JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 120.82.84.128

120.82.84.128 was found in our database!

This IP was reported 13 times. Confidence of Abuse is 4%: ?

ISP	China Unicom Guangdong province network
Usage Type	Fixed Line ISP
ASN	AS17816
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Shenzhen, Guangdong

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 120.82.84.128

Whois 120.82.84.128

IP Abuse Reports for 120.82.84.128:

This IP address has been reported a total of 13 times from 3 distinct sources. 120.82.84.128 was first reported on March 16th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-15 04:02:11 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 00:02:04.279769 2026] [security2:error] [pid 10611:tid 10611] [client 120.82.84.128:59388] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.garbothemusical.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.garbothemusical.net"] [uri "/"] [unique_id "alcGPKdXlLj7Rx9ASTNBbwAAAAE"], referer: http://www.garbothemusical.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-05 20:16:12 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 16:16:05.984161 2026] [security2:error] [pid 31439:tid 31439] [client 120.82.84.128:36935] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|g-h2o.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "g-h2o.com"] [uri "/"] [unique_id "aiMuhTHUrQmnToDUIo5XNQAAAAU"], referer: http://g-h2o.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-01 22:46:16 (1 month ago)	(mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 18:46:10.828834 2026] [security2:error] [pid 10373:tid 10373] [client 120.82.84.128:38711] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.danafrostick.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.danafrostick.com"] [uri "/"] [unique_id "ah4Lsii7piNU1z6mekiQgwAAABo"], referer: http://www.danafrostick.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-04-26 21:39:39 (2 months ago)	(mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 17:39:33.840954 2026] [security2:error] [pid 4130:tid 4130] [client 120.82.84.128:47458] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|cameronwv.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cameronwv.com"] [uri "/"] [unique_id "ae6GFS6Tpcce0B1dFm299QAAAB0"], referer: http://cameronwv.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-03-23 02:08:17 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 22:08:10.444667 2026] [security2:error] [pid 21313:tid 21313] [client 120.82.84.128:15466] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|homebuilt.org\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "homebuilt.org"] [uri "/index.html"] [unique_id "acCgiqGJsb49-A6iWaLH7gAAAA0"], referer: http://homebuilt.org/index.html show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-01-30 19:29:37 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210831) triggered by 120.82.84.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 30 14:29:30.959746 2026] [security2:error] [pid 13393:tid 13393] [client 120.82.84.128:7830] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|yakarinc.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "yakarinc.com"] [uri "/"] [unique_id "aX0Gmkl8qXGCQCN3Zz72ugAAAAg"], referer: http://yakarinc.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2025-11-27 16:26:05 (7 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇨🇳 ThreatBook.io	2025-11-21 23:34:44 (7 months ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-11-21 14 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-11-21 14:54:48 / 2025-11-21 15:02:35 /favicon.ico 2025-11-21 18:04:12 / 2025-11-21 16:53:13 / show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-24 00:18:42 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-05-23 23 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-05-23 23:22:00 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-05-01 23:50:08 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-05-01 06 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-05-01 06:55:13 /sitemap.xml 2025-05-01 05:04:57 /robots.txt show less	Web App Attack
🇨🇳 ThreatBook.io	2025-04-28 23:46:01 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-04-28 17 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-04-28 17:34:22 /sitemap.xml show less	Web App Attack
🇨🇳 ThreatBook.io	2025-04-26 23:40:55 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-04-26 12 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-04-26 12:21:34 /config.json show less	Web App Attack
🇨🇳 ThreatBook.io	2025-03-16 23:35:28 (1 year ago)	ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-03-16 20 ... show more ThreatBook Intelligence: Gateway more details on http://threatbook.io/ip/120.82.84.128 2025-03-16 20:21:25 /explore/projects?non_archived=true&page=2&sort=latest_activity_desc show less	Web App Attack

Showing 1 to 13 of 13 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇪 198.235.24.147

🇳🇱 195.178.110.28

🇨🇦 170.9.40.164

🇲🇼 168.253.224.242

🇪🇸 158.49.70.49

🇷🇺 94.41.141.36

🇳🇱 45.148.10.141

🇹🇼 34.81.72.185

🇪🇹 196.188.187.59

🇮🇷 185.109.244.91

🇫🇮 147.185.133.181

🇫🇷 141.95.170.136

🇸🇬 124.197.123.46

🇻🇳 103.133.109.99

🇩🇪 69.5.169.242

🇳🇱 195.178.110.227

🇩🇪 193.148.56.148

🇸🇬 157.230.254.77

🇧🇷 138.94.139.36

🇨🇳 112.25.252.50