JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 143.20.97.120

143.20.97.120 was found in our database!

This IP was reported 48 times. Confidence of Abuse is 100%: ?

100%

ISP	Internet Utilities Europe and Asia Limited
Usage Type	Data Center/Web Hosting/Transit
ASN	AS214481
Domain Name	netutils.io
Country	🇵🇱 Poland
City	Warsaw, Mazovia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 143.20.97.120

Whois 143.20.97.120

IP Abuse Reports for 143.20.97.120:

This IP address has been reported a total of 48 times from 39 distinct sources. 143.20.97.120 was first reported on June 4th 2026, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇬🇧 openstrike.co.uk	2026-06-08 05:13:09 (1 week ago)	51 attacks on config grabbing URLs (type 2), env grabbing URLs, VC URLs, password grabbing URLs: GET ... show more 51 attacks on config grabbing URLs (type 2), env grabbing URLs, VC URLs, password grabbing URLs: GET /env.json HTTP/1.1 GET /.env.docker HTTP/1.1 GET /.git/config HTTP/1.1 GET /.aws/credentials HTTP/1.1 show less	Hacking
🇳🇱 homeshowdomain.nl	2026-06-07 21:59:12 (1 week ago)	Auto-ban: >3000 req/min op 2026-06-07	Web App Attack SSH Hacking
🇳🇱 Savvii	2026-06-07 15:07:37 (1 week ago)	20 attempts against mh-misbehave-ban on ozone	Brute-Force Bad Web Bot Web App Attack
🇭🇺 kranem	2026-06-07 09:00:28 (1 week ago)	Triggered Cloudflare WAF from PL. Action taken: BLOCK ASN: 214481 (Wojciech Czapkowicz) Protocol: HT ... show more Triggered Cloudflare WAF from PL. Action taken: BLOCK ASN: 214481 (Wojciech Czapkowicz) Protocol: HTTP/2 (GET method) Endpoint: /.next/required-server-files.json Timestamp: 2026-06-07T07:39:23Z User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 show less	Bad Web Bot
🇬🇧 consul.to	2026-06-07 08:27:28 (1 week ago)	Web attack/malicious scanning detected	Web App Attack
🇩🇪 igerman	2026-06-07 07:28:39 (1 week ago)	caddy probes: api: GET /api/config(404), GET /api/settings(404), GET /api/v1/settings(404) \| cloud-c ... show more caddy probes: api: GET /api/config(404), GET /api/settings(404), GET /api/v1/settings(404) \| cloud-creds: GET /.aws/credentials(DROP) \| env-probe: GET /.env(DROP), GET /.env.backup(DROP), GET /.env.bak(DROP), GET /.env.development(DROP), GET /.env.example(DROP), GET /.env.local(DROP), GET /.env.production(DROP), GET /.env.staging(DROP) \| git-repo: GET /.git/config(DROP) \| web: GET /__/firebase/init.json(DROP), GET /application.properties(DROP), GET /application.yml(DROP), GET /config.js(404), GET /config.json(DROP), GET /config/application.properties(DROP), GET /config/secrets.yml(DROP), GET /secrets.json(DROP), GET /secrets.yml(DROP), GET /settings.json(DROP), GET /storage/logs/laravel.log(DROP), GET /v1/graphql(DROP) show less	Web App Attack
🇺🇸 agenciahypelab.com.br	2026-06-07 06:57:27 (1 week ago)	WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER	Brute-Force SSH
🇺🇸 alecj.com	2026-06-07 06:57:20 (1 week ago)	This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files	Web App Attack Hacking
🇬🇧 Celtic	2026-06-07 05:55:34 (1 week ago)	Blocked by Fail2Ban with Jail (plesk-modsecurity)	Brute-Force SSH
