JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.245.217.113

Neutral Activity

Abuse confidence score ?

0% Low Risk

36 reports

17 reporters · latest 3 years ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	San Jose, California

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.245.217.113 has been reported 36 times. The most recent report is from 3 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 20.245.217.113

This IP address has been reported a total of 36 times from 17 distinct sources. 20.245.217.113 was first reported on May 1st 2023, and the most recent report was 3 years ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇷🇸 BackstromM	2023-05-05 13:59:59 (3 years ago)	Directory Traversal / New File Upload probing / Remote Code Execution probing / vulnerability probin ... show more Directory Traversal / New File Upload probing / Remote Code Execution probing / vulnerability probing / site scan show less	Hacking Brute-Force Bad Web Bot Web App Attack
Anonymous	2023-05-04 14:44:04 (3 years ago)	#WEBSHELL - HTTP (Request),	Hacking
🇬🇧 David Gebler	2023-05-04 13:25:20 (3 years ago)	20.245.217.113 - - [04/May/2023:13:25:20 +0000] "GET /wp-content/plugins/downloads-manager/img/unloc ... show more 20.245.217.113 - - [04/May/2023:13:25:20 +0000] "GET /wp-content/plugins/downloads-manager/img/unlock.gif HTTP/1.1" 404 5882 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0" show less	Brute-Force Web App Attack
🇬🇧 David Gebler	2023-05-04 09:20:54 (3 years ago)	20.245.217.113 - - [04/May/2023:09:20:54 +0000] "GET /wp-content/plugins/downloads-manager/img/unloc ... show more 20.245.217.113 - - [04/May/2023:09:20:54 +0000] "GET /wp-content/plugins/downloads-manager/img/unlock.gif HTTP/1.1" 404 5882 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0" show less	Brute-Force Web App Attack
🇨🇦 nyclee.net	2023-05-04 07:28:07 (3 years ago)	WebServer Vunerability Probe ...	Hacking Web App Attack
🇺🇸 gu-alvareza	2023-05-04 07:05:26 (3 years ago)	AndroxGh0st.Malware	Hacking Exploited Host
🇩🇪 Ba-Yu	2023-05-04 05:20:32 (3 years ago)	General hacking/exploits/scanning	Web Spam Hacking Brute-Force Exploited Host Web App Attack
🇮🇩 hermawan	2023-05-04 02:04:45 (3 years ago)	[Thu May 04 09:04:42.255389 2023] [security2:error] [pid 63412:tid 140322747180608] [client 20.245.2 ... show more [Thu May 04 09:04:42.255389 2023] [security2:error] [pid 63412:tid 140322747180608] [client 20.245.217.113:49376] [client 20.245.217.113] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "137"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/.env"] [unique_id "ZFMSuthtgD3P9IhrkRE-hwAAAIc"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[63471] [BLF8mMQBdB8] [ZFMSuthtgD3P9IhrkRE-hwAAAIc] keep_alive=[0] [2023-05-04 09:04:42.255397] [R:ZFMSuthtgD3P9IhrkRE-hwAAAIc] UA:'Mozilla/5.0 (X11; L ... show less	Hacking Web App Attack
🇬🇧 David Gebler	2023-05-04 01:39:48 (3 years ago)	20.245.217.113 - - [04/May/2023:01:39:48 +0000] "GET /wp-content/plugins/downloads-manager/img/unloc ... show more 20.245.217.113 - - [04/May/2023:01:39:48 +0000] "GET /wp-content/plugins/downloads-manager/img/unlock.gif HTTP/1.1" 404 5882 "-" "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0" show less	Brute-Force Web App Attack
🇬🇧 CrystalMaker	2023-05-04 01:12:34 (3 years ago)	Wordpress attack - GET /wp-content/plugins/downloads-manager/img/unlock.gif; GET /wp-content/plugins ... show more Wordpress attack - GET /wp-content/plugins/downloads-manager/img/unlock.gif; GET /wp-content/plugins/apikey/apikey.php; GET /wp-content/plugins/apikey/cursed.php; GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php; GET /.env; GET /api/.env; GET /laravel/.env; GET /test/.env; GET /admin/.env; GET /vendor/.env; GET /sites/.env; GET /blog/.env; GET /system/.env; GET /public/.env; GET /shop/.env show less	Web App Attack
🇮🇩 hermawan	2023-05-03 12:14:40 (3 years ago)	[Wed May 03 19:14:38.749004 2023] [security2:error] [pid 258014:tid 140209391916608] [client 20.245. ... show more [Wed May 03 19:14:38.749004 2023] [security2:error] [pid 258014:tid 140209391916608] [client 20.245.217.113:57052] [client 20.245.217.113] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "137"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/.env"] [unique_id "ZFJQLoa0IURRWXamDdyFgQAAANc"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[258089] [gVD6//CX0SE] [ZFJQLoa0IURRWXamDdyFgQAAANc] keep_alive=[0] [2023-05-03 19:14:38.749007] [R:ZFJQLoa0IURRWXamDdyFgQAAANc] UA:'Mozilla/5.0 (X11; ... show less	Hacking Web App Attack
🇺🇦 URAN Publishing Service	2023-05-03 08:59:03 (3 years ago)	20.245.217.113 - - [03/May/2023:11:59:02 +0300] "GET /.env HTTP/1.1" 404 277 "-" "Mozilla/5.0 (X11; ... show more 20.245.217.113 - - [03/May/2023:11:59:02 +0300] "GET /.env HTTP/1.1" 404 277 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" ... show less	Web App Attack
🇷🇸 BackstromM	2023-05-03 07:57:56 (3 years ago)	wp-login / file install probing / vulnerability probing / site scan	Hacking Brute-Force Bad Web Bot Web App Attack
🇺🇸 gu-alvareza	2023-05-03 07:05:18 (3 years ago)	AndroxGh0st.Malware	Hacking Exploited Host
🇨🇦 Mediashaker	2023-05-03 06:19:34 (3 years ago)	(apache-scanners) Failed apache-scanners trigger with match [redacted] from 20.245.217.113 (US/Unite ... show more (apache-scanners) Failed apache-scanners trigger with match [redacted] from 20.245.217.113 (US/United States/-) show less	Port Scan

Showing 1 to 15 of 36 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇰🇷 220.118.173.234

🇺🇸 162.243.208.127

🇨🇳 117.72.69.18

🇳🇱 51.124.112.121

🇧🇷 45.205.1.163

🇺🇸 20.29.18.118

🇮🇳 203.122.45.246

🇺🇸 192.227.232.167

🇺🇸 168.235.210.157

🇺🇸 162.216.150.245

🇳🇱 134.209.93.117

🇨🇳 122.228.193.33

🇷🇺 87.250.224.203

🇨🇳 58.49.26.202

🇺🇸 40.124.171.250

🇧🇪 35.195.120.45

🇮🇹 34.154.126.77

🇺🇸 20.65.170.47

🇩🇪 213.209.159.43

🇧🇷 201.16.238.49