unique_id "aix2BRx3fMSELGqwkQZw9wAAABU"], referer: http://instituteofscience.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-20 18:51:07 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 14:50:59.869896 2026] [security2:error] [pid 30024:tid 30024] [client 120.239.26.14:21915] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|jhreid.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "jhreid.com"] [uri "/"] [unique_id "ag4Ck3h9PijM5U8RbxE_XgAAABI"], referer: http://jhreid.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-16 22:36:07 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 18:36:00.137113 2026] [security2:error] [pid 17322:tid 17322] [client 120.239.26.14:21912] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|perverseconsequences.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "perverseconsequences.com"] [uri "/"] [unique_id "agjxUDegMIGexTIYi1qOEQAAABI"], referer: http://perverseconsequences.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-04-02 22:59:06 (3 months ago)	ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.239.26.14 2026-04 ... show more ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.239.26.14 2026-04-02 23:12:31 /robots.txt show less	Web App Attack
🇺🇸 TPI-Abuse	2026-04-02 17:17:03 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 13:16:54.913511 2026] [security2:error] [pid 26952:tid 26952] [client 120.239.26.14:30456] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|newgoldenletters.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "newgoldenletters.com"] [uri "/"] [unique_id "ac6khqjoRQzv7gQCcIEibQAAAAE"], referer: https://newgoldenletters.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-29 04:50:08 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.26.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 00:50:00.229104 2026] [security2:error] [pid 2083:tid 2083] [client 120.239.26.14:14247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.grandpont-house.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.grandpont-house.org"] [uri "/"] [unique_id "aciveGKA15NJqtFRUqm69AAAABE"], referer: http://www.grandpont-house.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-10-04 22:43:57 (9 months ago)	ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.239.26.14 2025-10 ... show more ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.239.26.14 2025-10-04 11:16:45 /robots.txt show less	Web App Attack
🇸🇪 finnjohan	2025-09-26 01:11:31 (9 months ago)	Layer 7 DDOS	DDoS Attack
🇨🇳 ThreatBook.io	2025-05-27 22:52:32 (1 year ago)	ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.239.26.14 2025-05 ... show more ThreatBook Intelligence: Spam,Gateway more details on https://threatbook.io/ip/120.239.26.14 2025-05-27 00:48:08 / show less	Web App Attack

Showing 1 to 11 of 11 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 223.100.136.242

🇬🇧 185.247.137.24

🇳🇱 176.65.148.144

🇮🇸 157.157.52.6

🇺🇸 104.28.167.7

🇨🇦 85.217.149.41

🇺🇸 2600:1f18:3120:f504:7778:286d:64b2:b870

🇳🇱 193.176.31.215

🇧🇷 191.54.25.102

🇺🇸 181.177.80.95

🇺🇸 157.245.191.249

🇺🇸 152.32.183.236

🇷🇴 141.98.82.192

🇮🇳 137.59.87.152

🇮🇳 117.221.3.223

🇸🇬 103.13.207.88

🇱🇹 94.244.77.5

🇧🇬 91.92.47.140

🇩🇪 82.82.143.196

🇺🇸 66.132.172.205