JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.27.124.135

120.27.124.135 was found in our database!

This IP was reported 280 times. Confidence of Abuse is 0%: ?

ISP	Aliyun Computing Co., LTD
Usage Type	Data Center/Web Hosting/Transit
ASN	AS37963
Domain Name	alibabacloud.com
Country	🇨🇳 China
City	Qingdao, Shandong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.27.124.135

Whois 120.27.124.135

IP Abuse Reports for 120.27.124.135:

This IP address has been reported a total of 280 times from 36 distinct sources. 120.27.124.135 was first reported on November 1st 2023, and the most recent report was 5 months ago.

Old Reports: The most recent abuse report for this IP address is from 5 months ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇨🇳 ThreatBook.io	2026-03-09 00:14:28 (5 months ago)	ThreatBook Intelligence: FTP Brute Force,Scanner more details on https://threatbook.io/ip/120.27.124 ... show more ThreatBook Intelligence: FTP Brute Force,Scanner more details on https://threatbook.io/ip/120.27.124.135 2026-03-08 15:30:53 /website.rar 2026-03-08 15:30:53 /website.tar 2026-03-08 15:30:53 /wwwroot.tar.gz 2026-03-08 15:30:53 /website.tar.tgz 2026-03-08 15:30:53 /website.tar.gz 2026-03-08 15:30:53 /website.gz 2026-03-08 15:30:53 /website.zip 2026-03-08 15:30:53 /wwwroot.rar 2026-03-08 15:30:53 /website.tgz 2026-03-08 15:30:53 /wwwroot.zip show less	Web App Attack
🇨🇳 ThreatBook.io	2026-03-06 00:23:18 (5 months ago)	ThreatBook Intelligence: FTP Brute Force,Scanner more details on https://threatbook.io/ip/120.27.124 ... show more ThreatBook Intelligence: FTP Brute Force,Scanner more details on https://threatbook.io/ip/120.27.124.135 2026-03-05 10:58:53 /wwwroot.rar 2026-03-05 10:56:42 /website.tar.tgz 2026-03-05 10:28:18 /website.rar 2026-03-05 10:37:02 /website.zip 2026-03-05 10:47:57 /website.tar.gz 2026-03-05 10:52:19 /website.tar 2026-03-05 10:54:30 /website.gz 2026-03-05 11:01:04 /wwwroot.zip 2026-03-05 10:50:08 /website.tgz 2026-03-05 11:03:15 /wwwroot.tar.gz show less	Web App Attack
🇨🇳 ThreatBook.io	2026-02-03 00:42:53 (6 months ago)	ThreatBook Intelligence: FTP Brute Force,Zombie more details on https://threatbook.io/ip/120.27.124. ... show more ThreatBook Intelligence: FTP Brute Force,Zombie more details on https://threatbook.io/ip/120.27.124.135 2026-02-02 03:02:08 /website.tar.tgz 2026-02-02 03:02:08 /website.tar 2026-02-02 03:02:08 /website.tgz 2026-02-02 03:02:08 /wwwroot.rar 2026-02-02 03:02:08 /wwwroot.zip 2026-02-02 03:02:08 /website.rar 2026-02-02 03:02:08 /website.gz 2026-02-02 03:02:08 /website.zip 2026-02-02 03:02:08 /wwwroot.tar.gz 2026-02-02 03:02:08 /website.tar.gz show less	Web App Attack
🇨🇳 ThreatBook.io	2026-01-27 01:07:30 (7 months ago)	ThreatBook Intelligence: FTP Brute Force,Zombie more details on https://threatbook.io/ip/120.27.124. ... show more ThreatBook Intelligence: FTP Brute Force,Zombie more details on https://threatbook.io/ip/120.27.124.135 2026-01-26 16:51:18 /wwwroot.tar.gz 2026-01-26 16:51:18 /wwwroot.rar 2026-01-26 16:51:18 /website.tgz 2026-01-26 16:51:18 /website.rar 2026-01-26 16:51:18 /wwwroot.zip 2026-01-26 16:51:18 /website.tar 2026-01-26 16:51:18 /website.tar.gz 2026-01-26 16:51:18 /website.gz 2026-01-26 16:51:18 /website.tar.tgz 2026-01-26 16:51:18 /website.zip show less	Web App Attack
🇨🇳 ThreatBook.io	2026-01-25 00:57:55 (7 months ago)	ThreatBook Intelligence: FTP Brute Force,Zombie more details on https://threatbook.io/ip/120.27.124. ... show more ThreatBook Intelligence: FTP Brute Force,Zombie more details on https://threatbook.io/ip/120.27.124.135 2026-01-24 04:32:43 /website.rar 2026-01-24 04:32:43 /website.gz 2026-01-24 04:32:43 /website.tar.gz 2026-01-24 04:32:43 /website.tar 2026-01-24 04:32:44 /wwwroot.tar.gz 2026-01-24 04:32:43 /website.tar.tgz 2026-01-24 04:32:43 /website.tgz 2026-01-24 04:32:43 /wwwroot.zip 2026-01-24 04:32:43 /wwwroot.rar 2026-01-24 04:32:43 /website.zip show less	Web App Attack
