JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 223.240.120.14

223.240.120.14 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 51%: ?

51%

ISP	CHINANET Anhui province network
Usage Type	Fixed Line ISP
ASN	AS140527
Domain Name	hf.ah.cn
Country	🇨🇳 China
City	Hefei, Anhui

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 223.240.120.14

Whois 223.240.120.14

IP Abuse Reports for 223.240.120.14:

This IP address has been reported a total of 16 times from 11 distinct sources. 223.240.120.14 was first reported on June 25th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 ruusvuu	2026-06-30 08:50:03 (1 week ago)	Automated abuse report: 15 attack/probe requests from China Telecom / CN. Targeted paths: /.env, /.e ... show more Automated abuse report: 15 attack/probe requests from China Telecom / CN. Targeted paths: /.env, /.env.local, /.env.production, /.env.development, /.env.dev. Sample log lines: [mir-com] [6/30/2026, 1:50:01 AM] GET .mirregistry.com/.env.tmp 404 223.240.120.14 - 1.035 ms [mir-com] [6/30/2026, 1:50:02 AM] GET .mirregistry.com/.env.swp 404 223.240.120.14 - 4.710 ms [mir-com] [6/30/2026, 1:50:03 AM] GET .mirregistry.com/.env~ 404 223.240.120.14 - 4.942 ms Detected by an automated web-server log monitor. show less	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 07:54:46 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:54:40.578926 2026] [security2:error] [pid 25915:tid 25915] [client 223.240.120.14:51448] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "meghanmack.com"] [uri "/.env.save"] [unique_id "akN2QEF5K0jaYNQax2i1JAAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 07:16:42 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:16:37.459039 2026] [security2:error] [pid 4049:tid 4049] [client 223.240.120.14:49857] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.meridianranchdrc.org"] [uri "/.env.bak"] [unique_id "akNtVYvtFTw7cs8NdNeirAAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 07:05:00 (1 week ago)	Aggressive web scan	Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 07:00:29 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 03:00:19.268978 2026] [security2:error] [pid 12940:tid 12940] [client 223.240.120.14:56589] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jayworthallen.com.drjaymissdiana.com"] [uri "/.env.staging"] [unique_id "akNpg7akRuqni4w_vkZQUQAAABI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-30 06:37:29 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 30 02:37:22.070146 2026] [security2:error] [pid 16508:tid 16658] [client 223.240.120.14:49354] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sellmantitle.com"] [uri "/.env.dev"] [unique_id "akNkIikszewJaBlyK7jM2QAAANE"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-30 05:44:04 (1 week ago)	Bot / scanning and/or hacking attempts: GET /.env.dev HTTP/1.1	Hacking Web App Attack
🇨🇭 4server	2026-06-30 05:38:57 (1 week ago)	[TueJun3007:38:53.8687562026][security2:error][pid1964207:tid1964272][client223.240.120.14:0]ModSecu ... show more [TueJun3007:38:53.8687562026][security2:error][pid1964207:tid1964272][client223.240.120.14:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"365\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"inserzioniticino.ch.81-17-25-250.cpanel.site\"][uri\"/frontend/.env\"][unique_id\"akNWbdUNwy28kuTrmJITDAAAAYA\"] show less	Hacking Web App Attack
🇺🇸 Sling	2026-06-30 05:32:42 (1 week ago)	Automated detection: IP accessed 14 sensitive endpoints within 30s on api.slingexe.com. Paths: /.env ... show more Automated detection: IP accessed 14 sensitive endpoints within 30s on api.slingexe.com. Paths: /.env, /.env.local, /.env.production, /.env.dev, /.env.backup, /.env.bak, /.env.example, /.env.sample, /env, /app/.env. UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran). show less	Web App Attack Bad Web Bot Hacking
🇫🇷 masterguru	2026-06-30 05:09:53 (1 week ago)	Restricted File Access Attempt. Matched phrase "compose.yaml" at REQUEST_FILENAME. (930130-193)	Hacking Web App Attack
Anonymous	2026-06-28 13:07:03 (1 week ago)	Automated web scanner. Requested suspicious paths: /.env.prod. UTC: 2026-06-28 12:17:30.	Web App Attack
🇺🇸 TPI-Abuse	2026-06-28 02:39:22 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 223.240.120.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 22:39:17.585740 2026] [security2:error] [pid 20669:tid 20669] [client 223.240.120.14:40063] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "more-grace.com"] [uri "/.env"] [unique_id "akCJVTbA1PqUyGJ0bGm1VAAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Bedios GmbH	2026-06-27 15:13:08 (2 weeks ago)	Login credentials theft attempt	Hacking
🇳🇱 homeshowdomain.nl	2026-06-26 22:02:51 (2 weeks ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-25. show less	Web App Attack SSH Hacking
🇳🇱 homeshowdomain.nl	2026-06-25 22:01:48 (2 weeks ago)	Auto-ban: >3000 req/min op 2026-06-25	Web App Attack SSH Hacking

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇷🇴 193.46.255.86

🇩🇪 185.242.3.195

🇬🇧 185.216.145.178

🇺🇸 162.216.150.196

🇫🇷 158.220.99.210

🇺🇸 104.152.52.200

🇪🇸 90.162.116.66

🇳🇱 89.21.67.136

🇺🇸 66.132.224.28

🇯🇵 49.251.137.156

🇧🇪 34.76.135.15

🇨🇦 20.220.212.5

🇺🇸 20.55.117.85

🇺🇸 2607:f8b0:4004:100d::122

🇨🇿 213.192.2.99

🇧🇪 207.175.0.82

🇫🇮 204.168.155.174

🇹🇳 197.2.89.119

🇺🇸 193.3.53.4

🇲🇽 189.217.130.86