This IP address has been reported a total of
9
times from
8 distinct
sources.
213.200.31.120 was first reported on
January 27th 2025 , and the most recent report was
2 days ago United States of America
with 2
reports;
Russian Federation
with 1
report.
The most common categories in these recent reports were:
Bad Web Bot
3
times;
Brute-Force
1
time;
Hacking
1
time;
DDoS Attack
1
time;
Web App Attack
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-10-06 13:23:57
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 213.200.31.120 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210350) triggered by 213.200.31.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 09:23:50.241428 2026] [security2:error] [pid 30957:tid 30957] [client 213.200.31.120:3034] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mexicanfriedicecreammix.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mexicanfriedicecreammix.com"] [uri "/"] [unique_id "asT2ZgMYcVG7VkCJxlaTPwAAAA4"], referer: https://backlinksupplier.site/dir/quality-backlink-services-135366
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-17 17:30:59
(3 weeks ago)
Large-scale coordinated botnet (5M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ...
show more
Large-scale coordinated botnet (5M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Blocked by User-Agent Filter: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 | UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇺🇸
kosada.com
2026-08-25 14:54:46
(1 month ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇩🇪
LRob
2026-08-04 07:07:24
(2 months ago)
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_forma ...
show more
CrowdSec: Distributed L7 HTTP flood on WordPress 'The Events Calendar' AJAX endpoints (request_format~json) - DDoS | req: /calendrier-2/action~agenda/time_limit~1763852400/cat_ids~122,194/tag_ids~654,596,581,623,729/request_format~json/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36
show less
DDoS Attack
Web App Attack
🇺🇸
kosada.com
2026-06-29 07:39:36
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
johnkarlhill
2026-03-28 13:47:53
(6 months ago)
WebKnight blocked malicious web request on johnkarlhill.com
Brute-Force
SSH
🇪🇸
el-brujo
2026-02-28 12:53:41
(7 months ago)
Cloudflare WAF: Request Path: /inclusiones/plantillas/006%28%2F%2A%2150000SELECT%2A%2F1026%2F%2A%215 ...
show more
Cloudflare WAF: Request Path: /inclusiones/plantillas/006%28%2F%2A%2150000SELECT%2A%2F1026%2F%2A%2150000FROM%2A%2F%28%2F%2A%2150000SELECT%2A%2F%2F%2A%2150000COUNT%2A%2F%28%2A%29%2C%2F%2A%2150000CONCAT%2A%2F%28%2527~%2527%2C%28%2F%2A%2150000SELECT%2A%2F%28ELT%281026=1026%2C1%29%29%29%2C%2527~%2527%2CFLOOR%28RAND%280%29%2A2%29%29x%2F%2A%2150000FROM%2A%2FINFORMATION_SCHEMA.PLUGINS%2F%2A%2150000GROUP%2A%2F%2F%2A%2150000BY%2A%2Fx%29a%29--%20-/script.js Request Query: Host: www.elhacker.net userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Action: block Source: firewallManaged ASN Description: MAGTICOMAS Magticom Country: GE Method: GET Timestamp: 2026-02-28T12:53:41Z ruleId: 8629bb58defe4193ab4d493c7bd2d8fa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇮🇩
hermawan
2025-11-27 17:20:27
(10 months ago)
[Thu Nov 27 23:04:43.252748 2025] [security2:error] [pid 991162:tid 139900473984704] [client 213.200 ...
show more
[Thu Nov 27 23:04:43.252748 2025] [security2:error] [pid 991162:tid 139900473984704] [client 213.200.31.120:20528] ModSecurity: Access denied with code 403 (phase 2). Pattern match "." at ARGS_NAMES:start. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "728"] [id "921170"] [msg "deny 921170"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: s found within ARGS_NAMES:start: start request_line = GET /index.php/profil/meteorologi/list-of-all-tags/analisis-klimatologi?start=2500 HTTP/1.1 Request URI RAW = /index.php/profil/meteorologi/list-of-all-tags/analisis-klimatologi?start=2500 Request Basename = analisis-klimatologi"] [ver "OWASP_CRS/4.20.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ATTACK"] [tag "capec/1000/152/137/15/460"] [hostname "staklim-malang.info"] [uri "/index.php/profil/m
...
show less
Hacking
Web App Attack
🇺🇸
LARL-Stompro-2024
2025-01-27 06:21:07
(1 year ago)
Evergreen ILS - Mylist Bot Abuse - HTTP Port 443 - Fake UserAgent. Requests:1
Bad Web Bot
Showing 1 to
9
of 9 reports
