AbuseIPDB » 20.97.113.197

20.97.113.197 was found in our database!

This IP was reported 28 times. Confidence of Abuse is 42%: ?

42%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
Domain Name	microsoft.com
Country	United States of America
City	San Antonio, Texas

IP info including ISP, Usage Type, and Location provided by IP2Location. Updated monthly.

Report 20.97.113.197

Whois 20.97.113.197

IP Abuse Reports for 20.97.113.197:

This IP address has been reported a total of 28 times from 25 distinct sources. 20.97.113.197 was first reported on May 27th 2023, and the most recent report was 4 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 4 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
mawan	2024-09-13 22:46:52 (4 weeks ago)	Suspected of having performed illicit activity on AMS server.	Web App Attack
Incidents Response Neptus Team	2024-09-13 20:50:00 (4 weeks ago)	Report Abuse IP	Hacking Exploited Host Web App Attack
blik2108	2024-09-13 18:56:45 (1 month ago)	vm20.blacknell.co.uk:443 20.97.113.197 - - [13/Sep/2024:19:56:43 +0100] "GET /config/aws.yml HTTP/1. ... show morevm20.blacknell.co.uk:443 20.97.113.197 - - [13/Sep/2024:19:56:43 +0100] "GET /config/aws.yml HTTP/1.1" 404 521 "-" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" vm20.blacknell.co.uk:443 20.97.113.197 - - [13/Sep/2024:19:56:44 +0100] "GET /config.js HTTP/1.1" 404 521 "-" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" vm20.blacknell.co.uk:443 20.97.113.197 - - [13/Sep/2024:19:56:44 +0100] "GET /config/config.json HTTP/1.1" 404 521 "-" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36" vm20.blacknell.co.uk:443 20.97.113.197 - - [13/Sep/2024:19:56:44 +0100] "GET /wp-config.php.bak HTTP/1.1" 404 521 "-" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/ ... show less	Brute-Force Web App Attack
globcom	2024-09-13 18:27:47 (1 month ago)	General hacking/exploits/scanning	Web App Attack
Anonymous	2024-09-13 14:02:38 (1 month ago)	20.97.113.197 - - \[13/Sep/2024:22:02:37 +0800\] \"GET /admin/.env HTTP/1.1\" 404 43834 \"-\" \"Mozi ... show more20.97.113.197 - - \[13/Sep/2024:22:02:37 +0800\] \"GET /admin/.env HTTP/1.1\" 404 43834 \"-\" \"Mozilla/5.0 \(Linux\; Android 7.0\; SM-G892A Build/NRD90M\; wv\) AppleWebKit/537.36 \(KHTML, like Gecko\) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36\" show less	Web App Attack
findlab	2024-09-13 13:00:04 (1 month ago)	Backdrop CMS module - malicious activity detected	Bad Web Bot Web App Attack
zynex	2024-09-13 11:57:58 (1 month ago)	URL Probing: /admin/.env	Web App Attack
Anonymous	2024-09-13 10:25:48 (1 month ago)	RdpGuard detected brute-force attempt on HTTP	Brute-Force
Anonymous	2024-09-13 10:17:44 (1 month ago)	Aggressive web scan	Web App Attack
Anonymous	2024-09-13 10:05:02 (1 month ago)	\| Suspicious URL access.	Hacking SQL Injection Web App Attack
Anonymous	2024-09-13 09:44:34 (1 month ago)	Bot / scanning and/or hacking attempts: GET /sftp-config.json HTTP/1.1, GET /aws.yml HTTP/1.1, GET / ... show moreBot / scanning and/or hacking attempts: GET /sftp-config.json HTTP/1.1, GET /aws.yml HTTP/1.1, GET /config/config.json HTTP/1.1, GET /wp-config.php.old HTTP/1.1, GET /?pp=env&pp=env HTTP/1.1, GET /login?pp=enable&pp=env HTTP/1.1, GET /sftp.json HTTP/1.1, GET /_profiler/phpinfo.php HTTP/1.1, GET /phpinfos.php HTTP/1.1, GET /config.php HTTP/1.1, GET /?pp=enable&pp=env HTTP/1.1, GET /helpers/utility.js HTTP/1.1, GET /.vscode/settings.json HTTP/1.1, GET /.env.bak HTTP/1.1, GET /wp-config.php.bak HTTP/1.1, GET /.ssh/sftp-config.json HTTP/1.1, GET /config.js HTTP/1.1, GET /config/aws.yml HTTP/1.1, GET /prevlaravel/sftp-config.json HTTP/1.1, GET /.aws/credentials HTTP/1.1, GET /.vscode/sftp.json HTTP/1.1, GET /settings.php HTTP/1.1, GET /includes/config.php HTTP/1.1, GET /includes/settings.php HTTP/1.1, GET /config/config.php HTTP/1.1, GET /config/settings.php HTTP/1.1 show less	Hacking Web App Attack
Guardian	2024-09-13 09:20:33 (1 month ago)	Multi abuses [2]: Unauthorized connection attempt / Port scanning, Unauthorized attempt to retrieve ... show moreMulti abuses [2]: Unauthorized connection attempt / Port scanning, Unauthorized attempt to retrieve configuration file 20.97.113.197 [13/Sep/2024:09:20:32] "GET / HTTP/1.1" 20.97.113.197 [13/Sep/2024:09:20:32] "GET /.env HTTP/1.1" show less	Port Scan Web App Attack
Anonymous	2024-09-13 09:17:06 (1 month ago)	(mod_security) mod_security triggered on hostname [redacted])	SQL Injection
TPI-Abuse	2024-09-13 08:45:39 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 20.97.113.197 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 20.97.113.197 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 13 04:45:33.020130 2024] [security2:error] [pid 31120:tid 31120] [client 20.97.113.197:52734] [client 20.97.113.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.groz.net"] [uri "/.env"] [unique_id "ZuP7rfbdDzqLvVi8xI0_QwAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
mgarofano80	2024-09-02 05:17:33 (1 month ago)		Brute-Force Web App Attack