JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.245.25.223

120.245.25.223 was found in our database!

This IP was reported 2 times. Confidence of Abuse is 15%: ?

15%

ISP	China Mobile Communications Corporation
Usage Type	Fixed Line ISP
ASN	AS56048
Domain Name	chinamobile.com
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.245.25.223

Whois 120.245.25.223

IP Abuse Reports for 120.245.25.223:

This IP address has been reported a total of 2 times from 2 distinct sources. 120.245.25.223 was first reported on July 9th 2026, and the most recent report was 1 day ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 4server	2026-07-11 20:54:27 (1 day ago)	[SatJul1122:53:58.2560662026][security2:error][pid3007726:tid3007835][client120.245.25.223:0]ModSecu ... show more [SatJul1122:53:58.2560662026][security2:error][pid3007726:tid3007835][client120.245.25.223:0]ModSecurity:Accessdeniedwithcode403$phase2$.Matchof\"rx$http://bsalsa\\\\\\\\.com\\|\^site24x7$\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"www.ppinvestment.ch\"][uri\"/\"][unique_id\"alKtZlWTgFhTbrSMUnGOEAAAANA\"]\,referer:https://www.ppinvestment.ch/ show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 02:51:42 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 120.245.25.223 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210831) triggered by 120.245.25.223 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 22:51:33.992953 2026] [security2:error] [pid 543:tid 543] [client 120.245.25.223:32557] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|exhaustthelimits.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "exhaustthelimits.org"] [uri "/"] [unique_id "ak8MtfSaapSBdWIj0s02SAAAABg"], referer: http://exhaustthelimits.org/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 2 of 2 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 45.148.10.183

🇺🇸 216.180.246.204

🇰🇿 212.96.95.194

🇺🇸 173.255.215.183

🇧🇷 129.121.47.136

🇻🇳 116.99.168.112

🇺🇸 104.20.38.165

🇮🇩 103.130.18.233

🇳🇬 102.88.137.213

🇳🇱 91.92.40.48

🇧🇬 78.90.19.40

🇺🇸 62.101.187.6

🇺🇸 35.236.109.134

🇺🇸 35.227.77.13

🇷🇺 31.43.194.174

🇺🇦 31.28.253.63

🇩🇪 213.209.159.238

🇺🇸 198.13.208.43

🇳🇱 195.178.110.137

🇪🇪 188.95.157.35