JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 117.20.112.110

117.20.112.110 was found in our database!

This IP was reported 15 times. Confidence of Abuse is 59%: ?

59%

ISP	Smart Axiata Co., Ltd.
Usage Type	Mobile ISP
ASN	AS45498
Domain Name	smart.com.kh
Country	🇰🇭 Cambodia
City	Phnom Penh, Phnom Penh

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 117.20.112.110

Whois 117.20.112.110

IP Abuse Reports for 117.20.112.110:

This IP address has been reported a total of 15 times from 14 distinct sources. 117.20.112.110 was first reported on November 26th 2020, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇫🇷 IRISIO	2026-07-07 15:00:10 (3 days ago)	scans/SQL injection/spam posts : 7 queries	Web App Attack SQL Injection
🇬🇧 thetomtaylor.co.uk	2026-07-05 03:08:02 (5 days ago)	Fail2Ban - [WAF]ModSecurity OWASP CRS rule violation on nginx-modsecurity ... [ice02,wa01,wa02]	Hacking SQL Injection Web App Attack
Anonymous	2026-07-05 00:28:04 (5 days ago)	Bot / scanning and/or hacking attempts: GET /.env.backup HTTP/1.1, GET /deployment-config.json HTTP/ ... show more Bot / scanning and/or hacking attempts: GET /.env.backup HTTP/1.1, GET /deployment-config.json HTTP/1.1, GET /.netrc HTTP/1.1, GET /wp-config.bak HTTP/1.1, GET /access.log HTTP/1.1, GET /.github/workflows/deploy.yml HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env HTTP/1.1, GET /sftp.json HTTP/1.1, GET /config.php.bak HTTP/1.1, GET /wp-config.php.save HTTP/1.1, GET /config.json HTTP/1.1, GET /.env.production HTTP/1.1, GET /bitbucket-pipelines.yml HTTP/1.1, GET /wp-config.php~ HTTP/1.1, GET /.env.local HTTP/1.1, GET /deploy.yml HTTP/1.1, GET /.vscode/ftp-sync.json HTTP/1.1, GET /database.json HTTP/1.1, GET /.deploy HTTP/1.1, GET /.env.development HTTP/1.1, GET /appspec.yml HTTP/1.1, GET /plesk.json HTTP/1.1, GET /deploy.yaml HTTP/1.1, GET /database.yml HTTP/1.1 show less	Hacking Web App Attack
🇬🇧 consul.to	2026-07-05 00:17:54 (5 days ago)	Web attack/malicious scanning detected	Web App Attack
🇺🇸 TPI-Abuse	2026-07-04 23:33:30 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 117.20.112.110 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 117.20.112.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 19:33:21.458121 2026] [security2:error] [pid 5626:tid 5626] [client 117.20.112.110:27324] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paragonprintingcenter.com"] [uri "/sftp-config.json"] [unique_id "akmYQeOUvS6lbG4a4gd2XQAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-07-04 22:29:54 (5 days ago)	118 requests with url.path .php.bak 104 requests with url.path config.json	Brute-Force Bad Web Bot
🇬🇧 Apache	2026-07-04 19:26:27 (5 days ago)	(mod_security) mod_security (id:210492) triggered by 117.20.112.110 (KH/Cambodia/-): 5 in the last 3 ... show more (mod_security) mod_security (id:210492) triggered by 117.20.112.110 (KH/Cambodia/-): 5 in the last 300 secs (CF_ENABLE) show less	Brute-Force Web App Attack
🇫🇷 COMAITE	2026-07-04 18:47:08 (6 days ago)	Suspicious URL access.	Web App Attack
🇺🇸 TPI-Abuse	2026-07-04 17:31:34 (6 days ago)	(mod_security) mod_security (id:210492) triggered by 117.20.112.110 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 117.20.112.110 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 13:31:21.530022 2026] [security2:error] [pid 15020:tid 15020] [client 117.20.112.110:18171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.ctrussell.us"] [uri "/sftp-config.json"] [unique_id "aklDaUFXdnSaxyNxJkAywwAAAAY"] show less	Brute-Force Bad Web Bot Web App Attack
🇳🇱 Alboweb B.V.	2026-07-04 17:13:04 (6 days ago)	Apache web server attack detected by Fail2Ban in plesk-apache jail	Web App Attack
🇳🇱 Savvii	2026-07-04 16:36:45 (6 days ago)	20 attempts against mh-misbehave-ban on redirect	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-16 02:40:05 (7 months ago)	scanning http requests from known botnet	Web App Attack
🇳🇱 exxos	2025-09-08 04:03:01 (10 months ago)	Attacks with Bad user agents	Hacking
Anonymous	2024-05-22 16:16:17 (2 years ago)	Automatic report - Vulnerability scan /autodiscover/autodiscover.xml	Web App Attack
🇳🇱 taivas.nl	2020-11-26 23:00:09 (5 years ago)	Spammer	Email Spam

Showing 1 to 15 of 15 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇪 41.215.125.250

🇺🇸 15.218.135.58

🇯🇵 8.216.4.147

🇧🇷 191.205.211.13

🇱🇾 154.127.69.19

🇨🇳 121.225.55.146

🇳🇱 45.153.34.186

🇨🇳 42.81.126.27

🇸🇳 41.82.50.218

🇭🇺 31.46.172.169

🇺🇸 2607:f8b0:4023:1006::12e

🇺🇦 195.64.250.116

🇧🇷 177.221.172.30

🇭🇰 154.221.25.72

🇳🇱 142.93.135.160

🇨🇳 111.9.232.121

🇻🇳 103.179.174.112

🇮🇹 95.255.158.96

🇷🇴 92.118.39.71

🇺🇿 87.192.228.148