AbuseIPDB » 135.237.120.58

135.237.120.58 was found in our database!

This IP was reported 19 times. Confidence of Abuse is 44%: ?

44%

ISP	Microsoft Limited
Usage Type	Data Center/Web Hosting/Transit
Domain Name	microsoft.com
Country	United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 135.237.120.58

Whois 135.237.120.58

IP Abuse Reports for 135.237.120.58:

This IP address has been reported a total of 19 times from 19 distinct sources. 135.237.120.58 was first reported on August 3rd 2024, and the most recent report was 1 month ago.

Old Reports: The most recent abuse report for this IP address is from 1 month ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
EGP Abuse Dept	2024-08-08 04:33:12 (1 month ago)	Unauthorized connection to proxy port 8080	Port Scan Hacking
london2038.com	2024-08-07 17:33:14 (1 month ago)	Connection atttempts against closed TCP ports Aug 7 19:33:14 [BLOCK] SRC=135.237.120.58 LEN=5 ... show moreConnection atttempts against closed TCP ports Aug 7 19:33:14 [BLOCK] SRC=135.237.120.58 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=39098 DF PROTO=TCP SPT=58307 DPT=81 WINDOW=64240 RES=0x00 SYN Aug 7 19:33:14 [BLOCK] SRC=135.237.120.58 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=39099 DF PROTO=TCP SPT=58308 DPT=8012 WINDOW=64240 RES=0x00 SYN Aug 7 19:33:14 [BLOCK] SRC=135.237.120.58 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=39100 DF PROTO=TCP SPT=58309 DPT=8001 WINDOW=64240 RES=0x00 SYN show less	Port Scan
openstrike.co.uk	2024-08-07 05:12:57 (1 month ago)	455 attacks on env grabbing URLs, PHP URLs: GET /web/.env HTTP/1.1 GET /.env.php HTTP/1. ... show more455 attacks on env grabbing URLs, PHP URLs: GET /web/.env HTTP/1.1 GET /.env.php HTTP/1.1 show less	Hacking Web App Attack
Savvii	2024-08-06 14:29:08 (1 month ago)	20 attempts against mh-misbehave-ban on redirect	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2024-08-06 08:45:40 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 135.237.120.58 (-): 1 in the last 300 secs; Por ... show more(mod_security) mod_security (id:210492) triggered by 135.237.120.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 06 04:45:34.978575 2024] [security2:error] [pid 10656:tid 10656] [client 135.237.120.58:58189] [client 135.237.120.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.electric-cosmos.com"] [uri "/.env"] [unique_id "ZrHiro3e4NbKR2HNvz3_OgAAAAc"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2024-08-06 04:43:49 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted] 135.237.120.58 (US/United States/-)	SQL Injection
RF68	2024-08-06 04:33:00 (1 month ago)	xx requests to *.env	Hacking Brute-Force Exploited Host Web App Attack
juutis	2024-08-06 04:04:43 (1 month ago)	Multiple WAF abuses - IP blocked	Hacking Brute-Force Web App Attack
cmbplf	2024-08-06 02:25:45 (1 month ago)	278 requests to *.env	Brute-Force Bad Web Bot
Tobias Gion	2024-08-06 01:13:13 (1 month ago)		Bad Web Bot Web App Attack
Swiptly	2024-08-05 22:00:30 (1 month ago)	Multiple critical ModSecurity events ...	Web Spam Bad Web Bot
Mr-Money	2024-08-05 21:47:18 (1 month ago)	135.237.120.58 - - [05/Aug/2024:23:47:17 +0200] "GET /.env HTTP/1.1" 404 502 "-" "Mozilla/5.0 (X11; ... show more135.237.120.58 - - [05/Aug/2024:23:47:17 +0200] "GET /.env HTTP/1.1" 404 502 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 135.237.120.58 - - [05/Aug/2024:23:47:17 +0200] "GET /conf/.env HTTP/1.1" 404 502 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" 135.237.120.58 - - [05/Aug/2024:23:47:17 +0200] "GET /wp-content/.env HTTP/1.1" 404 502 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
Anonymous	2024-08-05 16:00:38 (1 month ago)	[Mon Aug 05 17:59:00.178270 2024] [proxy_fcgi:error] [pid 34381:tid 34381] [client 135.237.120.58:56 ... show more[Mon Aug 05 17:59:00.178270 2024] [proxy_fcgi:error] [pid 34381:tid 34381] [client 135.237.120.58:56731] AH01071: Got error 'Primary script unknown' [Mon Aug 05 18:00:36.280428 2024] [proxy_fcgi:error] [pid 34310:tid 34310] [client 135.237.120.58:54281] AH01071: Got error 'Primary script unknown' ... show less	Brute-Force Web App Attack
barbarella	2024-08-05 13:33:30 (1 month ago)	Multiple (7) times attack on https port 443: unauthorized access to cgi-bin scripts (GET /cgi-bin/.e ... show moreMultiple (7) times attack on https port 443: unauthorized access to cgi-bin scripts (GET /cgi-bin/.env) 13:33:36 Configuration snooping with .env file (GET /site/.env) 13:34:07 unauthorized access to cgi-bin scripts (GET /cgi-bin/.env) 13:36:22 unauthorized access to cgi-bin scripts (GET /cgi-bin/.env) 13:36:28 Configuration snooping with .env file (GET /site/.env) 13:38:23 unauthorized access to cgi-bin scripts (GET /cgi-bin/.env) 13:38:29 Configuration snooping with .env file (GET /site/.env) show less	Hacking Web App Attack
Anonymous	2024-08-05 13:32:56 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted] 135.237.120.58 (US/United States/-)	SQL Injection