JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 180.153.236.220

180.153.236.220 was found in our database!

This IP was reported 278 times. Confidence of Abuse is 42%: ?

42%

ISP	CHINANET SHANGHAI PROVINCE NETWORK
Usage Type	Fixed Line ISP
ASN	AS4811
Domain Name	chinatelecom.cn
Country	🇨🇳 China
City	Shanghai, Shanghai

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 180.153.236.220

Whois 180.153.236.220

IP Abuse Reports for 180.153.236.220:

This IP address has been reported a total of 278 times from 30 distinct sources. 180.153.236.220 was first reported on September 23rd 2025, and the most recent report was 16 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 neron	2026-10-22 10:34:59 (16 hours ago)	CrowdSec blocked: http:scan detected via OPNsense firewall	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-10-22 05:54:08 (21 hours ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 01:54:02.843988 2026] [security2:error] [pid 3718:tid 3718] [client 180.153.236.220:57309] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.jeranny.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.jeranny.com"] [uri "/"] [unique_id "atmk-t03jI17nnAHGq7gMgAAAAA"], referer: https://www.jeranny.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-19 04:19:07 (3 days ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 00:19:03.323596 2026] [security2:error] [pid 2019:tid 2019] [client 180.153.236.220:62195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|jerryfeil.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "jerryfeil.com"] [uri "/"] [unique_id "atWaN6vl5eo6PNdh34NEggAAAAk"], referer: https://jerryfeil.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-18 21:40:17 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 17:40:08.251206 2026] [security2:error] [pid 6611:tid 6611] [client 180.153.236.220:10753] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|miles2go.net\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "miles2go.net"] [uri "/"] [unique_id "atU8uITO5LjKPm_TNf7y5gAAABA"], referer: http://miles2go.net/ show less	Brute-Force Bad Web Bot Web App Attack
🇮🇹 CoreTech srl	2026-10-18 20:58:56 (4 days ago)	cloudlinux2 fail2ban: 2026-10-18 22:54:09,370 fail2ban.actions [2057]: NOTICE [plesk-modsecu ... show more cloudlinux2 fail2ban: 2026-10-18 22:54:09,370 fail2ban.actions [2057]: NOTICE [plesk-modsecurity] Unban 34.32.110.88cloudlinux2 fail2ban: 2026-10-18 22:54:45,396 fail2ban.filter [2057]: INFO [plesk-modsecurity] Found 180.153.236.220 - 2026-10-18 22:54:45cloudlinux2 fail2ban: 2026-10-18 22:55:03,033 fail2ban.filter [2057]: INFO [plesk-modsecurity] Found 180.153.236.57 - 2026-10-18 22:55:02cloudlinux2 fail2ban: 2026-10-18 22:55:29,637 fail2ban.filter [2057]: INFO [plesk-wordpress] Found 170.84.173.19 - 2026-10-18 22:55:29cloudlinux2 fail2ban: 2026-10-18 22:55:22,490 fail2ban.filter [2057]: INFO [plesk-modsecurity] Found 34.162.103.181 - 2026-10-18 22:55:22cloudlinux2 fail2ban: 2026-10-18 22:55:22,673 fail2ban.actions [2057]: NOTICE [plesk-modsecurity] Ban 34.162.103.181cloudlinux2 fail2ban: 2026-10-18 22:55:22,265 fail2ban.filter [2057]: INFO [plesk-modsecurity] Found 34.162.103.181 - 2026-10-18 22:55:22cloudlinux2 fail2ban: 2026-10-18 22:55 show less	Web App Attack
🇺🇸 TPI-Abuse	2026-10-18 19:50:40 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 15:50:32.927035 2026] [security2:error] [pid 25065:tid 25092] [client 180.153.236.220:25135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|jimlawrencesongs.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "jimlawrencesongs.com"] [uri "/"] [unique_id "atUjCE8DaIFSN-wwG4BmHQAAAJE"], referer: http://jimlawrencesongs.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-18 05:41:19 (4 days ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:41:13.445218 2026] [security2:error] [pid 6396:tid 6408] [client 180.153.236.220:9223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.casademontemaior.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.casademontemaior.com"] [uri "/"] [unique_id "atRb-Yc1mEkT0JDHjh3DmgAAAQg"], referer: http://www.casademontemaior.