AbuseIPDB » 20.198.243.91

20.198.243.91 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 47%: ?

47%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	Singapore
City	Singapore

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 20.198.243.91

Whois 20.198.243.91

IP Abuse Reports for 20.198.243.91:

This IP address has been reported a total of 28 times from 15 distinct sources. 20.198.243.91 was first reported on June 13th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
hbrks	2025-06-17 13:00:13 (3 weeks ago)	GET '/.env'	Web Spam Hacking Bad Web Bot
MSZ	2025-06-17 13:00:04 (3 weeks ago)	Blocked by Fail2Ban (plesk-modsecurity)	Hacking Brute-Force Web App Attack
MatStef132	2025-06-17 04:09:44 (3 weeks ago)	Triggered Cloudflare WAF (firewallCustom) from SG. Action taken: CHALLENGE Protocol: HTT ... show moreTriggered Cloudflare WAF (firewallCustom) from SG. Action taken: CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /sendgrid/.env UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 show less	Bad Web Bot
el-brujo	2025-06-17 02:24:05 (3 weeks ago)	17/Jun/2025:04:24:05.405800 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more17/Jun/2025:04:24:05.405800 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 20.198.243.91] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.hostench.eu"] [uri "/.env"] [unique_id "aFDRxZhijYNFOOcPYb0wLgACHiM"] ... show less	Hacking Web App Attack
TPI-Abuse	2025-06-16 11:21:28 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 07:21:25.588825 2025] [security2:error] [pid 3752834:tid 3752834] [client 20.198.243.91:49686] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "greed.ee"] [uri "/.env"] [unique_id "aE_-NQADWaUfeKALQoc7BwAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
iNetWorker	2025-06-16 06:04:53 (3 weeks ago)	trolling for resource vulnerabilities	Web App Attack
LRNP	2025-06-16 05:41:53 (3 weeks ago)	mirror2.urbanterror.info:443 20.198.243.91 - - [16/Jun/2025:05:41:53 +0000] "GET /.env HTTP/1.1" 404 ... show moremirror2.urbanterror.info:443 20.198.243.91 - - [16/Jun/2025:05:41:53 +0000] "GET /.env HTTP/1.1" 404 181 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 04:36:48 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 16 00:36:42.150509 2025] [security2:error] [pid 3134966:tid 3134978] [client 20.198.243.91:35590] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.seriousgames-system.info"] [uri "/.env"] [unique_id "aE-fWjr61sgxx3vEkDZ5ugAAAQk"] show less	Brute-Force Bad Web Bot Web App Attack
enpepet	2025-06-16 03:54:36 (3 weeks ago)	GENERAL: parametres: [url:env=] UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like G ... show moreGENERAL: parametres: [url:env=] UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 URL:/.env show less	Port Scan Hacking Brute-Force Bad Web Bot
TPI-Abuse	2025-06-16 03:29:49 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 23:29:43.986391 2025] [security2:error] [pid 1619630:tid 1619630] [client 20.198.243.91:35396] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oss-in-atm.info"] [uri "/.env"] [unique_id "aE-Pp9t0fjbcWpnchLu28wAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 02:45:48 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 22:45:41.139697 2025] [security2:error] [pid 3110450:tid 3110450] [client 20.198.243.91:38782] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "microscopy.info"] [uri "/.env"] [unique_id "aE-FVdTspIZ9WRIqWCsGvwAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 02:22:51 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 22:22:46.560470 2025] [security2:error] [pid 1861711:tid 1861711] [client 20.198.243.91:33222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.londongroup.info"] [uri "/.env"] [unique_id "aE9_9n0n61znsJvWDhRC3AAAAAw"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 01:43:22 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 21:43:17.850774 2025] [security2:error] [pid 4175101:tid 4175101] [client 20.198.243.91:56910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "johnwarnock.info"] [uri "/.env"] [unique_id "aE92tRB3crl2Cavtf-CotQAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 01:27:16 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 21:27:08.853023 2025] [security2:error] [pid 37608:tid 37608] [client 20.198.243.91:34478] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.infodrop.info"] [uri "/.env"] [unique_id "aE9y7L9v56djmXAZKiAl3wAAACc"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-06-16 00:11:17 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.198.243.91 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 15 20:11:13.831537 2025] [security2:error] [pid 1907916:tid 1907916] [client 20.198.243.91:36366] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "encoreporchfest.info"] [uri "/.env"] [unique_id "aE9hIeEV2NnFpFoXn9Z84gAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack

Showing 1 to 15 of 28 reports

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩

Recently Reported IPs:

162.216.150.68

80.87.222.51

14.103.170.170

49.43.115.51

123.58.209.115

185.221.216.155

92.171.15.223

193.106.245.20

194.0.234.107

2607:f8b0:4001:c14::124

115.28.77.246

213.158.92.120

103.84.5.36

92.118.39.87

196.0.120.211

45.8.133.29

203.205.37.233

162.216.149.111

41.198.151.95

190.89.136.244