JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 180.153.236.231

180.153.236.231 was found in our database!

This IP was reported 206 times. Confidence of Abuse is 39%: ?

39%

ISP	CHINANET SHANGHAI PROVINCE NETWORK
Usage Type	Fixed Line ISP
ASN	AS4811
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 180.153.236.231

Whois 180.153.236.231

IP Abuse Reports for 180.153.236.231:

This IP address has been reported a total of 206 times from 25 distinct sources. 180.153.236.231 was first reported on September 23rd 2025, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-07-31 19:06:19 (15 hours ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇹🇷 neron	2026-07-30 13:06:18 (1 day ago)	CrowdSec blocked: http:exploit detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 20:18:39 (5 days ago)	(mod_security) mod_security (id:949110) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:949110) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 16:18:34.690818 2026] [security2:error] [pid 3717665:tid 3717665] [client 180.153.236.231:8959] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "servicesafes.com"] [uri "/"] [unique_id "amZrmn06hpZZZPy4A6PVnAAAAAE"], referer: https://servicesafes.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-26 13:07:04 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 26 09:06:57.337221 2026] [security2:error] [pid 58942:tid 58942] [client 180.153.236.231:53813] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.nationalnova.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.nationalnova.com"] [uri "/"] [unique_id "amYGcbmriiH7u624HYLO-QAAAAo"], referer: http://www.nationalnova.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 05:31:29 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 01:31:24.223941 2026] [security2:error] [pid 30860:tid 30860] [client 180.153.236.231:13663] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|e-zschedule.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "e-zschedule.com"] [uri "/"] [unique_id "al8ELHC1T-05cCK7LehwFAAAAAk"], referer: https://e-zschedule.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-19 09:23:46 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 05:23:39.357263 2026] [security2:error] [pid 7874:tid 7874] [client 180.153.236.231:8567] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.customdesignsbybjp.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.customdesignsbybjp.com"] [uri "/"] [unique_id "alyXm4mQfir86ihjB23NfwAAAAA"], referer: https://www.customdesignsbybjp.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-16 08:32:47 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 04:32:41.401268 2026] [security2:error] [pid 11184:tid 11184] [client 180.153.236.231:64121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.hotpay.co\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.hotpay.co"] [uri "/"] [unique_id "aliXKRLA5eBN4Z5Nl-CeuQAAAAc"], referer: https://www.hotpay.co/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 4server	2026-07-16 06:44:08 (2 weeks ago)	[ThuJul1608:44:03.0900092026][security2:error][pid300324:tid300340][client180.153.236.231:0]ModSecur ... show more [ThuJul1608:44:03.0900092026][security2:error][pid300324:tid300340][client180.153.236.231:0]ModSecurity:Accessdeniedwithcode403$phase2$.Matchof\"rx$http://bsalsa\\\\\\\\.com\\|\^site24x7$\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"www.asw-sa.com\"][uri\"/\"][unique_id\"alh9swjYxcW6N3lCOEvu4AAAAUU\"]\,referer:http://www.asw-sa.com/ show less	Port Scan Brute-Force Web App Attack
🇺🇸 TPI-Abuse	2026-07-13 08:34:14 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 13 04:34:08.975537 2026] [security2:error] [pid 30529:tid 30529] [client 180.153.236.231:29113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.stkm.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.stkm.com"] [uri "/"] [unique_id "alSjAN8gDTJLlt19kQWCWAAAAAM"], referer: https://www.stkm.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇨🇴 adalbertoreyes.org	2026-07-12 17:05:58 (2 weeks ago)	CategoryPortScan	Port Scan
🇮🇩 Burayot	2026-07-12 10:46:36 (2 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.153.236.231 (CN/China/-): 1 in t ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 180.153.236.231 (CN/China/-): 1 in the last 3600 secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 06:36:00 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 02:35:54.745297 2026] [security2:error] [pid 22232:tid 22232] [client 180.153.236.231:11235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.stationrestaurant.ca\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.stationrestaurant.ca"] [uri "/"] [unique_id "alM1ykFDL3ZkzqiQidyk8QAAAAQ"], referer: https://www.stationrestaurant.ca/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-12 06:13:47 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 02:13:41.950543 2026] [security2:error] [pid 961:tid 973] [client 180.153.236.231:18493] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|reclaimingspirituality.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "reclaimingspirituality.com"] [uri "/"] [unique_id "alMwla2DAZPGxdFfHzkU6gAAAIU"], referer: https://reclaimingspirituality.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 Progetto1	2026-07-11 04:50:03 (3 weeks ago)	Website Scanning / Scraping	Bad Web Bot Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-09 17:33:28 (3 weeks ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 09 13:33:23.170578 2026] [security2:error] [pid 24716:tid 24716] [client 180.153.236.231:6001] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|swwpccpa.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "swwpccpa.com"] [uri "/"] [unique_id "ak_bYz5RrsElIdN3Wvw66gAAAAU"], referer: http://swwpccpa.com/ show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 206 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇷 95.0.32.184

🇺🇸 205.210.31.34

🇧🇪 198.235.24.209

🇧🇷 168.228.220.166

🇳🇱 138.226.239.10

🇨🇳 117.62.22.100

🇮🇳 103.89.136.111

🇰🇷 49.142.74.19

🇧🇩 37.111.245.173

🇨🇳 1.14.110.85

🇺🇸 2a09:bac5:9444:3af::5e:68

🇬🇧 2a06:4880::20

🇮🇩 202.51.214.99

🇨🇳 180.184.36.192

🇮🇳 143.110.241.64

🇫🇷 91.196.152.222

🇫🇷 91.196.152.219

🇫🇷 85.217.140.15

🇸🇬 47.236.152.137

🇺🇸 45.61.150.67