JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.239.27.212

120.239.27.212 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 12%: ?

12%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS56040
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.239.27.212

Whois 120.239.27.212

IP Abuse Reports for 120.239.27.212:

This IP address has been reported a total of 16 times from 3 distinct sources. 120.239.27.212 was first reported on March 31st 2025, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-19 21:19:42 (3 hours ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 17:19:38.121984 2026] [security2:error] [pid 23536:tid 23536] [client 120.239.27.212:15411] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.stationrestaurant.ca\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.stationrestaurant.ca"] [uri "/"] [unique_id "ajWyatva2h_AVXNFE9769wAAAA8"], referer: https://www.stationrestaurant.ca/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 19:49:02 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 15:48:56.954082 2026] [security2:error] [pid 3173:tid 3194] [client 120.239.27.212:5773] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|whitecrosslibrary.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "whitecrosslibrary.com"] [uri "/"] [unique_id "aiCFKB89WnzKGC28bSR-0AAAAdI"], referer: https://whitecrosslibrary.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-31 00:35:53 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 20:35:44.647846 2026] [security2:error] [pid 31462:tid 31462] [client 120.239.27.212:5637] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.synercom.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.synercom.org"] [uri "/"] [unique_id "ahuCYOsivexQ35olVa5TZAAAAAc"], referer: http://www.synercom.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-22 20:14:18 (4 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 16:14:12.160299 2026] [security2:error] [pid 26359:tid 26376] [client 120.239.27.212:13662] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.adprospb.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.adprospb.com"] [uri "/index.html"] [unique_id "ahC5FLJ9oAx1Dv7PkV5PxQAAAQA"], referer: https://www.adprospb.com/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-16 20:30:58 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 16:30:54.035429 2026] [security2:error] [pid 8260:tid 8260] [client 120.239.27.212:6661] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|troop9weymouth.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "troop9weymouth.com"] [uri "/"] [unique_id "agjT_paAGeNdyHJMRv3XmAAAABQ"], referer: https://troop9weymouth.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-05-14 19:34:59 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 15:34:53.721017 2026] [security2:error] [pid 23132:tid 23132] [client 120.239.27.212:19955] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|americanvaluesbooks.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "americanvaluesbooks.com"] [uri "/"] [unique_id "agYj3bZchBg2grZuglk3TgAAABA"], referer: http://americanvaluesbooks.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2026-05-13 01:34:39 (1 month ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2026-05-12 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2026-05-12 00:58:14 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2026-05-10 01:14:54 (1 month ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2026-05-09 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2026-05-09 02:38:14 /s/kg9ugn/808000/6411e0087192541a09d88223fb51a6a0/_/images/fav-generic.png show less	Web App Attack
🇺🇸 TPI-Abuse	2026-03-21 22:41:38 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 18:41:33.458879 2026] [security2:error] [pid 18285:tid 18285] [client 120.239.27.212:4536] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.controvac.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.controvac.com"] [uri "/"] [unique_id "ab8enYoHpA-4fLExbIqfEwAAAAw"], referer: https://www.controvac.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-02-04 19:15:39 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 04 14:15:35.850920 2026] [security2:error] [pid 10166:tid 10166] [client 120.239.27.212:12988] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|jerielster.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "jerielster.com"] [uri "/"] [unique_id "aYOa15f-zOcrdV75PokewgAAABM"], referer: http://jerielster.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-27 22:48:35 (4 months ago)	(mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.239.27.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jan 27 17:48:29.479035 2026] [security2:error] [pid 20831:tid 20831] [client 120.239.27.212:9030] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.intersession.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.intersession.net"] [uri "/"] [unique_id "aXlAvUE818Ejqq6HSen5SAAAAAE"], referer: https://www.intersession.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-10-20 00:14:13 (8 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2025-10-19 1 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2025-10-19 14:31:23 /config.json show less	Web App Attack
🇳🇱 EGP Abuse Dept	2025-10-17 14:42:16 (8 months ago)	Unauthorized connection to proxy port 8080	Port Scan Hacking
🇨🇳 ThreatBook.io	2025-07-28 00:03:14 (10 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2025-07-27 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2025-07-27 09:32:51 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2025-04-01 02:23:55 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2025-03-31 0 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.27.212 2025-03-31 07:48:50 /sitemap.xml show less	Web App Attack

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 205.210.31.239

🇯🇵 203.25.124.165

🇬🇧 193.176.29.7

🇨🇳 111.26.6.111

🇮🇳 103.180.212.135

🇷🇴 92.118.39.211

🇺🇸 91.230.168.67

🇳🇱 85.11.167.118

🇨🇳 39.154.11.152

🇸🇬 194.5.82.160

🇮🇩 182.253.156.184

🇸🇪 171.25.158.80

🇺🇸 162.216.149.147

🇧🇷 131.100.242.102

🇷🇴 92.118.39.209

🇬🇧 87.236.176.143

🇨🇳 36.143.206.232

🇺🇸 35.173.251.92

🇷🇴 2.57.121.112

🇫🇷 217.113.196.230