JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 60.20.50.19

60.20.50.19 was found in our database!

This IP was reported 25 times. Confidence of Abuse is 13%: ?

13%

ISP	China Unicom Liaoning province network
Usage Type	Fixed Line ISP
ASN	AS4837
Domain Name	chinaunicom.cn
Country	🇨🇳 China
City	Shenyang, Liaoning

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 60.20.50.19

Whois 60.20.50.19

IP Abuse Reports for 60.20.50.19:

This IP address has been reported a total of 25 times from 12 distinct sources. 60.20.50.19 was first reported on August 5th 2025, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 TPI-Abuse	2026-07-19 20:15:38 (2 days ago)	(mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 16:15:28.942403 2026] [security2:error] [pid 1864:tid 1892] [client 60.20.50.19:56432] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|agrigrailtech.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "agrigrailtech.com"] [uri "/"] [unique_id "al0wYKfi4dRnOb7xLV8mTAAAAEw"], referer: http://agrigrailtech.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-15 03:46:54 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 23:46:41.549287 2026] [security2:error] [pid 15410:tid 15410] [client 60.20.50.19:14097] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.ohiobabe.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.ohiobabe.com"] [uri "/"] [unique_id "alcCoVUlhv1uHcpdpNT-agAAABc"], referer: http://www.ohiobabe.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-05 23:12:04 (2 weeks ago)	(mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 05 19:11:59.319879 2026] [security2:error] [pid 9672:tid 9672] [client 60.20.50.19:49980] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.ran101.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.ran101.com"] [uri "/"] [unique_id "akrkv5tRMOHp8tibUjT6MQAAAAo"], referer: http://www.ran101.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 David Koswari	2026-07-03 06:39:00 (2 weeks ago)	REQ_BLOCKED_ACL	DDoS Attack FTP Brute-Force Ping of Death Port Scan Hacking SQL Injection Spoofing Brute-Force Bad Web Bot Exploited Host Web App Attack SSH IoT Targeted
🇺🇸 TPI-Abuse	2026-04-04 01:14:25 (3 months ago)	(mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 21:14:16.445907 2026] [security2:error] [pid 25751:tid 25751] [client 60.20.50.19:35801] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.mp3tracks.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.mp3tracks.com"] [uri "/"] [unique_id "adBl6PJK0sO4lL1jPrur_gAAAAc"], referer: http://www.mp3tracks.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 SOC Blue Team	2026-03-26 15:26:43 (3 months ago)	IPs get by Hunting on SIEM	Phishing Web Spam Port Scan Hacking
🇫🇮 6kilowatti	2026-03-26 01:26:38 (3 months ago)	2026-03-26T03:26:36.788409+02:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00: ... show more 2026-03-26T03:26:36.788409+02:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=60.20.50.19 DST=83.148.240.21 LEN=40 TOS=0x00 PREC=0x00 TTL=35 ID=4919 PROTO=TCP SPT=49294 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0 ... show less	Port Scan
🇩🇪 KPS	2026-03-25 23:57:07 (3 months ago)	PortscanM	Port Scan
Anonymous	2026-03-25 17:03:08 (3 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇮🇹 Progetto1	2026-03-16 07:39:05 (4 months ago)	Mail - Multiple failed login attempts	Brute-Force Exploited Host
🇮🇹 VHosting	2026-03-10 22:22:48 (4 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 TPI-Abuse	2026-02-21 21:06:29 (5 months ago)	(mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210831) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 21 16:06:26.095487 2026] [security2:error] [pid 27074:tid 27074] [client 60.20.50.19:1755] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|fisseq.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "fisseq.com"] [uri "/"] [unique_id "aZoeUr9IyJu1H7HU7GElWQAAAAE"], referer: http://fisseq.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 VHosting	2026-02-05 18:55:38 (5 months ago)	Detected mail brute force attack from 4 different servers	Brute-Force
🇺🇸 TPI-Abuse	2025-09-24 05:41:13 (9 months ago)	(mod_security) mod_security (id:210350) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210350) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 24 01:41:07.532333 2025] [security2:error] [pid 24580:tid 24580] [client 60.20.50.19:37880] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/game/166894/"] [unique_id "aNOEcx-0lfak-2g42dRFTQAAABM"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-09-21 15:06:44 (10 months ago)	(mod_security) mod_security (id:210350) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210350) triggered by 60.20.50.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 21 11:06:38.288808 2025] [security2:error] [pid 14693:tid 14693] [client 60.20.50.19:53986] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close\|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close\|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found\|\|www.renju.net\|F\|4"] [data "close, keep-alive"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.renju.net"] [uri "/people/090097/"] [unique_id "aNAUfg7gsI2tw7pKhfxBkQAAACY"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 25 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇳 209.38.120.71

🇷🇺 186.2.175.89

🇧🇷 179.216.241.230

🇬🇧 87.236.176.84

🇳🇱 85.137.93.150

🇫🇷 51.91.78.238

🇳🇱 45.153.34.204

🇹🇭 203.172.251.67

🇺🇸 185.147.157.139

🇳🇱 176.65.149.31

🇺🇸 146.190.222.185

🇯🇵 132.145.122.251

🇨🇦 85.217.149.26

🇺🇦 46.150.85.153

🇪🇸 2a00:1d24:409:93:9999::8

🇪🇸 213.179.217.8

🇮🇳 210.212.136.3

🇲🇳 202.37.109.47

🇺🇸 185.165.44.247

🇨🇳 112.94.5.43