AbuseIPDB » 57.159.25.113

57.159.25.113 was found in our database!

This IP was reported 36 times. Confidence of Abuse is 43%: ?

43%

ISP	Microsoft Limited UK
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	India
City	Pune, Maharashtra

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 57.159.25.113

Whois 57.159.25.113

IP Abuse Reports for 57.159.25.113:

This IP address has been reported a total of 36 times from 15 distinct sources. 57.159.25.113 was first reported on May 16th 2025, and the most recent report was 3 weeks ago.

Old Reports: The most recent abuse report for this IP address is from 3 weeks ago. It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
SkyDancer	2025-05-20 20:30:12 (3 weeks ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show moreMultiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force
Vegascosmetics	2025-05-18 21:53:15 (4 weeks ago)	Kingcopy(AI-IDS): IP is wandering around the site and acting suspiciously.	Bad Web Bot
TPI-Abuse	2025-05-17 15:47:18 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 17 11:47:14.751050 2025] [security2:error] [pid 1384718:tid 1384718] [client 57.159.25.113:38088] [client 57.159.25.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "leadek.com"] [uri "/.env"] [unique_id "aCivgjhg7sIQ0Eh_lSVQZAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
SkyDancer	2025-05-17 15:04:58 (4 weeks ago)	Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blo ... show moreMultiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X). show less	Hacking Brute-Force
TPI-Abuse	2025-05-17 14:50:50 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 17 10:50:47.350384 2025] [security2:error] [pid 2138673:tid 2138673] [client 57.159.25.113:37624] [client 57.159.25.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ardglasspugs.com"] [uri "/.env"] [unique_id "aCiiR6aOnEP1OWc8PoEZtAAAAAA"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-05-17 14:32:57 (4 weeks ago)	(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 17 10:32:49.288973 2025] [security2:error] [pid 3566695:tid 3566695] [client 57.159.25.113:39796] [client 57.159.25.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ferhardi.com"] [uri "/.env"] [unique_id "aCieEfHkMxKDY-cw5emKwAAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
kosada.com	2025-05-17 12:48:56 (1 month ago)	Web vulnerability probing	Web App Attack
Anonymous	2025-05-17 12:22:33 (1 month ago)	Bot / scanning and/or hacking attempts: GET /.env HTTP/1.1, GET / HTTP/1.1	Hacking Web App Attack
Anonymous	2025-05-17 12:18:03 (1 month ago)	Fuzzing/Looking for credentials files.	Brute-Force Web App Attack
TPI-Abuse	2025-05-17 10:31:05 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 17 06:30:57.656973 2025] [security2:error] [pid 2944137:tid 2944137] [client 57.159.25.113:50314] [client 57.159.25.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kontikimotorcycles.com"] [uri "/.env"] [unique_id "aChlYUe4xjBNQZiEeY5tDgAAAAU"] show less	Brute-Force Bad Web Bot Web App Attack
TPI-Abuse	2025-05-17 09:38:10 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 17 05:38:05.019679 2025] [security2:error] [pid 18998:tid 18998] [client 57.159.25.113:52086] [client 57.159.25.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bikinipageone.com"] [uri "/.env"] [unique_id "aChY_abfgBEJfClJCwS6mgAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
Jim Keir	2025-05-17 09:26:11 (1 month ago)	2025-05-17 09:26:10 57.159.25.113 File scanning, blocking 57.159.25.113 for 5 minutes	Web App Attack
4server	2025-05-17 08:48:40 (1 month ago)	[SatMay1710:48:38.3743092025][security2:error][pid3211525:tid3211547][client57.159.25.113:0][client5 ... show more[SatMay1710:48:38.3743092025][security2:error][pid3211525:tid3211547][client57.159.25.113:0][client57.159.25.113]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\b\(\?:\\\\\\\\.\(\?:ht\(\?:access\|passwd\|group\)\|www_\?acl\)\|global\\\\\\\\.asa\|httpd\\\\\\\\.conf\|boot\\\\\\\\.ini\|web.config\)\\\\\\\\b\|\(\|\^\|\\\\\\\\.\\\\\\\\.\)/etc/\|/\\\\\\\\.\(\?:history\|bash_history\|sh_history\|env\)\$\)\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"204\"][id\"390709\"][rev\"30\"][msg\"Atomicorp.comWAFRules:Attempttoaccessprotectedfileremotely\"][data\"/.env\"][severity\"CRITICAL\"][hostname\"worldgoldfundltd.com\"][uri\"/.env\"][unique_id\"aChNZiyn-5Fe8h7uq41ivwAAAQ4\"] show less	Port Scan Brute-Force Web App Attack
Anonymous	2025-05-17 08:38:04 (1 month ago)	Fail2ban block	Brute-Force Exploited Host Web App Attack
TPI-Abuse	2025-05-17 08:23:40 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Port ... show more(mod_security) mod_security (id:210492) triggered by 57.159.25.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 17 04:23:37.151070 2025] [security2:error] [pid 249434:tid 249434] [client 57.159.25.113:35678] [client 57.159.25.113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "digitaltom.com"] [uri "/.env"] [unique_id "aChHiWBkbcZWLosihkNKxAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