JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.109.92.208

20.109.92.208 was found in our database!

This IP was reported 31 times. Confidence of Abuse is 69%: ?

69%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.109.92.208

Whois 20.109.92.208

IP Abuse Reports for 20.109.92.208:

This IP address has been reported a total of 31 times from 26 distinct sources. 20.109.92.208 was first reported on April 6th 2026, and the most recent report was 2 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇧🇷 SOC Blue Team	2026-06-02 05:28:06 (2 days ago)	IPs get by Hunting on SIEM	Phishing Web Spam Port Scan Hacking
🇺🇸 TPI-Abuse	2026-06-02 04:46:04 (2 days ago)	(mod_security) mod_security (id:210492) triggered by 20.109.92.208 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.109.92.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 00:45:55.026079 2026] [security2:error] [pid 28315:tid 28315] [client 20.109.92.208:2725] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.96"] [uri "/.git/HEAD"] [unique_id "ah5gA_xNGiVl4xQCyf9ufgAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-06-02 02:43:52 (2 days ago)	Honeypot hit: Empty payload (likely service probe); 2083 [1], 2082 [1], 2087 [1] TCP Reported by: ht ... show more Honeypot hit: Empty payload (likely service probe); 2083 [1], 2082 [1], 2087 [1] TCP Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB show less	Port Scan
🇹🇭 Sawasdee	2026-06-02 01:51:39 (2 days ago)	Port Scan ...	Port Scan
🇫🇷 ISPLtd	2026-06-02 01:44:42 (2 days ago)	Jun 1 22:44:42 20.109.92.208 TCP SPT=2863 DPT=2087 SYN Jun 1 22:44:42 20.109.92.208 TCP SPT=2576 D ... show more Jun 1 22:44:42 20.109.92.208 TCP SPT=2863 DPT=2087 SYN Jun 1 22:44:42 20.109.92.208 TCP SPT=2576 DPT=8080 SYN Jun 1 22:44:42 20.109.92.208 TCP SPT=1937 DPT=2082 ... show less	Port Scan
🇷🇺 6o6ep	2026-06-02 01:11:16 (2 days ago)	connection via IP or to a non-existent subdomain: GET /.git/HEAD HTTP/1.1	Port Scan Hacking Web App Attack
🇷🇸 Scan	2026-06-02 00:05:20 (2 days ago)	MultiHost/MultiPort Probe, Scan, Hack -	Port Scan Hacking
🇬🇧 Deveroonie	2026-06-01 23:37:29 (2 days ago)	20.109.92.208 - - [01/Jun/2026:23:37:28 +0000] "GET /.git/config HTTP/1.1" 404 196 "-" "Mozilla/5.0 ... show more 20.109.92.208 - - [01/Jun/2026:23:37:28 +0000] "GET /.git/config HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" ... show less	Brute-Force Bad Web Bot Web App Attack
🇧🇷 Vieira Filho	2026-06-01 23:23:35 (2 days ago)	20.109.92.208 - - [01/Jun/2026:20:23:35 -0300] [35.198.31.82] "35.198.31.82" "GET /.env HTTP/1.1" 4 ... show more 20.109.92.208 - - [01/Jun/2026:20:23:35 -0300] [35.198.31.82] "35.198.31.82" "GET /.env HTTP/1.1" 404 571 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36" 0.000 ... show less	Brute-Force Web App Attack Exploited Host
🇺🇸 Rayulcifer	2026-04-18 20:39:59 (1 month ago)	20.109.92.208 - - [18/Apr/2026:15:39:28 -0500] "CONNECT ip-count.dstat.uk:443 HTTP/1.1" 502 544 "-" ... show more 20.109.92.208 - - [18/Apr/2026:15:39:28 -0500] "CONNECT ip-count.dstat.uk:443 HTTP/1.1" 502 544 "-" "-" 20.109.92.208 - - [18/Apr/2026:15:39:58 -0500] "CONNECT ip-count.dstat.uk:443 HTTP/1.1" 502 544 "-" "-" ... show less	Open Proxy Port Scan Hacking Web App Attack SSH
🇺🇸 TPI-Abuse	2026-04-12 06:39:23 (1 month ago)	(mod_security) mod_security (id:210492) triggered by 20.109.92.208 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210492) triggered by 20.109.92.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 12 02:39:18.861555 2026] [security2:error] [pid 3568482:tid 3568482] [client 20.109.92.208:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.cloudex.click"] [uri "/.git/config"] [unique_id "ads-FrTE3JOZT21GySO8ggAAAA4"] show less	Brute-Force Bad Web Bot Web App Attack
🇦🇹 nomzamo	2026-04-12 06:37:51 (1 month ago)	Fail2Ban reported: nginx-credential-scan	Brute-Force Bad Web Bot
🇮🇩 Burayot	2026-04-12 06:27:40 (1 month ago)	LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.109.92.208 (US/United States/-): ... show more LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 20.109.92.208 (US/United States/-): 2 in the last 3600 secs show less	Web App Attack
🇳🇱 Savvii	2026-04-12 05:55:02 (1 month ago)	20 attempts against mh-misbehave-ban on ficus	Brute-Force Bad Web Bot Web App Attack
🇳🇱 homeshowdomain.nl	2026-04-07 21:59:03 (1 month ago)	Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ... show more Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-04-06. show less	Web App Attack SSH Hacking

Showing 1 to 15 of 31 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇨🇳 220.167.232.123

🇬🇧 217.146.80.101

🇧🇪 198.235.24.167

🇻🇳 160.191.244.158

🇩🇪 130.12.181.107

🇨🇳 124.174.126.18

🇹🇭 118.193.56.229

🇧🇩 103.183.62.0

🇳🇬 102.88.137.213

🇷🇺 85.239.39.61

🇫🇷 51.68.236.71

🇨🇴 190.250.108.32

🇻🇳 152.32.250.21

🇨🇳 120.220.48.51

🇨🇳 112.47.61.99

🇷🇴 2.57.121.112

🇧🇪 198.235.24.166

🇳🇱 185.223.235.14

🇨🇳 121.4.80.85

🇨🇳 106.13.222.229