JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.127.149.125

20.127.149.125 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Washington, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.127.149.125

Whois 20.127.149.125

IP Abuse Reports for 20.127.149.125:

This IP address has been reported a total of 24 times from 23 distinct sources. 20.127.149.125 was first reported on July 30th 2026, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 masterguru	2026-07-30 11:57:47 (1 hour ago)	Host header is a numeric IP address. Pattern match "^ (920350-145)	Hacking Bad Web Bot
🇩🇪 london2038.com	2026-07-30 11:54:30 (1 hour ago)	Probing for exploits 20.127.149.125 - - [30/Jul/2026:13:54:25 +0200] "GET /.env.bsc HTTP/2.0" 422 0 ... show more Probing for exploits 20.127.149.125 - - [30/Jul/2026:13:54:25 +0200] "GET /.env.bsc HTTP/2.0" 422 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 20.127.149.125 - - [30/Jul/2026:13:54:25 +0200] "GET /.env.btc HTTP/2.0" 422 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-30 11:53:58 (1 hour ago)	(mod_security) mod_security (id:210492) triggered by 20.127.149.125 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 20.127.149.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 30 07:53:51.570890 2026] [security2:error] [pid 24491:tid 24491] [client 20.127.149.125:49972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.151.19"] [uri "/.env.development"] [unique_id "ams7T_0JlkeS2qkLrWy_jgAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 InVertebrado	2026-07-30 11:20:41 (2 hours ago)	20.127.149.125 - - [30/Jul/2026:13:20:30 +0200] "GET /.bitcoin/wallet.dat HTTP/1.1" 500 5760 "-" "Mo ... show more 20.127.149.125 - - [30/Jul/2026:13:20:30 +0200] "GET /.bitcoin/wallet.dat HTTP/1.1" 500 5760 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 20.127.149.125 - - [30/Jul/2026:13:20:38 +0200] "GET /.bitcoin/backup/wallet.dat HTTP/1.1" 500 5760 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 20.127.149.125 - - [30/Jul/2026:13:20:41 +0200] "GET /wallet.dat HTTP/1.1" 500 5762 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ... show less	Web App Attack
🇩🇪 Petros Stefanakis	2026-07-30 10:55:10 (2 hours ago)	(mod_security) mod_security triggered on hostname [redacted] 20.127.149.125 (US/United States/-)	SQL Injection
🇩🇪 LRob	2026-07-30 10:36:05 (3 hours ago)	CrowdSec: crowdsecurity/http-probing \| req: /bip39_mnemonic.txt \| 11 distinct paths \| UA: Mozilla/5. ... show more CrowdSec: crowdsecurity/http-probing \| req: /bip39_mnemonic.txt \| 11 distinct paths \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 show less	Port Scan Web App Attack
🇪🇸 Francisco Vallejo	2026-07-30 10:18:56 (3 hours ago)	[Thu Jul 30 12:18:56.520759 2026] [core:info] [pid 2910849:tid 140690705082048] [client 20.127.149.1 ... show more [Thu Jul 30 12:18:56.520759 2026] [core:info] [pid 2910849:tid 140690705082048] [client 20.127.149.125:55266] AH00128: File does not exist: /var/www/franvallejo/.env.web3 [Thu Jul 30 12:18:56.521568 2026] [core:info] [pid 2910912:tid 140691938207424] [client 20.127.149.125:55374] AH00128: File does not exist: /var/www/franvallejo/.env.bak [Thu Jul 30 12:18:56.521577 2026] [core:info] [pid 2910849:tid 140690830907072] [client 20.127.149.125:55354] AH00128: File does not exist: /var/www/franvallejo/.env.staging [Thu Jul 30 12:18:56.528247 2026] [core:info] [pid 2910912:tid 140691845932736] [client 20.127.149.125:55312] AH00128: File does not exist: /var/www/franvallejo/.env.prod [Thu Jul 30 12:18:56.551888 2026] [core:info] [pid 2910849:tid 140690797336256] [client 20.127.149.125:55314] AH00128: File does not exist: /var/www/franvallejo/.env.local ... show less	Brute-Force SSH
🇪🇸 alferez	2026-07-30 10:15:17 (3 hours ago)	Searching .(env\|sql\|zip\|tar\|rar) files	Hacking Exploited Host Web App Attack
🇺🇸 Starburst SysOp Team	2026-07-30 09:55:32 (3 hours ago)	. Matched phrase "/.env" at REQUEST_URI. (210492-srv1)	Web App Attack
🇮🇹 Inartis	2026-07-30 09:52:40 (3 hours ago)	20.127.149.125 - - [30/Jul/2026:11:52:38 +0200] "GET /.env.eth HTTP/1.1" 404 5616 "-" "Mozilla/5.0 ( ... show more 20.127.149.125 - - [30/Jul/2026:11:52:38 +0200] "GET /.env.eth HTTP/1.1" 404 5616 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 20.127.149.125 - - [30/Jul/2026:11:52:38 +0200] "GET /.env.bsc HTTP/1.1" 404 458 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" 20.127.149.125 - - [30/Jul/2026:11:52:39 +0200] "GET /.env.btc HTTP/1.1" 404 458 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-07-30 08:59:46 (4 hours ago)	Multiple WAF Violations	Web App Attack
Anonymous	2026-07-30 08:57:00 (4 hours ago)	Fail2Ban: ModSecurity detected a web application attack.	Bad Web Bot Web App Attack
Anonymous	2026-07-30 08:48:58 (5 hours ago)	20.127.149.125 - - [30/Jul/2026:10:48:52 +0200] "GET /seed-backup.tar.gz HTTP/2.0" 403 106 "-" "Mozi ... show more 20.127.149.125 - - [30/Jul/2026:10:48:52 +0200] "GET /seed-backup.tar.gz HTTP/2.0" 403 106 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ... show less	Web App Attack
🇵🇱 TaKeN	2026-07-30 08:48:48 (5 hours ago)	Automated Wazuh local observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application pr ... show more Automated Wazuh local observation. Wazuh rule 31151 lvl=10 detected repeated HTTP web application probing from this source IP. Observed 1 matching blocked event(s) between 2026-07-30T10:48:48+02:00 and 2026-07-30T10:48:48+02:00. Sample requested paths: /trustwallet/backup/seed.txt. show less	Web App Attack Hacking
🇩🇪 LRob	2026-07-30 08:41:31 (5 hours ago)	CrowdSec: crowdsecurity/http-probing \| req: /ledger/backup/seed.txt \| 11 distinct paths \| UA: Mozill ... show more CrowdSec: crowdsecurity/http-probing \| req: /ledger/backup/seed.txt \| 11 distinct paths \| UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 show less	Port Scan Web App Attack

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇮🇹 172.213.21.18

🇫🇮 147.185.133.40

🇹🇭 122.154.235.21

🇨🇳 115.49.102.34

🇮🇳 106.219.195.251

🇨🇦 96.52.169.128

🇺🇦 91.215.71.134

🇸🇬 43.134.87.254

🇨🇭 20.203.148.31

🇺🇿 195.158.26.59

🇳🇱 188.166.92.230

🇺🇸 165.154.218.158

🇨🇳 139.212.71.76

🇨🇳 116.179.37.209

🇨🇳 116.179.37.106

🇯🇵 40.81.194.185

🇮🇳 223.181.120.34

🇮🇳 203.109.66.14

🇩🇪 165.245.221.68

🇨🇳 116.179.37.61