JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.240.178.148

120.240.178.148 was found in our database!

This IP was reported 27 times. Confidence of Abuse is 41%: ?

41%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS9808
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Guangzhou, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.240.178.148

Whois 120.240.178.148

IP Abuse Reports for 120.240.178.148:

This IP address has been reported a total of 27 times from 12 distinct sources. 120.240.178.148 was first reported on January 1st 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇸 Scan	2026-06-10 01:59:14 (1 day ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇷🇸 Scan	2026-06-08 00:13:00 (3 days ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇺🇸 kosada.com	2026-05-29 00:39:13 (1 week ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇿🇦 Tokolosh Hunters	2026-05-27 02:16:54 (2 weeks ago)	AutoBlockWindow-Known bad useragent query-2026-05-27 02:16:53	Bad Web Bot
🇺🇸 TPI-Abuse	2026-05-26 03:15:23 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 23:15:18.846372 2026] [security2:error] [pid 4736:tid 4736] [client 120.240.178.148:30477] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.sweak.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.sweak.com"] [uri "/"] [unique_id "ahUQRglHXnEBKu6r2Rno-wAAAAM"], referer: http://www.sweak.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-05-22 12:32:55 (2 weeks ago)	Blocked by UFW (ICMP on ) Source port: TTL: 105 Packet length: 104 TOS: 0x00 This report (for 120. ... show more Blocked by UFW (ICMP on ) Source port: TTL: 105 Packet length: 104 TOS: 0x00 This report (for 120.240.178.148) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-05-22 00:01:38 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 20:01:30.958636 2026] [security2:error] [pid 17113:tid 17113] [client 120.240.178.148:31286] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.intergeovial.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.intergeovial.com"] [uri "/"] [unique_id "ag-c2t9u1C9pePo9rX2wFAAAAAM"], referer: http://www.intergeovial.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇸🇪 NordhTech	2026-05-18 16:00:18 (3 weeks ago)	More than 3 malicious connection attempts, trying port(s) 27015/tcp, then blocked from services ...	Port Scan Hacking
🇩🇪 iNetWorker	2026-05-18 14:10:47 (3 weeks ago)	firewall-block, port(s): 27015/udp	Port Scan
🇩🇪 Admins@FBN	2026-05-17 22:01:02 (3 weeks ago)	FW-PortScan: Traffic Blocked srcport=2690 dstport=27015	Port Scan
🇩🇪 iNetWorker	2026-05-17 12:40:47 (3 weeks ago)	firewall-block, port(s): 27015/udp	Port Scan
🇺🇸 TPI-Abuse	2026-04-25 22:59:13 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 18:59:08.578600 2026] [security2:error] [pid 1297994:tid 1297994] [client 120.240.178.148:1449] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|csems.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "csems.org"] [uri "/"] [unique_id "ae1HPPlhqz-wsyPpfzPZiwAAAAk"], referer: https://csems.org/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 xmission.com	2026-04-16 20:44:22 (1 month ago)	Blocked by UFW (ICMP on ) Source port: TTL: 39 Packet length: 104 TOS: 0x08 This report (for 120.2 ... show more Blocked by UFW (ICMP on ) Source port: TTL: 39 Packet length: 104 TOS: 0x08 This report (for 120.240.178.148) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇺🇸 TPI-Abuse	2026-04-07 02:17:06 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 120.240.178.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 22:16:58.061104 2026] [security2:error] [pid 1207216:tid 1207216] [client 120.240.178.148:58185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|cestcaryntravel.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cestcaryntravel.com"] [uri "/"] [unique_id "adRpGh1N1vVKaEt91lI-RwAAAA0"], referer: https://cestcaryntravel.com/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-03-11 16:07:55 (3 months ago)	Unauthorized connection attempt on Port 23	Port Scan Hacking Exploited Host

Showing 1 to 15 of 27 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 201.16.238.49

🇳🇬 197.242.249.122

🇫🇮 147.185.133.47

🇹🇭 118.175.93.34

🇧🇩 103.183.62.3

🇿🇦 102.220.85.131

🇩🇪 213.209.159.56

🇧🇬 91.92.40.171

🇫🇷 84.247.169.208

🇫🇷 51.159.149.103

🇸🇬 47.79.207.106

🇨🇿 46.135.100.183

🇯🇵 43.165.169.74

🇲🇽 187.191.48.9

🇺🇸 129.153.145.135

🇨🇳 117.181.205.178

🇧🇷 45.191.209.248

🇺🇸 170.106.152.218

🇫🇮 147.185.133.229

🇰🇷 115.178.75.243