🇺🇸 Lashifu	2026-01-24 18:58:00 (7 months ago)	GET /admin.tar HTTP/1.1 cache-control: no-cache content-length: 0 accept: / x-forwarded-for: 1 ... show more GET /admin.tar HTTP/1.1 cache-control: no-cache content-length: 0 accept: / x-forwarded-for: 120.27.124.135 cookie: acw_tc=3cbc601017691623221188470e9d8270ddaa76cad23b90133615467abd; cdn_sec_tc=3cbc601017691623221188470e9d8270ddaa76cad23b90133615467abd; server_name_session=afd79d570ad8bccbaf44cedb344ec4b8 user-agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0) host: cnmnmsl.ink eagleeye-traceid: 3cbc601017691623259171228e cdn-loop: esa;loop=1 waf-intercept-client-ip-port: 120.27.124.135: show less	Port Scan Hacking Brute-Force Exploited Host
🇳🇱 Site.eu	2025-11-03 00:25:08 (9 months ago)	Excessive 404/403 errors	Brute-Force
Anonymous	2025-10-30 14:15:26 (10 months ago)	Account archive download attempts	Hacking Brute-Force
🇺🇸 kosada.com	2025-10-27 06:42:56 (10 months ago)	Web bot: DDoS	DDoS Attack Bad Web Bot
🇺🇸 TPI-Abuse	2025-10-24 11:53:04 (10 months ago)	(mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 24 07:52:56.647029 2025] [security2:error] [pid 20691:tid 20691] [client 120.27.124.135:64333] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.hipstan.com\|F\|2"] [data ".hipstan.com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hipstan.com"] [uri "/www.hipstan.com.sql"] [unique_id "aPtomAALLGF_m8NtOLnTdgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-10-23 11:10:54 (10 months ago)	(mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 23 07:10:46.169674 2025] [security2:error] [pid 25221:tid 25221] [client 120.27.124.135:50145] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.airintakesonline.com\|F\|2"] [data ".airintakesonline.com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.airintakesonline.com"] [uri "/www.airintakesonline.com.sql"] [unique_id "aPoNNs9ussMcPBzdpMIL0AAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-10-23 10:27:47 (10 months ago)	(mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 23 06:27:43.599132 2025] [security2:error] [pid 18057:tid 18057] [client 120.27.124.135:56652] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.jsw4.net\|F\|2"] [data ".jsw4.net.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.jsw4.net"] [uri "/www.jsw4.net.sql"] [unique_id "aPoDH16EpK553JhPcXKgZwAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-10-23 00:42:09 (10 months ago)	Account archive download attempts	Hacking Brute-Force
🇩🇪 igerman	2025-10-18 16:04:36 (10 months ago)	caddy probes: [web] GET /1.zip -> 403 [web] GET /1.tar.gz -> 403 [web] HEAD /1.tgz -> 403 [web] GET ... show more caddy probes: [web] GET /1.zip -> 403 [web] GET /1.tar.gz -> 403 [web] HEAD /1.tgz -> 403 [web] GET /1.tar -> 403 [web] GET /1.gz -> 403 [web] HEAD /1.tar.tgz -> 403 [web] GET /www.zip -> 403 [web] GET /www.tar.gz -> 403 [web] HEAD /www.tgz -> 403 [web] GET /www.tar -> 403 show less	Web App Attack
🇺🇸 TPI-Abuse	2025-10-17 22:55:30 (10 months ago)	(mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 120.27.124.135 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 17 18:55:26.679105 2025] [security2:error] [pid 20637:tid 20651] [client 120.27.124.135:60138] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.hkyiquan.org\|F\|2"] [data ".hkyiquan.org.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hkyiquan.org"] [uri "/www.hkyiquan.org.sql"] [unique_id "aPLJXjAOCwt_6LjQjJiu_gAAAEw"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 280 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇭🇰 199.45.155.86

🇻🇳 161.248.239.20

🇨🇳 60.212.0.13

🇮🇩 36.92.140.209

🇨🇳 1.29.252.142

🇵🇰 154.80.14.98

🇺🇸 91.230.168.251

🇸🇦 64.137.216.198

🇺🇸 35.237.179.210

🇺🇸 34.94.116.132

🇺🇸 198.44.46.138

🇺🇸 147.185.132.46

🇺🇸 66.198.167.120

🇪🇸 46.6.127.33

🇹🇼 35.221.185.189

🇺🇸 34.74.212.80

🇨🇳 182.34.193.57

🇹🇷 94.154.43.73

🇺🇸 85.239.151.10

🇮🇳 74.125.178.211