JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

20.246.98.57

Neutral Activity

Abuse confidence score ?

0% Low Risk

55 reports

40 reporters · latest 2 years ago

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report Whois

No reports in the last 60 days

20.246.98.57 has been reported 55 times. The most recent report is from 2 years ago.

The full history is preserved below and remains searchable. A 0% score reflects the absence of recent activity, but this is not a guarantee that earlier reports were invalid. Abuse confidence score decays, naturally, over time, when the abusive activity stops.

IP Abuse Reports for 20.246.98.57

Export CSV

This IP address has been reported a total of 55 times from 40 distinct sources. 20.246.98.57 was first reported on March 28th 2024, and the most recent report was 2 years ago.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇳🇱 Linuxmalwarehuntingnl	2024-07-03 08:55:15 (2 years ago)	Unauthorized connection attempt	Brute-Force
Anonymous	2024-05-01 10:17:13 (2 years ago)	[30/Apr/2024:05:43:17 -0400] \"GET /_profiler/phpinfo/_profiler/phpinfo HTTP/1.1\" \"Mozilla/5.0 (Li ... show more [30/Apr/2024:05:43:17 -0400] \"GET /_profiler/phpinfo/_profiler/phpinfo HTTP/1.1\" \"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\" [30/Apr/2024:05:43:18 -0400] \"GET /_profiler/phpinfo/_profiler/phpinfo HTTP/1.1\" \"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\" show less	Hacking
🇱🇺 Tha_14	2024-04-29 23:34:27 (2 years ago)	Incoming TCP Connection from 20.246.98.57 to port: 80. Honeypot was triggered at 4/30/2024 12:33:09 ... show more Incoming TCP Connection from 20.246.98.57 to port: 80. Honeypot was triggered at 4/30/2024 12:33:09 AM. show less	Port Scan Hacking
🇳🇱 Cyber SOC	2024-04-09 13:49:07 (2 years ago)	Peaksys - 2024-04-09 14:48:49 UTC+01	Port Scan
🇩🇪 psauxit	2024-03-31 09:24:53 (2 years ago)	Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrp ... show more Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping show less	Hacking Web App Attack
🇩🇪 ut-addicted.com	2024-03-31 02:40:04 (2 years ago)	\[Sun Mar 31 04:40:01.926279 2024\] \[:error\] \[pid 6861:tid 139648160462592\] \[client 20.246.98.5 ... show more \[Sun Mar 31 04:40:01.926279 2024\] \[:error\] \[pid 6861:tid 139648160462592\] \[client 20.246.98.57:58920\] \[client 20.246.98.57\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 8\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/.env"\] \[unique_id "ZgjNAfatWjZYxTePyjE-MAAAAMo"\] show less	Brute-Force Web App Attack
🇦🇷 adrian Guirao	2024-03-31 00:33:53 (2 years ago)	Scanning for open ports and vulnerable services.	Port Scan
🇩🇪 mclo	2024-03-30 23:24:55 (2 years ago)	20.246.98.57 - - [31/Mar/2024:00:24:55 +0100] "GET /.env HTTP/1.1" 404 133 "-" "Mozilla/5.0 (Linux; ... show more 20.246.98.57 - - [31/Mar/2024:00:24:55 +0100] "GET /.env HTTP/1.1" 404 133 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ... show less	Web App Attack
🇩🇪 Mr-Money	2024-03-30 15:18:38 (2 years ago)	20.246.98.57 - - [30/Mar/2024:16:18:37 +0100] "GET /.env HTTP/1.1" 404 492 "-" "Mozilla/5.0 (Linux; ... show more 20.246.98.57 - - [30/Mar/2024:16:18:37 +0100] "GET /.env HTTP/1.1" 404 492 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
Anonymous	2024-03-30 13:40:38 (2 years ago)	Fail2Ban triggered	Web App Attack
🇩🇪 Mr-Money	2024-03-30 12:13:24 (2 years ago)	20.246.98.57 - - [30/Mar/2024:13:13:24 +0100] "GET /.env HTTP/1.1" 404 461 "-" "Mozilla/5.0 (Linux; ... show more 20.246.98.57 - - [30/Mar/2024:13:13:24 +0100] "GET /.env HTTP/1.1" 404 461 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" ... show less	Hacking SQL Injection Bad Web Bot Exploited Host Web App Attack
Anonymous	2024-03-30 11:46:32 (2 years ago)	[29/Mar/2024:20:04:29 -0400] \"GET /_profiler/phpinfo HTTP/1.1\" \"Mozilla/5.0 (Linux; U; Android 4. ... show more [29/Mar/2024:20:04:29 -0400] \"GET /_profiler/phpinfo HTTP/1.1\" \"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\" [29/Mar/2024:20:04:29 -0400] \"GET /_profiler/phpinfo HTTP/1.1\" \"Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30\" show less	Hacking
🇫🇷 Security_Whaller	2024-03-30 11:39:47 (2 years ago)	Malicious activity detected on Honeypot.	Hacking Brute-Force Web App Attack
🇬🇧 mangomad	2024-03-30 11:13:43 (2 years ago)	Repeated Apache mod_security rule triggers	Brute-Force Web App Attack
🇱🇹 NotACaptcha	2024-03-30 10:22:05 (2 years ago)	webserver:80 [30/Mar/2024] "POST / HTTP/1.1" 200 452 "-" "python-requests/2.31.0" webserver:80 [30/ ... show more webserver:80 [30/Mar/2024] "POST / HTTP/1.1" 200 452 "-" "python-requests/2.31.0" webserver:80 [30/Mar/2024] "POST / HTTP/1.1" 200 452 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" webserver:80 [30/Mar/2024] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30" show less	Web App Attack

Showing 1 to 15 of 55 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 162.216.149.59

🇺🇸 152.32.207.179

🇫🇷 62.210.185.4

🇨🇳 27.0.135.6

🇩🇪 213.209.159.133

🇲🇽 187.154.98.53

🇰🇿 92.47.46.174

🇩🇪 213.209.159.208

🇨🇱 200.126.105.149

🇸🇳 179.64.79.203

🇺🇸 173.254.207.25

🇨🇳 124.205.141.215

🇭🇰 103.72.147.239

🇷🇺 95.46.40.230

🇮🇳 52.172.177.191

🇦🇷 45.227.36.86

🇿🇲 41.63.63.211

🇰🇷 118.130.125.158

🇺🇸 103.195.146.2

🇧🇩 103.12.205.20