Anonymous	2026-06-07 05:43:02 (1 week ago)	Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1, GET /.env.development HTTP/1.1, GET /.en ... show more Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1, GET /.env.development HTTP/1.1, GET /.env.production HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.staging HTTP/1.1, GET /api/.env HTTP/1.1, GET /.aws/credentials HTTP/1.1, GET /.env.backup HTTP/1.1, GET /app/.env HTTP/1.1 show less	Hacking Web App Attack
Anonymous	2026-06-07 05:23:29 (1 week ago)	(caddyscan) Scanner path probe from 143.20.97.120 (PL/Poland/-): 5 in the last 3600 secs; Ports: ; ... show more (caddyscan) Scanner path probe from 143.20.97.120 (PL/Poland/-): 5 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 143.20.97.120 - - [07/Jun/2026:05:23:23 +0000] "GET /.aws/credentials HTTP/1.1" [REDACTED] 200 2627 143.20.97.120 - - [07/Jun/2026:05:23:23 +0000] "GET /.git/config HTTP/1.1" [REDACTED] 200 2627 143.20.97.120 - - [07/Jun/2026:05:23:27 +0000] "GET /.env HTTP/1.1" [REDACTED] 200 2627 143.20.97.120 - - [07/Jun/2026:05:23:27 +0000] "GET /.env.production HTTP/1.1" [REDACTED] 200 2627 143.20.97.120 - - [07/Jun/2026:05:23:27 +0000] "GET /.env.local HTTP/1.1" show less	Port Scan
🇺🇸 Blue Pumpkin	2026-06-07 05:20:38 (1 week ago)	143.20.97.120 - - [07/Jun/2026:05:20:37 +0000] "GET /health HTTP/1.1" 404 4879 "http://dark.hey-ai.c ... show more 143.20.97.120 - - [07/Jun/2026:05:20:37 +0000] "GET /health HTTP/1.1" 404 4879 "http://dark.hey-ai.com/health" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" ... show less	Brute-Force
🇩🇪 gadix	2026-06-07 04:33:44 (1 week ago)	[07/Jun/2026:06:33:31.119937 +0200] aiT0mzzTIEZojuY1RCcrTgAAAFY 143.20.97.120 47136 127.0.0.1 7080 [ ... show more [07/Jun/2026:06:33:31.119937 +0200] aiT0mzzTIEZojuY1RCcrTgAAAFY 143.20.97.120 47136 127.0.0.1 7080 [07/Jun/2026:06:33:33.639946 +0200] aiT0nf9oVWIhcSwhSoWc7wAAAJQ 143.20.97.120 44544 127.0.0.1 7080 [07/Jun/2026:06:33:38.906013 +0200] aiT0ojzTIEZojuY1RCcrUwAAAEA 143.20.97.120 44590 127.0.0.1 7080 ... show less	Web App Attack
🇳🇱 wlt-blocker	2026-06-07 02:31:41 (1 week ago)	Unauthorized access to webpage admin	Web App Attack
🇫🇷 ✨	2026-06-07 01:44:09 (1 week ago)	Domain : inhabito.uk Rule : config 2026-06-07 01:42:31 *hidden-privacy* GET /.aws/credentials - ... show more Domain : inhabito.uk Rule : config 2026-06-07 01:42:31 *hidden-privacy* GET /.aws/credentials - 443 - 143.20.97.120 HTTP/2 Mozilla/5.0 (compatible; cohere-ai/1.0; https://cohere.com) - inhabito.uk 404 0 2 1106 184 46 - - show less	Hacking SQL Injection

Showing 1 to 15 of 48 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇳🇱 204.76.203.36

🇩🇪 192.109.200.220

🇸🇬 172.217.44.216

🇩🇪 137.226.198.155

🇺🇦 176.103.2.110

🇮🇳 128.185.219.54

🇺🇸 107.0.200.227

🇮🇳 103.100.7.38

🇧🇬 91.191.209.98

🇺🇸 52.160.224.116

🇹🇷 45.195.231.75

🇺🇦 37.221.157.115

🇰🇷 203.142.160.143

🇩🇪 167.94.145.16

🇱🇹 141.98.11.83

🇮🇩 43.243.142.42

🇰🇷 183.99.228.131

🇺🇸 160.153.176.197

🇺🇸 150.107.38.21

🇳🇱 77.105.138.89