JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.118.246.5

Activity Trending Down

Abuse confidence score ?

55% Elevated

21 reports

18 reporters · latest 2 weeks ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

Reports Activity

Example preview

Report Categories (Last 60 Days)

Example preview

Top Reporter Countries (Last 60 Days)

Example preview

Account required for the enhanced features Log in Sign up

IP Abuse Reports for 20.118.246.5

Export CSV

This IP address has been reported a total of 21 times from 18 distinct sources. 20.118.246.5 was first reported on July 27th 2026, and the most recent report was 2 weeks ago. In the last 60 days, the top reporter locations were: United States of America with 5 reports; Germany with 4 reports; Australia with 1 report. The most common categories in these recent reports were: Web App Attack 11 times; Hacking 6 times; Brute-Force 5 times; Port Scan 4 times; Bad Web Bot 4 times; Other 1 time.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇪 boxed-it	2026-09-26 08:23:31 (2 weeks ago)	GET /config/database.php (Tarpitted for 3h37m29s, wasted 764.65kB)	Web App Attack
🇺🇸 TPI-Abuse	2026-09-26 05:20:28 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.118.246.5 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.118.246.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 01:20:23.063473 2026] [security2:error] [pid 6840:tid 6840] [client 20.118.246.5:35223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.14"] [uri "/.git/config"] [unique_id "ardWF27xIB79M5gSX4ALowAAAFQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 Tsumugi Kotobuki	2026-09-26 03:18:03 (2 weeks ago)	Port Scan on Honeypot \| Ports: 8443/HTTPS-alt \| Proto: TCP(1) \| Flags: all SYN \| TTL: 43 \| Len: 60B ... show more Port Scan on Honeypot \| Ports: 8443/HTTPS-alt \| Proto: TCP(1) \| Flags: all SYN \| TTL: 43 \| Len: 60B \| Win: 64240(1) \| F2B/ufw-honeypot@2026-09-26T03:18:03Z show less	Port Scan Hacking
🇷🇺 mysh38	2026-09-26 02:32:01 (2 weeks ago)	fail2ban: nginx-bots jail ban	Web App Attack
Anonymous	2026-09-26 02:24:00 (2 weeks ago)	Linux System Files Information Disclosure; WordPress Sensitive System Files Information Disclosure; ... show more Linux System Files Information Disclosure; WordPress Sensitive System Files Information Disclosure; Sensitive Configuration File Disclosure; Web Server Exposed Git Repository Information Disclosure. show less	Hacking
🇺🇸 factor1	2026-09-26 02:17:02 (2 weeks ago)	CrowdSec at athena Reports Abuse	Web App Attack
🇺🇸 MakoWish	2026-09-26 02:06:28 (2 weeks ago)	Fuzzing for misconfigured web servers.	Hacking Web App Attack
🇩🇪 Grossmann-Gruppe	2026-09-26 01:12:03 (2 weeks ago)	Plesk Fail2Ban: plesk-modsecurity	Hacking Brute-Force
🇷🇸 Scan	2026-09-26 00:39:11 (2 weeks ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇳🇱 thedreamer.nl	2026-09-26 00:25:19 (2 weeks ago)	20.118.246.5 - - [26/Sep/2026:02:23:13 +0200] "GET /.git/HEAD HTTP/1.1" 499 0 "-" "Mozilla/5.0 (comp ... show more 20.118.246.5 - - [26/Sep/2026:02:23:13 +0200] "GET /.git/HEAD HTTP/1.1" 499 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "US" "Des Moines" "41.60150" "-93.61270" 20.118.246.5 - - [26/Sep/2026:02:23:13 +0200] "GET /.git/config HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36" "US" "Des Moines" "41.60150" "-93.61270" 20.118.246.5 - - [26/Sep/2026:02:23:14 +0200] "GET /.git/logs/HEAD HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0" "US" "Des Moines" "41.60150" "-93.61270" 20.118.246.5 - - [26/Sep/2026:02:23:14 +0200] "GET /.git/refs/heads/master HTTP/1.1" 499 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15" "US" "Des Moines" "41.60150" "-93.61270" ... show less	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-09-26 00:17:07 (2 weeks ago)	denied traffic to a non-approved destination port. destination port 43.	Port Scan
🇺🇸 TPI-Abuse	2026-09-26 00:15:45 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.118.246.5 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.118.246.5 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 20:15:42.760258 2026] [security2:error] [pid 12507:tid 12507] [client 20.118.246.5:35016] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.68"] [uri "/.git/HEAD"] [unique_id "arcOruAhvrfJTzRweG9l_wAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 findlab	2026-09-07 20:30:01 (1 month ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
🇬🇧 relianoid.com	2026-09-07 19:55:53 (1 month ago)	404 Errors Abuse detected by Relianoid OSS Load Balancer - relianoid.com	Web App Attack
🇦🇺 paulshipley.com.au	2026-09-07 19:25:32 (1 month ago)	levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:14 +1000] "GET /careers HTTP/1.1" 4 ... show more levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:14 +1000] "GET /careers HTTP/1.1" 404 129582 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:16 +1000] "GET /openings HTTP/1.1" 404 133881 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:16 +1000] "GET /job-openings HTTP/1.1" 404 133883 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:16 +1000] "GET /join-our-team HTTP/1.1" 404 133885 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:16 +1000] "GET /open-positions HTTP/1.1" 404 133886 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" levellapromotions.com.au:443 20.118.246.5 - - [08/Sep/2026:05:25:16 +1000] "GET /work-with-us HT ... show less	Web App Attack

Showing 1 to 15 of 21 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇫🇷 45.154.138.228

🇺🇸 195.140.176.22

🇺🇦 185.212.251.48

🇮🇹 172.213.17.173

🇺🇸 147.185.132.122

🇺🇸 143.42.1.53

🇲🇴 125.31.2.160

🇳🇱 109.160.32.153

🇻🇳 103.69.96.120

🇳🇱 94.154.43.246

🇫🇷 91.196.152.188

🇧🇬 78.128.113.98

🇬🇧 35.203.211.90

🇮🇳 20.244.17.248

🇺🇸 20.29.30.67

🇺🇸 201.79.38.142

🇨🇿 195.123.244.73

🇹🇼 118.160.116.84

🇨🇳 112.123.228.180

🇮🇩 103.126.10.226