JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.122.97.131

Neutral Activity

Abuse Confidence Score

0% Low Risk

38 reports

24 reporters · latest 11 months ago

ISP: Microsoft Corporation
Usage Type: Data Center/Web Hosting/Transit
ASN: AS8075
Domain Name: microsoft.com
Country: 🇺🇸 United States of America
City: Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.122.97.131 has been reported 38 times. The most recent report is from 11 months ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

Abuse Reports

Export reports CSV

Total reports

38 from 24 distinct reporters

First reported

November 25th 2025

Most recent report

11 months ago

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2025-12-15 08:05:09 UTC · (11 months ago)	Blocked: Reason='Auto-block via DW'; Requests=0	Hacking
🇬🇧 Swiptly	2025-11-27 03:27:23 UTC · (11 months ago)	Excessive 403/404/405 PHP/CMS errors from scanning or broken bots ...	Web App Attack
🇧🇾 lns.bz	2025-11-27 02:28:56 UTC · (11 months ago)	Too many 404 requests [BY]	Web App Attack
🇺🇸 mnsf	2025-11-27 01:05:33 UTC · (11 months ago)	Too many Status 40X (19)	Brute-Force Web App Attack
🇳🇱 Site.eu	2025-11-26 22:15:26 UTC · (11 months ago)	Excessive multi-domain requests	Brute-Force
🇺🇸 rsa	2025-11-26 21:28:00 UTC · (11 months ago)	GET /new.php HTTP/1.1	Hacking Brute-Force Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 19:37:00 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:36:53.584250 2025] [security2:error] [pid 8197:tid 8197] [client 20.122.97.131:3632] ModS ... show more (mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:36:53.584250 2025] [security2:error] [pid 8197:tid 8197] [client 20.122.97.131:3632] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.abbeygardensllandudno.com"] [uri "/user/.env"] [unique_id "aSdW1SeufmliMuP-KVy6KAAAAAs"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-26 17:46:12 UTC · (11 months ago)	Bot / seems abusive / Apache connections: 22	DDoS Attack Web Spam Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 16:57:40 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:57:32.688337 2025] [security2:error] [pid 19205:tid 19205] [client 20.122.97.131:10881] M ... show more (mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:57:32.688337 2025] [security2:error] [pid 19205:tid 19205] [client 20.122.97.131:10881] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drhoss.com"] [uri "/user/.env"] [unique_id "aScxfDWFdFRqY2gHuTjkDQAAAAM"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
🇬🇧 SecondEdge	2025-11-26 16:57:30 UTC · (11 months ago)	A web attack was detected from 20.122.97.131 (United States / Virginia / Boydton) against second-edge.com (Admin,CGI-BIN,Git Variable Scan,PHPMyAdmin,PHPSQLAdmin,PHPUnit,WebShell,Wordpress,Wordpress Admin,XMLRPC) over 2m14s.	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 16:28:56 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:28:49.377871 2025] [security2:error] [pid 21803:tid 21803] [client 20.122.97.131:9956] Mo ... show more (mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:28:49.377871 2025] [security2:error] [pid 21803:tid 21803] [client 20.122.97.131:9956] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.cdhcreations.com"] [uri "/user/.env"] [unique_id "aScqwfvTdkO7T7tb_QnY6QAAAAI"], referer: https://www.google.com/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 stinpriza	2025-11-26 14:59:55 UTC · (11 months ago)	Web App Attack	Web App Attack
🇺🇸 TPI-Abuse	2025-11-26 14:53:31 UTC · (11 months ago)	(mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 09:53:24.583586 2025] [security2:error] [pid 9852:tid 9852] [client 20.122.97.131:7521] ModS ... show more (mod_security) mod_security (id:210492) triggered by 20.122.97.131 (-): 1 in the last 300 secs; Ports: ; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 09:53:24.583586 2025] [security2:error] [pid 9852:tid 9852] [client 20.122.97.131:7521] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pilgrimpastor.my1611.com"] [uri "/user/.env"] [unique_id "aScUZA6RzdJ5ukEDTiDbrQAAAAU"], referer: https://www.google.co.uk/ show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2025-11-26 14:42:11 UTC · (11 months ago)	20.122.97.131 - - [26/Nov/2025:15:39:28 +0100] "GET /cgi-bin/bypass.php HTTP/1.1" 404 27 "https://www.google.com/" "Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 20.122.97.13 ... show more 20.122.97.131 - - [26/Nov/2025:15:39:28 +0100] "GET /cgi-bin/bypass.php HTTP/1.1" 404 27 "https://www.google.com/" "Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 20.122.97.131 - - [26/Nov/2025:15:40:10 +0100] "GET /cgi-bin/xmrlpc.php HTTP/1.1" 404 27 "https://www.google.com/" "Mozilla/5.0 (Linux; Android 11; 21081111RG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" ... show less	Web App Attack
🇨🇭 zynex	2025-11-26 13:55:45 UTC · (11 months ago)	URL Probing: /cgi-bin/bypass.php	Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown

Recently Reported IPs:

🇵🇱 176.53.159.196

🇺🇸 162.216.149.250

🇺🇸 136.66.211.195

🇵🇰 101.53.225.5

🇺🇸 80.190.73.149

🇩🇪 69.5.169.110

🇺🇸 67.205.162.44

🇸🇬 43.134.62.67

🇨🇦 34.19.216.73

🇳🇱 34.1.234.134

🇲🇽 201.138.198.78

🇺🇸 142.93.81.117

🇨🇳 123.14.124.20

🇨🇳 113.206.181.207

🇵🇰 103.24.71.30

🇺🇸 85.239.151.42

🇨🇳 49.64.169.153

🇺🇸 34.182.188.9

🇧🇪 34.76.83.139

🇧🇪 34.22.155.148