JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.109.87.117

20.109.87.117 was found in our database!

This IP was reported 165 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.109.87.117

Whois 20.109.87.117

IP Abuse Reports for 20.109.87.117:

This IP address has been reported a total of 165 times from 135 distinct sources. 20.109.87.117 was first reported on August 24th 2025, and the most recent report was 15 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 acadeova	2026-06-04 06:30:19 (15 hours ago)	Blocked by UFW on vps4 [9849/tcp] Source port: 3145 TTL: 239 Packet length: 40 TOS: 0x00 This repor ... show more Blocked by UFW on vps4 [9849/tcp] Source port: 3145 TTL: 239 Packet length: 40 TOS: 0x00 This report was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
🇦🇹 urnilxfgbez	2026-06-03 22:45:00 (23 hours ago)	Last 24 Hours suspicious: (DPT=445\|DPT=3389\|DPT=22\|DPT=3306\|DPT=8080\|DPT=23\|DPT=5900\|DPT=1433)	Port Scan
Anonymous	2026-06-03 05:56:08 (1 day ago)	Honeypot hit: Empty payload (likely service probe); 2086 [1] TCP Reported by: https://github.com/sef ... show more Honeypot hit: Empty payload (likely service probe); 2086 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
Anonymous	2026-06-03 05:18:13 (1 day ago)	Jun 3 01:18:12 localhost kernel: [108809208.100741] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:9 ... show more Jun 3 01:18:12 localhost kernel: [108809208.100741] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=20.109.87.117 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x40 TTL=46 ID=63830 DF PROTO=TCP SPT=18460 DPT=2087 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 3 01:18:12 localhost kernel: [108809208.100767] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=20.109.87.117 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x40 TTL=46 ID=63830 DF PROTO=TCP SPT=18460 DPT=2087 SEQ=721649921 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405A00402080A6AD2C9DA000000000103030A) Jun 3 01:18:12 localhost kernel: [108809208.108300] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0:1e:08:00 SRC=20.109.87.117 DST=[mungedIP2] LEN=60 TOS=0x00 PREC=0x40 TTL=45 ID=28162 DF PROTO=TCP SPT=18447 DPT=8443 WINDOW=64240 RES=0x00 SYN URGP=0 Jun 3 01:18:12 localhost kernel: [108809208.109941] iptables_INPUT_denied: IN=eth0 OUT= MAC=f2:3c:91:84:83:95:00:00:0c:9f:f0: show less	Port Scan
🇧🇷 chronos	2026-06-03 05:03:27 (1 day ago)	Web traffic. Possible probing or exploitation attempts. \| Port: 443 \| Proto: TCP \| Location: United ... show more Web traffic. Possible probing or exploitation attempts. \| Port: 443 \| Proto: TCP \| Location: United States, Boydton show less	Port Scan Hacking Brute-Force
Anonymous	2026-06-03 04:35:32 (1 day ago)	T: f2b 404 5x	Web App Attack
🇺🇸 xmission.com	2026-06-03 04:11:03 (1 day ago)	Blocked by UFW (TCP on 8080) Source port: 18615 TTL: 48 Packet length: 60 TOS: 0x00 This report (fo ... show more Blocked by UFW (TCP on 8080) Source port: 18615 TTL: 48 Packet length: 60 TOS: 0x00 This report (for 20.109.87.117) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan Web App Attack
🇺🇸 MPL	2026-06-03 04:08:26 (1 day ago)	tcp port scan (7 or more attempts)	Port Scan
🇩🇪 Axel	2026-06-03 03:41:52 (1 day ago)	[2026-06-03 03:41:52 UTC] Honeypot HTTPS-Alt connection attempt \| AXFRA HONEYPOT	Web App Attack
🇺🇸 Starburst SysOp Team	2026-06-03 03:22:40 (1 day ago)	Host header is a numeric IP address. Pattern match "(?:^( (920350-mnz6-7)	Hacking Bad Web Bot
🇮🇪 AutosOnShow	2026-06-03 03:16:06 (1 day ago)	blocked for webapp attack \| path requested: /.git/config \| seen at 2026-06-03 03:15:30.828 \|	Web App Attack
🇳🇱 StopAbuse	2026-06-03 03:11:38 (1 day ago)	tcp/2083 tcp/443 tcp/8080 tcp/8443	Port Scan
🇹🇷 Threat.live	2026-06-03 03:05:06 (1 day ago)	Suspicious Connection Attempts	Brute-Force
🇬🇧 sandra361	2026-06-03 02:54:01 (1 day ago)	Port scan detected: 7 attempts across 7 ports (2082,2083,2086,443,80,8080,8443). \| Evidence: GHOST_S ... show more Port scan detected: 7 attempts across 7 ports (2082,2083,2086,443,80,8080,8443). \| Evidence: GHOST_SCAN:IN=enp1s0f0 OUT= SRC=20.109.87.117 LEN=60 TOS=0x00 PREC=0x00 TTL=41 ID=40103 DF PROTO=TCP SPT=27726 DPT=2082 WINDOW=64240 RES=0x00 SYN URGP=0 show less	Port Scan
🇩🇰 SaltySoftworks	2026-06-03 02:36:34 (1 day ago)	Connecting to IP instead of domain name Page: /___proxy_subdomain_whm/login/?login_only=1	Hacking Web App Attack Brute-Force

Showing 1 to 15 of 165 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇴 181.50.102.225

🇫🇷 152.228.133.93

🇩🇪 109.91.4.177

🇨🇦 85.217.149.68

🇳🇱 45.148.10.151

🇨🇳 220.167.233.243

🇨🇳 182.43.164.191

🇨🇳 120.229.47.124

🇨🇳 110.228.36.25

🇮🇩 108.136.131.13

🇺🇸 64.62.197.112

🇦🇷 45.230.80.52

🇳🇱 45.148.10.35

🇶🇦 2001:1a10:195e:e900:a9f6:199c:8704:2709

🇰🇷 220.86.28.189

🇹🇼 198.235.24.72

🇻🇳 171.244.141.86

🇳🇱 159.223.238.255

🇨🇳 129.28.84.30

🇷🇴 92.118.39.225