JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 130.131.200.54

130.131.200.54 was found in our database!

This IP was reported 17 times. Confidence of Abuse is 53%: ?

53%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 130.131.200.54

Whois 130.131.200.54

IP Abuse Reports for 130.131.200.54:

This IP address has been reported a total of 17 times from 11 distinct sources. 130.131.200.54 was first reported on March 21st 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇹🇷 SeczarSecureOps	2026-06-03 05:42:26 (2 days ago)	Seczar SecureOps — Port Scan Detection (9 events) — quarantined 43200m on fgdcapi	Port Scan
🇮🇪 AutosOnShow	2026-06-03 05:19:05 (2 days ago)	blocked for webapp attack \| path requested: /.env \| seen at 2026-06-03 05:18:38.384 \|	Web App Attack
🇳🇱 Yachiyo Runami	2026-06-03 05:14:57 (2 days ago)	Port Scan on Honeypot \| Ports: 8080/HTTP-proxy, 80/HTTP \| Proto: TCP(2) \| Flags: all SYN \| TTL: 47 \| ... show more Port Scan on Honeypot \| Ports: 8080/HTTP-proxy, 80/HTTP \| Proto: TCP(2) \| Flags: all SYN \| TTL: 47 \| Len: 60B(2x) \| Win: 64240(2) \| F2B/ufw-honeypot@2026-06-03T05:14:57Z show less	Port Scan Hacking
Anonymous	2026-06-03 04:47:44 (2 days ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
🇬🇧 PeravixGroup	2026-06-03 04:23:12 (2 days ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇨🇿 plzenskypruvodce.cz	2026-06-03 04:19:45 (2 days ago)	[Wed Jun 03 06:19:40.577013 2026] [access_compat:error] [pid 1366262:tid 1366290] [client 130.131.20 ... show more [Wed Jun 03 06:19:40.577013 2026] [access_compat:error] [pid 1366262:tid 1366290] [client 130.131.200.54:55363] AH01797: client denied by server configuration: /var/www/baletniskola-ok.cz/www/server-status [Wed Jun 03 06:19:44.543688 2026] [authz_core:error] [pid 1366262:tid 1366312] [client 130.131.200.54:56423] AH01630: client denied by server configuration: /var/www/baletniskola-ok.cz/www/.htpasswd ... show less	Web App Attack
🇺🇸 TPI-Abuse	2026-05-23 08:55:32 (1 week ago)	(mod_security) mod_security (id:210492) triggered by 130.131.200.54 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 130.131.200.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 23 04:55:25.206266 2026] [security2:error] [pid 29695:tid 29695] [client 130.131.200.54:34858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thesilverlegion.org"] [uri "/config/.env"] [unique_id "ahFrfc3NuGtO57Ke1NZW4gAAAAA"], referer: https://chat.openai.com/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-05-23 07:54:25 (1 week ago)	(PERMBLOCK) 130.131.200.54 (US/United States/-) has had more than 4 temp blocks in the last 86400 se ... show more (PERMBLOCK) 130.131.200.54 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
Anonymous	2026-05-23 06:53:11 (1 week ago)	(caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:06:53:08 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:06:53:08 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:06:53:08 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:06:53:08 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:06:53:08 +0000] "GET /@fs/.env?import&raw HTTP/1.1" show less	Port Scan
Anonymous	2026-05-23 05:52:51 (1 week ago)	(caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:05:52:46 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:05:52:46 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:05:52:46 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:05:52:46 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:05:52:46 +0000] "GET /@fs/.env?import&raw HTTP/1.1" show less	Port Scan
Anonymous	2026-05-23 04:52:43 (1 week ago)	(caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:04:52:39 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:04:52:39 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:04:52:39 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:04:52:39 +0000] "GET /@fs/.env?import&raw HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:04:52:39 +0000] "GET /@fs/.env.local?import&raw HTTP/1.1" show less	Port Scan
Anonymous	2026-05-23 03:49:46 (1 week ago)	(caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Po ... show more (caddyscan) Scanner path probe from 130.131.200.54 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:03:49:42 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:03:49:42 +0000] "GET /config/.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:03:49:42 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:03:49:43 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 130.131.200.54 - - [23/May/2026:03:49:43 +0000] "GET /.env HTTP/1.1" show less	Port Scan
🇩🇪 2048	2026-05-04 08:24:38 (1 month ago)	2026-05-04T10:24:35.513272+02:00 machodeer kernel: [590991.057112] [UFW BLOCK] IN=ens3 OUT= MAC=REDA ... show more 2026-05-04T10:24:35.513272+02:00 machodeer kernel: [590991.057112] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=130.131.200.54 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=10877 DF PROTO=TCP SPT=6400 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-05-04T10:24:36.556369+02:00 machodeer kernel: [590992.099808] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=130.131.200.54 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=10878 DF PROTO=TCP SPT=6400 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-05-04T10:24:37.579576+02:00 machodeer kernel: [590993.123474] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=130.131.200.54 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=10879 DF PROTO=TCP SPT=6400 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 show less	Port Scan
🇩🇪 2048	2026-05-03 08:10:03 (1 month ago)	2026-05-03T10:10:00.463073+02:00 machodeer kernel: [503715.824447] [UFW BLOCK] IN=ens3 OUT= MAC=REDA ... show more 2026-05-03T10:10:00.463073+02:00 machodeer kernel: [503715.824447] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=130.131.200.54 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=25630 DF PROTO=TCP SPT=14926 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-05-03T10:10:01.515049+02:00 machodeer kernel: [503716.877125] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=130.131.200.54 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=25631 DF PROTO=TCP SPT=14926 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-05-03T10:10:02.539069+02:00 machodeer kernel: [503717.901245] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=130.131.200.54 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=42 ID=25632 DF PROTO=TCP SPT=14926 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 show less	Port Scan
🇮🇱 spd.co.il	2026-04-28 08:03:53 (1 month ago)	Web application attack detected	Hacking Web App Attack

Showing 1 to 15 of 17 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 177.91.146.9

🇫🇮 147.185.133.101

🇨🇳 116.255.155.36

🇷🇴 92.118.39.236

🇱🇹 45.227.254.170

🇷🇺 37.228.92.87

🇧🇷 205.210.31.144

🇰🇷 106.243.155.71

🇧🇩 103.163.117.86

🇬🇧 95.214.185.136

🇺🇸 50.62.22.47

🇺🇸 44.215.219.236

🇸🇦 37.127.24.205

🇺🇸 198.135.49.119

🇳🇱 193.176.31.247

🇬🇧 193.32.209.230

🇳🇱 185.223.235.57

🇳🇱 185.223.235.43

🇱🇻 185.113.139.84

🇰🇿 178.90.94.29