JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.114.175.89

20.114.175.89 was found in our database!

This IP was reported 562 times. Confidence of Abuse is 100%: ?

100%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.114.175.89

Whois 20.114.175.89

IP Abuse Reports for 20.114.175.89:

This IP address has been reported a total of 562 times from 443 distinct sources. 20.114.175.89 was first reported on August 21st 2026, and the most recent report was 54 seconds ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 Zydzy	2026-08-22 08:19:59 (54 seconds ago)	Automated attack detected. Server: 95.140.154.181. Jail: nginx-exploit.	Web App Attack
🇧🇷 mateus.vicente	2026-08-22 08:12:46 (8 minutes ago)	[2026-08-22T08:12:46Z] Requests to sensitive Apache endpoints and path traversal patterns. (db-srv)	Brute-Force Bad Web Bot Web App Attack
🇳🇱 donarev419	2026-08-22 08:11:57 (8 minutes ago)	Connection to port 3000 with data transfer. Data preview: HEAD / HTTP/1.1 Host: 87.229.95.155:3000 ... show more Connection to port 3000 with data transfer. Data preview: HEAD / HTTP/1.1 Host: 87.229.95.155:3000 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10 show less	Port Scan Hacking
🇳🇱 JCB	2026-08-22 08:04:00 (16 minutes ago)	20.114.175.89 - - [21/Aug/2026:17:15:00 +0300] "GET /.env.bak HTTP/1.1" 403 239 "-" "Mozilla/5.0 (iP ... show more 20.114.175.89 - - [21/Aug/2026:17:15:00 +0300] "GET /.env.bak HTTP/1.1" 403 239 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1" 20.114.175.89 - - [21/Aug/2026:17:15:00 +0300] "GET /.env.production HTTP/1.1" 403 239 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1" ... show less	Web App Attack Hacking
🇺🇸 NeverBehave	2026-08-22 08:02:33 (18 minutes ago)	[fail2ban] service ocserv jail	Brute-Force Web App Attack
🇳🇱 Mr. Sky	2026-08-22 08:02:21 (18 minutes ago)	Automated web application probing detected against a public web server. 14 suspicious requests 9 cr ... show more Automated web application probing detected against a public web server. 14 suspicious requests 9 critical requests Observed requests: GET /v1/models GET /terraform.tfstate GET /serviceAccountKey.json Risk level: CRITICAL Reference: STI-20260822-100221-20-114-175-89 show less	Web App Attack
🇩🇪 Ano_Nym	2026-08-22 08:01:34 (19 minutes ago)	CrowdSec IDS alert on VPS 217.154.115.19 (DE). Scenario: crowdsecurity/http-probing	Web App Attack
🇩🇪 D3vNu11	2026-08-22 07:48:28 (32 minutes ago)	Level: (LOW): Known Attacker via CitrixHoneypot IOC Country: United States 19x -> Target Country: As ... show more Level: (LOW): Known Attacker via CitrixHoneypot IOC Country: United States 19x -> Target Country: Ashburn, USA HTTPS show less	Hacking Web App Attack
🇫🇮 kumiko	2026-08-22 07:46:48 (34 minutes ago)	[2026-08-22 10:46:48] Probing for dotfiles "GET /.config/gcloud/application_default_credentials.jso ... show more [2026-08-22 10:46:48] Probing for dotfiles "GET /.config/gcloud/application_default_credentials.json HTTP/1.1" 403 show less	Bad Web Bot Web App Attack
🇳🇱 Eric	2026-08-22 07:46:35 (34 minutes ago)	[Sat Aug 22 07:44:28.595712 2026] [security2:error] [pid 2456118:tid 2456118] [client 20.114.175.89: ... show more [Sat Aug 22 07:44:28.595712 2026] [security2:error] [pid 2456118:tid 2456118] [client 20.114.175.89:34896] [client 20.114.175.89] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "736"] [id "920350"] [msg "Host header is a numeric IP address"] [data "94.209.38.171:443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "94.209.38.171"] [uri "/"] [unique_id "aolTXCAB1q2FcaiDQNoCkwAAABA"] [Sat Aug 22 07:44:29.009742 2026] [security2:error] [pid 2456142:tid 2456142] [client 20.114.175.89:34902] [client 20.114.175.89] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "736"] [id "920 ... show less	Hacking Web App Attack
Anonymous	2026-08-22 07:44:51 (36 minutes ago)	...	Bad Web Bot
🇯🇵 weils.net	2026-08-22 07:36:59 (43 minutes ago)	2026-08-22 15:36:59(GMT+8) - /config.php	Bad Web Bot
🇫🇷 omartin	2026-08-22 07:35:33 (45 minutes ago)	Critical Vulnerability Scan detected	Hacking Brute-Force Exploited Host Web App Attack
🇫🇷 LRNP	2026-08-22 07:32:15 (48 minutes ago)	_:80 20.114.175.89 - - [22/Aug/2026:07:31:58 +0000] "GET /.env HTTP/1.1" 404 181 "http://78.203.93.6 ... show more _:80 20.114.175.89 - - [22/Aug/2026:07:31:58 +0000] "GET /.env HTTP/1.1" 404 181 "http://78.203.93.66:80/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" ... show less	Bad Web Bot Web App Attack
🇺🇸 paulo.apoloni	2026-08-22 07:20:56 (59 minutes ago)	20.114.175.89 - - [22/Aug/2026:04:20:55 -0300] "GET /.git/HEAD HTTP/1.1" 404 181 "http://64.20.49.23 ... show more 20.114.175.89 - - [22/Aug/2026:04:20:55 -0300] "GET /.git/HEAD HTTP/1.1" 404 181 "http://64.20.49.231:80/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.114.175.89 - - [22/Aug/2026:04:20:55 -0300] "GET /.git/config HTTP/1.1" 404 181 "http://64.20.49.231:80/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.114.175.89 - - [22/Aug/2026:04:20:55 -0300] "GET /.aws/credentials HTTP/1.1" 404 181 "http://64.20.49.231:80/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.114.175.89 - - [22/Aug/2026:04:20:55 -0300] "GET /.aws/config HTTP/1.1" 404 181 "http://64.20.49.231:80/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 20.114.175.89 - - [22/Aug/2026:04:20:55 -0300] "GET /.env.bak HTTP/1.1" 404 181 "http://64.20.49.231:80/" ... show less	Web App Attack

Showing 1 to 15 of 562 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇬🇧 213.229.107.29

🇺🇸 104.28.152.174

🇺🇸 35.185.61.205

🇫🇷 2001:861:3886:a310:5df0:9766:c741:7846

🇺🇸 2001:470:2cc:1::1db

🇵🇭 210.213.251.146

🇵🇱 194.180.49.220

🇬🇧 193.163.125.87

🇫🇷 176.186.167.66

🇺🇸 134.209.53.36

🇮🇷 109.94.164.170

🇨🇳 106.75.232.21

🇬🇧 35.203.210.176

🇦🇪 31.215.129.96

🇩🇪 31.70.97.107

🇬🇧 217.154.35.203

🇧🇷 177.223.254.68

🇹🇭 171.4.222.135

🇨🇦 138.197.164.175

🇻🇳 113.189.87.100