JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.29.52.242

20.29.52.242 was found in our database!

This IP was reported 44 times. Confidence of Abuse is 55%: ?

55%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Des Moines, Iowa

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.29.52.242

Whois 20.29.52.242

IP Abuse Reports for 20.29.52.242:

This IP address has been reported a total of 44 times from 28 distinct sources. 20.29.52.242 was first reported on March 21st 2026, and the most recent report was 37 minutes ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇾 lns.bz	2026-07-25 04:43:31 (37 minutes ago)	Too many 404 requests [BY]	Web App Attack
Anonymous	2026-07-25 04:36:05 (45 minutes ago)	denied traffic to a non-approved destination port. destination port 2078.	Port Scan
🇺🇸 MPL	2026-07-25 03:47:54 (1 hour ago)	tcp port scan (10 or more attempts)	Port Scan
Anonymous	2026-07-25 03:46:03 (1 hour ago)	Bot / scanning and/or hacking attempts: GET /config/database.yml HTTP/1.1, GET /application.yml HTTP ... show more Bot / scanning and/or hacking attempts: GET /config/database.yml HTTP/1.1, GET /application.yml HTTP/1.1, GET /.git/refs/heads/main HTTP/1.1, GET /.aws/config HTTP/1.1, GET /info.php HTTP/1.1, GET /.git-credentials HTTP/1.1, GET /web.config HTTP/1.1, GET /.git/refs/heads/master HTTP/1.1, GET /.git/index HTTP/1.1, GET /.aws/credentials HTTP/1.1, GET /actuator/logfile HTTP/1.1, GET /.env.old HTTP/1.1, GET /.env_production HTTP/1.1, GET /.kube/config HTTP/1.1, GET /.htpasswd HTTP/1.1, GET /appsettings.json HTTP/1.1, GET /proc/self/environ HTTP/1.1, GET /backup/database.sql HTTP/1.1, GET /actuator/env HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.env.docker HTTP/1.1, GET /.env.bak HTTP/1.1, GET /wp-config.php HTTP/1.1, GET /application.properties HTTP/1.1, GET /terraform.tfstate.backup HTTP/1.1 show less	Hacking Web App Attack
🇩🇪 www.fransveldman.world	2026-07-16 11:56:02 (1 week ago)	Fetched browser challenge page 10 times in <2h without solving. Likely bad bot.	Bad Web Bot
🇯🇵 demonsword	2026-06-21 13:37:57 (1 month ago)	Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ... show more Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: www.eastmoney.com:443 show less	Open Proxy Port Scan
🇫🇷 COMAITE	2026-06-02 06:22:18 (1 month ago)	Suspicious URL access.	Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 06:21:43 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 20.29.52.242 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.29.52.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 02:21:40.371142 2026] [security2:error] [pid 1608:tid 1608] [client 20.29.52.242:44575] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.209"] [uri "/.git/HEAD"] [unique_id "ah52dIuB0wVyKNpHxkSk4gAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 SOC PR	2026-06-02 06:18:34 (1 month ago)	IPS: Sensitive Configuration File Disclosure.	Hacking
🇩🇪 AetherFox	2026-06-02 06:02:00 (1 month ago)	AetherFox VoidGuard detected: [Tue Jun 02 06:01:55.725662 2026] [authz_core:error] [pid 2824550:tid ... show more AetherFox VoidGuard detected: [Tue Jun 02 06:01:55.725662 2026] [authz_core:error] [pid 2824550:tid 2824559] [client 20.29.52.242:44494] AH01630: client denied by server configuration: proxy:http://[MASKED]/.git/HEAD [Tue Jun 02 06:01:55.725844 2026] [authz_core:error] [pid 2824550:tid 2824559] [client 20.29.52.242:44494] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Tue Jun 02 06:01:57.320164 2026] [authz_core:error] [pid 2824550:tid 2824561] [client 20.29.52.242:45001] AH01630: client denied by server configuration: proxy:http://[MASKED]/.env [Tue Jun 02 06:01:57.320383 2026] [authz_core:error] [pid 2824550:tid 2824561] [client 20.29.52.242:45001] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html [Tue Jun 02 06:01:59.299389 2026] [authz_core:error] [pid 2824550:tid 2824574] [client 20.29.52.242:45035] AH01630: client denied by server configuration: proxy:http://[MASKED]/.env.production ... show less	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-02 05:56:56 (1 month ago)	(mod_security) mod_security (id:949110) triggered by 20.29.52.242 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:949110) triggered by 20.29.52.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 01:56:49.645243 2026] [security2:error] [pid 8868:tid 8868] [client 20.29.52.242:45668] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "192.64.150.240"] [uri "/.git/HEAD"] [unique_id "ah5woXpvRwPBcZvJyoLAkQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇹🇼 kk_it_man	2026-06-02 05:50:14 (1 month ago)		Port Scan
🇺🇸 TPI-Abuse	2026-06-02 05:40:23 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 20.29.52.242 (-): 1 in the last 300 secs; Ports ... show more (mod_security) mod_security (id:210492) triggered by 20.29.52.242 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 01:40:15.822815 2026] [security2:error] [pid 6980:tid 6980] [client 20.29.52.242:44657] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.116"] [uri "/.git/HEAD"] [unique_id "ah5sv2Q-isBA-WmNY7jySgAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 ISPLtd	2026-06-02 05:31:58 (1 month ago)	Jun 2 02:31:57 20.29.52.242 TCP SPT=44647 DPT=8443 SYN Jun 2 02:31:57 20.29.52.242 TCP SPT=44629 D ... show more Jun 2 02:31:57 20.29.52.242 TCP SPT=44647 DPT=8443 SYN Jun 2 02:31:57 20.29.52.242 TCP SPT=44629 DPT=2083 SYN Jun 2 02:31:57 20.29.52.242 TCP SPT=44959 DPT=2086 ... show less	Port Scan
🇳🇱 donarev419	2026-06-02 04:58:21 (1 month ago)	Port scan detected on port 8443 (connection without data transfer)	Port Scan

Showing 1 to 15 of 44 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇦 142.44.225.200

🇳🇱 91.92.40.35

🇨🇦 54.39.210.16

🇺🇸 18.221.179.104

🇬🇧 2.57.17.87

🇫🇮 213.232.120.102

🇧🇷 190.89.159.189

🇸🇪 172.234.113.166

🇺🇸 162.216.149.80

🇨🇦 148.113.128.184

🇨🇦 148.113.128.20

🇨🇳 119.96.81.99

🇸🇬 103.189.234.9

🇺🇸 74.82.47.3

🇺🇸 67.52.95.38

🇺🇸 54.193.105.107

🇨🇦 54.39.136.48

🇸🇬 47.237.164.35

🇳🇱 45.148.10.147

🇺🇸 45.33.110.79