AbuseIPDB » 20.58.6.132

Check an IP Address, Domain Name, or Subnet

e.g. 3.235.186.94, microsoft.com, or 5.188.10.0/24

20.58.6.132 was found in our database!

This IP was reported 81 times. Confidence of Abuse is 0%: ?

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
Domain Name	microsoft.com
Country	United Kingdom of Great Britain and Northern Ireland
City	London, England

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 20.58.6.132

Whois 20.58.6.132

IP Abuse Reports for 20.58.6.132:

This IP address has been reported a total of 81 times from 39 distinct sources. 20.58.6.132 was first reported on September 25th 2022, and the most recent report was 3 months ago.

Old Reports: The most recent abuse report for this IP address is from 3 months ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	Date	Comment	Categories
jk jk	26 Sep 2022	WAF_blocked	Hacking Web App Attack
whitehoodie	26 Sep 2022	AUTOMATED REPORT: Tried to access .env file	Hacking Bad Web Bot Web App Attack
nyclee.net	26 Sep 2022	WebApp Attack	Brute-Force Web App Attack
QUADEMU Abuse	26 Sep 2022	[New] Noxious/Nuisible/вредоносный Host.	Port Scan Brute-Force
hermawan	26 Sep 2022	[Tue Sep 27 04:46:53.213986 2022] [-:error] [pid 186737:tid 139865989035584] [client 20.58.6.132:525 ... show more[Tue Sep 27 04:46:53.213986 2022] [-:error] [pid 186737:tid 139865989035584] [client 20.58.6.132:52591] [client 20.58.6.132] ModSecurity: Access denied with code 403 (phase 1). Match of "pm karangploso.jatim.bmkg.go.id search.brave.com staklim-jatim.bmkg.go.id staklim-malang.info matomo.staklim-malang.info" against "REQUEST_HEADERS:Host" required. [file "/etc/modsecurity/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "10"] [id "440217"] [msg "Not Current Hostname"] [data "Matched Data: found within REQUEST_HEADERS:Host: 103.166.156.58 request_line = GET /.env HTTP/1.1"] [severity "NOTICE"] [hostname "103.166.156.58"] [uri "/.env"] [unique_id "YzIdzet9adEUf06DdL__zQAAAPE"] [103.166.156.58] [karangploso.jatim.bmkg.go.id] top=[187057] [o4o8dzNirYA] [YzIdzet9adEUf06DdL__zQAAAPE] keep_alive=[0] [2022-09-27 04:46:53.213994] [R:YzIdzet9adEUf06DdL__zQAAAPE] UA:'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36' ... show less	Hacking Web App Attack
Vaction	26 Sep 2022	20.58.6.132 - - [26/Sep/2022:22:30:04 +0200] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (X11; Lin ... show more20.58.6.132 - - [26/Sep/2022:22:30:04 +0200] "GET /.env HTTP/1.1" 404 397 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Hacking Bad Web Bot Web App Attack
Anonymous	26 Sep 2022	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
RF68	25 Sep 2022	20.58.6.132 [26/Sep/2022 ""Spam host detected, attacker try to exploit known vulnerabilities""]<br / ... show more20.58.6.132 [26/Sep/2022 ""Spam host detected, attacker try to exploit known vulnerabilities""] ... show less	Web Spam Exploited Host Web App Attack
someone	25 Sep 2022	:80 20.58.6.132 - - [26/Sep/2022:04:05:21 +0200] "GET /.env HTTP/1.1" 403 2821 "-" "Mozilla/5.0 (X1 ... show more:80 20.58.6.132 - - [26/Sep/2022:04:05:21 +0200] "GET /.env HTTP/1.1" 403 2821 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" show less	Web App Attack
kolya	25 Sep 2022	[26/09/2022 00:50:43] Unauthorized connection attempt to port 80, server 2252f372.	Port Scan
4server	25 Sep 2022	[MonSep2602:49:04.6375992022][:error][pid10108:tid47312776763136][client20.58.6.132:59014][client20. ... show more[MonSep2602:49:04.6375992022][:error][pid10108:tid47312776763136][client20.58.6.132:59014][client20.58.6.132]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\\\.ini\\|web.config\)\\\\\\\\b\\|$\\|\^\\|\\\\\\\\.\\\\\\\\.$/etc/\\|/\\\\\\\\.$\?:history\\|bash_history\\|sh_history\\|env$\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"189\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"81.17.25.249\"][uri\"/.env\"][unique_id\"YzD3AGu8PuGKCKJ_WlQ4jAAAAJM\"][MonSep2602:49:04.9981822022][:error][pid10259:tid47312776763136][client20.58.6.132:59307][client20.58.6.132]ModSecurity:Accessdeniedwithcode403$phase2$.Patternmatch\"$\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\\|passwd\\|group$\\|www_\?acl\)\\|global\\\\\\\\.asa\\|httpd\\\\\\\\.conf\\|boot\\\\\\ show less	Blog Spam
Anonymous	25 Sep 2022		DNS Compromise DDoS Attack
Anonymous	25 Sep 2022	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
ut-addicted.com	25 Sep 2022	\[Sun Sep 25 22:01:15.602828 2022\] \[:error\] \[pid 3204:tid 139932748175104\] \[client 20.58.6.132 ... show more\[Sun Sep 25 22:01:15.602828 2022\] \[:error\] \[pid 3204:tid 139932748175104\] \[client 20.58.6.132:63995\] \[client 20.58.6.132\] ModSecurity: Access denied with code 403 $phase 2$. Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded $Total Score: 8$"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/.env"\] \[unique_id "YzCziwWd30ZIqBeHqibkwgAAAMs"\] show less	Brute-Force Web App Attack
iNetWorker	25 Sep 2022	trolling for resource vulnerabilities	Web App Attack