JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.239.31.58

120.239.31.58 was found in our database!

This IP was reported 10 times. Confidence of Abuse is 5%: ?

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS56040
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.239.31.58

Whois 120.239.31.58

IP Abuse Reports for 120.239.31.58:

This IP address has been reported a total of 10 times from 4 distinct sources. 120.239.31.58 was first reported on August 2nd 2025, and the most recent report was 3 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-06-26 22:35:11 (3 hours ago)	(mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 18:35:06.297184 2026] [security2:error] [pid 2027:tid 2056] [client 120.239.31.58:7389] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.nordicatrio.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.nordicatrio.com"] [uri "/"] [unique_id "aj7-mgNpbWWJAl0sgbrS0AAAANU"], referer: https://www.nordicatrio.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 06:02:36 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 02:02:31.986816 2026] [security2:error] [pid 15616:tid 15616] [client 120.239.31.58:6561] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|casadelsolmexico.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "casadelsolmexico.net"] [uri "/"] [unique_id "ajty90-qYxu8w-yfYFiUcwAAAAE"], referer: https://casadelsolmexico.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-22 21:48:56 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 22 17:48:52.384987 2026] [security2:error] [pid 24880:tid 24880] [client 120.239.31.58:6643] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|distilledwater.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "distilledwater.net"] [uri "/"] [unique_id "ajmtxHzkqXKJdon_HvvMvgAAAAI"], referer: http://distilledwater.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-26 15:22:50 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 11:22:40.946352 2026] [security2:error] [pid 6635:tid 6635] [client 120.239.31.58:15126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.puckerbottombikini.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.puckerbottombikini.com"] [uri "/"] [unique_id "ae4twGSVH0_BCChNZHfA8QAAAAY"], referer: http://www.puckerbottombikini.com show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-30 02:55:02 (7 months ago)	Malicious activity detected	Hacking Web App Attack
🇺🇸 TPI-Abuse	2025-09-24 07:25:00 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 24 03:24:45.645897 2025] [security2:error] [pid 10021:tid 10021] [client 120.239.31.58:1507] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.marxistphilosophy.org\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.marxistphilosophy.org"] [uri "/HistChinPhil1952_2005/002.htm"] [unique_id "aNOcvcgKpTHw1snSwtEBuwAAABY"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-23 20:14:36 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 23 16:14:31.778985 2025] [security2:error] [pid 22200:tid 22200] [client 120.239.31.58:19216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/people/130002/"] [unique_id "aNL_p65GQPL5tHw2GkT4iAAAABk"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-23 06:22:27 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210350) triggered by 120.239.31.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 23 02:22:09.899797 2025] [security2:error] [pid 11520:tid 11520] [client 120.239.31.58:4695] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/tournament/1482/game/52639/"] [unique_id "aNI8kWyqhvZEG0QKnRT71QAAAB8"], referer: https://www.renju.net/game/52639/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇳 ThreatBook.io	2025-08-04 23:19:48 (10 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.31.58 2025-08-04 14 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.239.31.58 2025-08-04 14:19:51 /robots.txt show less	Web App Attack
Anonymous	2025-08-02 15:40:27 (10 months ago)	Infected user bad webscan	Exploited Host

Showing 1 to 10 of 10 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 216.218.206.69

🇷🇺 213.234.5.66

🇧🇪 198.235.24.197

🇦🇷 190.55.123.250

🇦🇷 170.238.9.16

🇺🇸 158.94.187.131

🇺🇸 157.245.1.7

🇫🇮 147.185.133.83

🇦🇺 123.209.101.43

🇸🇪 77.53.193.47

🇺🇸 66.240.205.34

🇳🇱 45.148.10.151

🇰🇷 210.57.229.52

🇧🇷 205.210.31.135

🇭🇰 199.45.154.176

🇺🇸 191.101.33.115

🇧🇷 187.51.208.158

🇮🇳 125.16.27.190

🇨🇳 115.191.38.87

🇻🇳 103.82.195.111