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-17 04:35:19 (5 days ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 00:35:13.968878 2026] [security2:error] [pid 3228:tid 3228] [client 180.153.236.220:17787] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.my-spec.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.my-spec.com"] [uri "/"] [unique_id "atL7AVwdz8ZLH6UZj5HMewAAAAs"], referer: https://www.my-spec.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-12 05:33:06 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 01:33:00.522874 2026] [security2:error] [pid 27256:tid 27256] [client 180.153.236.220:9579] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|stoneybluff.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "stoneybluff.com"] [uri "/"] [unique_id "asxxDGHbUL7EAqZqPN6R7wAAAAY"], referer: https://stoneybluff.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 20:48:18 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 16:48:10.720234 2026] [security2:error] [pid 11910:tid 11910] [client 180.153.236.220:61427] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.humbliaslaw.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.humbliaslaw.com"] [uri "/"] [unique_id "asv2Co6Ukl9CgQMszXaa9QAAAAs"], referer: https://www.humbliaslaw.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 18:52:42 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 14:52:36.318458 2026] [security2:error] [pid 5357:tid 5357] [client 180.153.236.220:52275] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|bigholegolf.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "bigholegolf.com"] [uri "/"] [unique_id "asva9KuX7le-KQyU_x5HogAAAA4"], referer: https://bigholegolf.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 09:27:13 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 05:27:05.886817 2026] [security2:error] [pid 18896:tid 18957] [client 180.153.236.220:61683] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.power51.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.power51.com"] [uri "/"] [unique_id "astWaXhXORFgUqBQTc38HAAAAYc"], referer: https://www.power51.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 08:50:13 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 04:50:09.202771 2026] [security2:error] [pid 23794:tid 23794] [client 180.153.236.220:26495] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.ngmweb.com\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.ngmweb.com"] [uri "/"] [unique_id "astNwYMWWMVubnT45tEVJQAAADg"], referer: http://www.ngmweb.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-10-11 08:09:22 (1 week ago)	(mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Po ... show more (mod_security) mod_security (id:210831) triggered by 180.153.236.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 04:09:16.494360 2026] [security2:error] [pid 1190:tid 1190] [client 180.153.236.220:28517] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url\|user-Agent\|www\\\\.weblogs\\\\.com\|(?:jakart\|vi)a\|(google\|i{0,1}explorer{0,1}\\\\.exe\|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)\|\\\\bdatacha0s\\\\b\|; widows\|\\\\\\\\r\|a(?: href=\|d(?:sarobot\|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler\|\|www.olibrice.ai\|F\|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.olibrice.ai"] [uri "/"] [unique_id "astELBkxd90DYV2vt_TRHAAAAAc"], referer: http://www.olibrice.ai/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 SA19999	2026-10-07 08:00:30 (2 weeks ago)	Auto-report: ps:modsec:913100 \| sources=["ps-feeder"] \| Fox honeypot cluster	Web App Attack

Showing 1 to 15 of 278 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 176.65.132.132

🇬🇧 64.205.72.10

🇺🇸 216.180.246.250

🇮🇳 216.10.242.215

🇲🇽 201.119.236.102

🇦🇷 186.139.251.57

🇨🇱 186.78.17.239

🇺🇸 184.105.139.80

🇮🇳 180.94.216.137

🇺🇸 165.154.162.193

🇸🇬 149.118.51.53

🇭🇷 149.102.247.245

🇮🇩 103.187.165.26

🇧🇩 103.159.2.113

🇸🇮 102.220.161.170

🇳🇱 77.91.71.91

🇺🇸 66.132.224.24

🇺🇸 52.20.62.58

🇨🇦 51.222.26.148

🇸🇬 43.156.250.119