AbuseIPDB » 31.59.20.212
31.59.20.212
This IP was reported 6 times. Confidence of
Abuse
is 0% : ?
ISP
PT Goer Network Indonesia
Usage Type
Data Center/Web Hosting/Transit
ASN
AS205544
Domain Name
atharva.co.id
Country
🇬🇧
United Kingdom of Great Britain and Northern Ireland
City
London, England
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 31.59.20.212 :
This IP address has been reported a total of
6
times from
4 distinct
sources.
31.59.20.212 was first reported on
March 28th 2025 , and the most recent report was
2 months ago
Old Reports:
The most recent abuse report for this IP address is from
2 months ago
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇮🇩
Burayot
2026-03-26 23:51:30
(2 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 31.59.20.212 (GB/United Kingdom/-): ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 31.59.20.212 (GB/United Kingdom/-): 1 in the last 3600 secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 11:49:51
(7 months ago)
(mod_security) mod_security (id:211190) triggered by 31.59.20.212 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:211190) triggered by 31.59.20.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 06:49:47.292089 2025] [security2:error] [pid 11034:tid 11034] [client 31.59.20.212:44229] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||ftp.nbcnewsradio.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /poc.jsp?cmd=cat+%2Fetc%2Fpasswd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftp.nbcnewsradio.com"] [uri "/poc.jsp"] [unique_id "aRXF21mYmj4I-2eqJP2n0AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
dayda.net
2025-10-13 03:22:40
(8 months ago)
page=acymailing_front&ctrl=frontusers&ctrl=frontusers&noheader=1&user[email][email protected] &task=s ...
show more
page=acymailing_front&ctrl=frontusers&ctrl=frontusers&noheader=1&user[email][email protected] &task=subscribe&option=acymailing&redirect=https://example.com&ajax=0&acy_source=widget%202&hiddenlists=1&acyformname=formAcym93841&acysubmode=widget_acym
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-07-26 23:34:14
(10 months ago)
(mod_security) mod_security (id:221260) triggered by 31.59.20.212 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 31.59.20.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 19:33:30.771431 2025] [security2:error] [pid 26224:tid 26566] [client 31.59.20.212:41757] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||mail.kettlehill.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.net"] [uri "/cgi-bin/status/login.php"] [unique_id "aIVlyvTFOSR3bM1_Ra8WUwAAAM0"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-29 19:13:18
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 31.59.20.212 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.59.20.212 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 15:13:07.884411 2025] [security2:error] [pid 3270280:tid 3270280] [client 31.59.20.212:40657] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.farmers123.com"] [uri "/wp-config.php.old"] [unique_id "aDixw2tGr94jIoQc2UjNpwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-03-28 10:20:02
(1 year ago)
| PHPMyAdmin scans (looking for setup.php).
Hacking
SQL Injection
Web App Attack
Showing 1 to
6
of 6 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: